Credit Freeze: Protecting Your Identity, Preventing New Account Fraud

Executive Summary

Identity theft is the fastest growing crime in America today and directly impacts businesses and consumers alike. The Federal Trade Commission estimates that the cost to victims per incident of identity theft tops $1,000, while the cost to businesses climbs to $10,000.

It is a devastating problem for Georgia consumers as incidences of identity theft occur statewide on an increasingly frequent basis. In fact, Atlanta ranks 14th in the country for identity theft, according to a report issued in October 2007 by the Identity Theft Resource Center.

Credit freeze, which severely limits access to an individual’s credit file, is the single most effective tool to fight new account fraud, a devastating form of identity theft which occurs when a thief opens a line of credit in a victim’s name. It is far more powerful than fraud alerts or credit monitoring services, which simply inform the victim after a crime has already been committed.

Three bills that would have authorized credit freeze protection in Georgia were introduced during the 2007 General Assembly. State legislators did not take a vote on any of the bills, so all three are still eligible for action in the 2008 legislative session. Already, 39 states and the District of Columbia have enacted credit freeze laws that protect their citizens from identity thieves committing new account fraud.

Moreover, beginning in Fall 2007, all three major credit reporting agencies will offer credit freeze in all 50 states, regardless of state legislation. Experian and TransUnion will each charge consumers $10 to place, lift or temporarily thaw a credit file. Equifax has yet to announce the terms of its freeze.

The cost of a credit freeze is strongly determinative of the extent to which it will be utilized by consumers. Credit freeze laws across the country vary widely in terms of cost, but a $10 fee is at the high end. Additionally, while these proactive industry moves are step in the right direction, they merely represent an industry trend that could change at any time.

A Georgia credit freeze law could achieve this guarantee for consumers, as well as create uniformity and fairness in the charges and structure of the credit freeze offered.

Surveys conducted in South Carolina by AARP clearly demonstrate that convenience and cost have a significant impact on consumers’ use of a credit freeze. Minimal fees and quick processing of an account freeze, temporary thaw and permanent lift are major factors that benefit consumers and the businesses that rely on quick credit decisions.

Effective legislation would make credit freeze inexpensive, convenient and accessible. It would give consumers control over their credit files and personal identifying information, and prevent new account fraud altogether.

Introduction

Identity theft is a crime in which one person impersonates another for financial or material gain by stealing and using personal identifying information, such as their birth date, Social Security number (SSN), address, and/or bank account information.

New account fraud is a form of identity theft that occurs when a thief opens a new line of credit in a victim’s name, most commonly in the form of charge cards and utility accounts. The Federal Trade Commission (FTC) estimates that approximately 60 percent of all new account fraud is credit card fraud, a crime made easy by online and mail applications.

New account fraud is an expensive crime. The FTC reports:

• Fifteen percent of all cases of identity fraud are new account fraud.[i]
• Victims of new account fraud spent an average $1,180 to report and correct their accounts. On existing accounts, they spent an average $160.[ii]
• The average victim spent 77 hours remedying their new account fraud, with a median of 25 hours in 2006. In 2007, victims spent an average of 40 hours fixing the problems caused by new account fraud.[iii]
• Victims generally do not detect new account fraud for an average of 134 days. For misuse of an existing account, it takes an average of 42 days for the victim to discover the fraud.[iv]
• Correcting problems caused by new account fraud takes approximately four times as long as correcting those of a misused existing account.[v]
• The majority of complaints about credit card fraud in 2006 were of new accounts opened illegally in the victim’s name.[vi]

According to a report issued by the Privacy Rights Clearing House in April 2007, more than 153 million records containing personal and financial information were involved in security breaches disclosed from January 2005 to April 2007. A security breach occurs when a secure database is compromised, leaving personal identifying information exposed.

Since 2006, reported data breaches have affected over three million Georgia citizens. Some examples[vii] include:

• In April 2007, approximately 75,000 Fulton County residents had their personal information compromised when voter registration cards were discovered in the trash.
• In April 2007, the Georgia Department of Community Health lost a disk with the personal information of 2.9 million PeachCare and Medicaid recipients.
• In February 2007, in its second major security breach, the U.S. Department of Veterans Affairs lost a hard drive containing the personal information of 500,000 veterans and 1 million non-VA physicians.
• In January 2007, a computer was stolen from Emory University containing personal information on more than 38,000 cancer patients treated at or by Emory University physicians.
• In March 2006, a hacker exploited a security flaw in the Georgia Technology Authority, gaining access to confidential information of 573,000 state pensioners, including SSNs and bank account details.

This information could easily be used to commit acts of identity theft, including new account fraud, as many creditors require only full names, addresses and SSNs to open accounts.

“The identity theft criminals seem to have the technology to move with lightning speed,” wrote Atlanta Journal-Constitution editorial writer Maureen Downey, in a January 9, 2007, analysis of proposed legislation.“It's time to give consumers a way to fight back to guard their personal information.”

Credit freeze is the single most effective tool against new account fraud. Some retailers have argued against credit freeze legislation, claiming consumers would not be able to take advantage of instant lines of credit and introductory discount promotions offered at many stores. In response, other states have enacted provisions to allow consumers to temporarily lift, or “thaw,” their credit freeze within 15 minutes, allowing timely inquiries by potential creditors and lenders.

Major credit reporting agencies have also resisted this legislation because the business of providing consumers’ credit histories and other information to potential creditors such as credit card companies is so lucrative. These reporting agencies also profit from offering credit monitoring services, which scan customers’ credit accounts for signs of activity. But monitoring services do not offer any real protection against identity theft, as the consumer is notified only after the crime has been committed. As recently described by one economist, monitoring services are “a case of closing the barn door after the horse has bolted.”

Credit Freeze Defined

Most lenders and creditors rely on a credit report to determine a consumer’s credit worthiness, and the information collected by the three major credit reporting agencies – Equifax, Experian and TransUnion – is crucial to opening a new line of credit or obtaining a credit card. A credit freeze stops new account fraud before it starts by restricting access to the consumer’s file and forcing most lenders to deny credit to the criminal applying for it.

Specifically, a credit freeze, or security freeze, requires the reporting agencies to block access to a consumer’s credit report and score, which is most commonly accessed by potential lenders or creditors. Although a credit freeze cannot stop abuse in existing accounts, it is the single most effective tool against new account fraud.

Federal law currently allows consumers one free copy of their credit report from all three major credit reporting agencies each year. Georgia law allows consumers two copies of their report.

Consumers are also able to place a 90-day “fraud alert” on their credit files. A fraud alert simply notifies a consumer that an inquiry has been made into their file, and advises creditors to take special precautions when issuing credit under a flagged account. Creditors are not required to contact consumers who have fraud alerts in place. Thus, even with a fraud alert in place, identity thieves can still open new accounts and obtain new lines of credit in a victim’s name.

There are three kinds of fraud alerts: an initial alert, an extended fraud alert, and a military fraud alert. An initial alert is a 90-day alert available to anyone upon request.

An extended fraud alert remains on a consumer’s file for seven years and is restricted to victims of identity theft who have proof of the theft, such as a police report. To remove the extended alert, the consumer must provide paperwork, such as a police report, to prove their identity.

A military fraud alert is provided free of charge to active duty members of the military serving overseas who are particularly vulnerable to having their identity stolen while on extended tours. Members of the military utilizing this alert do not have to be a victim of identity theft to receive the service.

Monitoring services are also available to consumers for a monthly charge that generally ranges from $9.99 to $24.99. Accounts are monitored automatically, and the consumer is notified if there is any sort of inquiry into a credit account, new account activity, address changes, collection accounts, credit limit increases, changes to existing accounts, or closing of accounts. The services are offered by or in conjunction with one of the three major credit reporting agencies.

But credit monitoring doesn’t prevent identity theft or new account fraud, and is considered by some as only offering a false sense of security instead of any real protection.

Also, a consumer is only alerted to credit inquiries when a potential creditor requests a credit check from the same reporting agency that the service is monitoring. For example, if a consumer signed up for TrueCredit, TransUnion’s credit monitoring service, any alerts received would reflect new credit requests or inquires made using TransUnion data. If a thief was attempting to buy a used car and the dealer pulled a credit report from Equifax, the consumer would not receive an alert through TrueCredit.

Georgia consumers are entitled to a free credit report from each of the three major credit reporting agencies every year. By requesting the three free reports in a staggered fashion throughout the year, and vigilantly reviewing the information for mistakes and unauthorized activity, consumers can perform many of the tasks of a credit monitoring service themselves.

 

New Account Fraud Hurts Georgians

Seven years ago, Conyers resident Chris Underwood received a notice from a collection agency seeking payment for an account he had never opened. He contacted the company and soon realized that someone had stolen his SSN, using it to start utility services and open retail charge accounts.

Chris immediately contacted police, who filed a report on his behalf. He also placed fraud alerts on his account with all three credit reporting agencies.

At this time, Chris thought he had done everything possible to protect himself. But with only a fraud alert on his account, he was still a sitting duck for identity theft and new account fraud. Within two years, the thief struck again and made online purchases using a fraudulent account set up using Chris’ name.

Chris again filed a police report, but within two more years the crime repeated itself. To this day, Chris doesn’t know how many accounts this criminal has opened in his name.

“Every couple of years, I have to go round and round with collection agencies and credit reporting agencies to clear up my credit,” Chris said. “I have filed numerous police reports.The police never take action because it's such a low priority.”

In 2006, Chris tracked the thief to an address in Buffalo, NY, after discovering that a cell phone and its accessories were bought using his name. He learned this through his own investigation. When he contacted his local police, Chris was told to contact authorities in Buffalo. The Buffalo police told him to get back in touch with his local police, who eventually filed a report after several requests. To his knowledge, there was never an inquiry made into the address in New York, and Chris feels certain the crime will happen again.

The fraud alerts on Chris’ credit file do little to stop the continuing fraud and theft.

“They really haven’t done anything,” Chris said, adding that if legislation passed, he would happily place a credit freeze on his file, as he sees it as one of the only ways the theft of his identity will stop. Until then, though, he simply waits for more fraud.

“I'm sure the next time I pull a report, something new will be on there,” he said.

Common Myths of credit freezes

Common credit freeze misconceptions include:

Myth: A credit freeze prevents consumers from accessing their credit file in a timely manner, meaning consumers with frozen accounts will not be able to make big purchases or open new lines of credit during emergencies.

Truth: Timely thaw options are available and would benefit creditors, retailers and consumers. In five states and the District of Columbia, an electronic 15-minute thaw option will go into effect on September 1, 2008. At least six more states will have the same provision effective in 2009.

Myth: A credit freeze affects current accounts.

Truth: A credit freeze in no way affects current accounts. With a freeze in place, consumers can use current credit cards and bank accounts as usual. Also, most state laws include provisions that allow current creditors to access a consumer’s account if needed, such as for refinancing. A credit freeze only prevents criminals from opening new accounts using stolen personal identifying information.

Myth: A credit freeze prevents reporting agencies from continuing to gather information about the consumer, which could allow some unscrupulous consumers to use a freeze to hide from their bad credit history and/or bad debt.

Truth: Credit freezes do not handicap a credit reporting agencies’ ability to continue gathering information on a consumer.

Credit Freezes in Georgia and in the U.S.

Thirty-nine states and the District of Columbia have authorized some form of credit freeze protection, giving their citizens the right to control their personal identifying information by prohibiting unauthorized inquiries and requests into their credit file.

(Key: State in gray have legislation that offers credit freezes. States in white do not.)

Georgia Proposals

During the 2007 Georgia General Assembly, three different credit freeze bills were introduced. None were voted out of the House Banks and Banking Committee.

Rep. Tommy Benton (R-Jefferson) introduced House Bill 35, which sets a fee of $5 per credit reporting agency to implement a freeze, to lift a freeze, or to allow a temporary thaw. A version of this bill provides that a consumer’s request for a temporary thaw or permanent lift be processed within 15 minutes by September 1, 2008.

On the same day, Rep. Rob Teilhet (D-Smyrna) proposed House Bill 38, which would make a credit freeze, permanent lift, or temporary thaw free of charge for anyone. HB 38 also mandates that a temporary thaw must be processed within three business days of the consumer’s request.

Rep. Calvin Hill (R-Woodstock) proposed House Bill 130. This bill sets a $10 fee per credit reporting agency for the freeze, lift or thaw. Similar to HB 38, HB 130 mandates that a temporary thaw be processed within three business days.

On Sine Die, the last day of the legislative session, Representatives Benton and Teilhet attempted to pass credit freeze legislation as a rider onto Senate Bill 236, a security breach bill. This substitute version of SB 236 mandated a 15-minute thaw.A procedural vote to block consideration of the added credit freeze language passed 94-67, meaning that the substitute to SB 236 with the credit freeze rider could not be considered in 2007.

Legislation and Laws in Other States

Thirty-nine states and the District of Columbia have enacted credit freeze laws, with several common exemptions and features.

While most states do charge a fee – usually ranging from $3 to $10 – to place a credit freeze, other states have enacted certain fee exemptions. Some require that no fee be charged for placing, lifting or thawing a credit freeze, including Texas, Kansas, Indiana, South Dakota and Washington. Many states, including California, Louisiana, Maine, New Hampshire and Nevada, exempt victims of identity theft from all fees associated with a credit freeze. Some do not charge seniors fees for the freeze, and others waive the fees for the initial freeze and/or thaw.

The states have similar rules for requesting a freeze: in writing and by certified mail. But states are beginning to include provisions that would allow the reporting agencies to create more options for placing, lifting or thawing a freeze, such as by regular mail, telephone, fax or secure email. At least 14 states will permit one or more of these options in the near future. As consumers are able to receive credit reports and credit scores online, there could easily be a mechanism to allow consumers to place, lift or temporarily thaw their freeze to expedite the process.

A dozen states have provisions allowing for a temporary thaw of a credit freeze, implemented within 15 minutes, though none have gone into effect yet. Utah, Washington, West Virginia, Wyoming, New Mexico and the District of Columbia will all require reporting agencies to provide the 15-minute thaw beginning September 2008. Indiana, Maryland, Montana, Nebraska and Tennessee will require the 15-minute thaw in 2009.

Common Exemptions in Other States

Many states have exemptions to the credit freeze law that allow access to a frozen file for a select group of entities. These include:

• Existing creditors
• Creditors allowed to access the report under a thaw
• Anyone acting on a court order or subpoena
• Child support enforcement agency
• Government agency investigating fraud
• Law enforcement
• Anyone using a pre-screened list of consumers for purposes of sending out pre-approved credit offers permitted under the Fair Credit Reporting Act (15 U.S.C. Section 1681b(c))
• Anyone who is running a credit monitoring service that the consumer has subscribed to
• Anyone who is giving a consumer a copy of their own report or score
• Banks and credit unions
• Insurance companies, for the purposes of using scores to set rates

Federal Credit Freeze Legislation

There are several data-related measures currently before Congress, including the “Identity Theft Prevention Act,” which would allow consumers to freeze their credit for $30 through all three major credit reporting agencies. The legislation would also allow consumers to lift a freeze twice a year for free, after which each additional lift would cost $15.

Congress has also considered HR 3997, better known as the “Data Accountability and Trust Act,” or DATA. This act would allow only victims of identity theft to request a credit freeze, and would preëmpt state legislation. The act has been widely criticized and compared to a law that only allows car crash victims to wear seat belts.

Nationwide Industry Action

Beginning in October 2007, all three major credit reporting agencies will offer credit freeze in all 50 states, regardless of state legislation. TransUnion and Experian will each charge consumers $10 to place, lift or temporarily thaw a credit file. To date, Equifax has not announced details of its credit freeze.

The cost of a credit freeze is strongly determinative of the extent to which it will be utilized by consumers. Credit freeze laws across the country vary widely in terms of cost, but a $10 fee is at the high end. Some states offer the protection for free or a fee of $5 or less.

Additionally, while these proactive industry moves are step in the right direction, they merely represent an industry trend that could change at any time.

Consumer Preference: Fast and Free

A key concern for consumers is cost. Any fee imposed by legislation to implement a credit freeze, temporary thaw or permanent lift must be multiplied by three because consumers must pay that fee to each of the three major credit reporting agencies, each time they thaw their credit freeze.

Lobbyists for the reporting agencies have expressed concern over costs associated with creating mechanisms to place, thaw and lift a freeze. However, the system or software has already been created to comply with the credit freeze laws of 39 other states and the District of Columbia.

Proactive moves by TransUnion, Experian and Equifax to offer credit freeze in all states confirm that the technology is in place and the process is relatively automated. Thus, the credit freeze fees charged by the reporting agencies should be minimal and decrease over time.

Moreover, according to testimony recently provided by Cornell University economist Dr. Eric M. Eisenstein to the House Banks and Banking Committee, it is estimated that it costs only one dollar for a credit reporting agency to place, lift or temporarily thaw a credit freeze from an individual’s credit file.

In March 2007, AARP[viii] conducted a survey of consumers age 18 and older in South Carolina. South Carolina currently does not have a credit freeze law.

According to the AARP survey, consumers in South Carolina showed strong support for credit freeze, with many saying they would likely place a freeze on their credit files if that service were made available. However, many expressed concern over paying fees to the reporting agencies to place, thaw or lift the freeze. A considerable number of respondents said they would pay a minimal fee (between $1 and $6) to place a freeze if there was no fee to lift it, with fewer agreeing there should be a fee to both place and lift it. Some highlights from the AARP survey include:

• A total 81 percent of those surveyed said they supported credit freeze legislation in South Carolina, with 49 percent strongly supportive, and another 32 percent somewhat supportive. Less than 10 percent of those surveyed opposed the legislation.
• A total 78 percent of those surveyed said they would sign up for a credit freeze on their credit file if the service was made available.
• Six in ten of the consumers surveyed said they would be extremely likely or very likely to pay a fee between $1 and $3 to each reporting agency to place a freeze on their files, while only four in ten would pay a fee between $4 and $6 to each reporting agency for a freeze. Forty-five percent of the consumers said they were not likely to pay a fee of $10 to each reporting agency to place a freeze, and an overwhelming majority – 67 percent – said they were not likely to place a freeze if the fee was more than $10 per reporting agency.

From their survey, AARP concluded that credit freeze legislation would best serve consumers if the fee for placing a freeze was no more than $7 (though preferably less than $4), and if there were no fees for temporarily thawing or lifting the freeze altogether.

Conclusion

A credit freeze law that is inexpensive, convenient and accessible would offer Georgia’s consumers the protection they deserve. A state law would also create uniformity and fairness in the charges and structure of the credit freeze offered, and would guarantee the protection, regardless of changing industry trends.

Without the option of a credit freeze, Georgia consumers are exposed to identity theft and at risk of new account fraud, a crime that could be largely prevented.

Pro-consumer state legislation would impose a fee of $5 or less to place, lift or temporarily thaw a freeze. State law could also model a recent federal bill that allowed two free thaws per person each year.

A 15-minute implementation of a thaw that utilizes a consumer-generated personal identification number (PIN) would also address the concerns of both retailers and consumers that credit is easily accessible when needed. This form of freeze allows retailers to make on-the-spot sales even when a consumer has a freeze on their credit file.

Also, exemptions to the credit freeze should be carefully considered to include only the following: current creditors; creditors accessing the report under a thaw; anyone acting on a court order or subpoena; child support enforcement agencies; a government agency investigating fraud; anyone using a pre-screened list of consumers for purposes of sending out pre-approved credit offers permitted under the Fair Credit Reporting Act (15 U.S.C. Section 1681b(c); anyone who is running a credit monitoring service to which the consumer has subscribed; instances where the consumer wants to obtain a copy of his or her report.

Without effective legislation to help halt new account fraud, Georgia consumers can take some simple measures to reduce their chances of becoming a victim of identity theft.

What can you do to protect yourself from identity theft?

• Shred all documents with personal identifying information, especially financial documents.
• Never give out any personal information over the phone, internet, or through the mail unless you are sure of who you are talking to.
• Request at least one free copy of your credit report every year and carefully inspect it for fraud.You can do this online at www.annualcreditreport.com, by phone at (877) 322-8228, or by mail at:

Annual Credit Report Request Service

P.O. Box 105281

Atlanta, GA 30348-5281.

• Watch out for signs that identity theft has taken place.These may include: denials of credit that you did not apply for, letters or calls about purchases you did not make, or credit cards or account statements you do not recognize.
• Protect your computer with anti-virus and anti-spyware software, and firewalls.
• Choose difficult passwords.Test the strength of your current password for free at www.microsoft.com/protect/yourself/password/checker.mspx.
• Opt out of pre-approved credit card offers for five years by calling (888) 5-OPT-OUT.

Get off catalog mailing lists. You can do this online at www.dma.org/consumers, or by phone at (202) 861-2410.

 

What resources are available to Georgia consumers who suspect their identity has been stolen[a1] ?

For a total fee of $30, freeze your credit file with the three major credit reporting agencies now voluntarily offering the service in Georgia. This will bar any potential creditors from accessing your credit files without your permission.

• Place a 90-day fraud alert on your account with all three credit reporting agencies.This will flag your account and help prevent any new accounts from being opened for 90 days.
• File a police report.This will help you establish proof of the crime and will help you extend the fraud alert.
• Close all accounts that show signs of having been affected.
• Sign an ID Theft Affidavit at www.ftc.gov/idtheft. Keep all written records of correspondence about the identity theft.

Contact information for the three major credit reporting agencies:

Equifax P.O. Box 740241 Atlanta, GA 30374-0241 (800) 525-6285 or www.equifax.com

Experian P.O. Box 9532 Allen, TX, 75013 (888) 397-3742 or www.experian.com

TransUnion P.O. Box 6790 Fullerton, CA 92834-6790 (800) 680-7289 or www.transunion.com

[i] Consumer Fraud and Identity Theft Complaint Data, January – December 2006, Federal Trade Commission, February 2007.

[ii] Federal Trade Commission – Identity Theft Survey Report, September 2003.

[iii] 2007 Identity Fraud Survey Report, Javelin Strategy & Research; Federal Trade Commission – Identity Theft Survey Report, September 2003.

[iv] Identity Fraud Survey Report, Javelin Strategy & Research.

[v] 2007 Identity Fraud Survey Report, Javelin Strategy & Research; Federal Trade Commission – Identity Theft Survey Report, September 2003.

[vi] Consumer Fraud and Identity Theft Complaint Data, January – December 2006; Federal Trade Commission, February 2007.

[vii] Sources are the Privacy Rights Clearinghouse, the Atlanta Journal-Constitution and the Augusta Chronicle.

Testimony of economist Dr. Eric M. Eisenstein to the Georgia State House Banks and Banking Committee, October 4, 2007.

[viii] Security Freeze Legislation: Consumer Attitudes on Paying Activation and Lifting Fees, AARP, April 2006.