Identity Theft Protection Racket

Really good post on philosecurity on Identity Theft and the Protection Racket the Credit Card companies are running.

I tend to agree, if the credit card companies were really losing money everyone would have credit alerts and locks for free but right now, like data breaches, its really the user's problems and not the credit card companies or the people that lost the data.

Of real interest is that it mentions LifeLock got sued because it was issuing credit alerts on behalf of its customers.

"Last year Experian sued identity theft protection firm, LifeLock, for activating fraud alerts on behalf of hundreds of thousands of clients. Experian “claimed that alerts should be entered only when people have already been victimized by identity theft or have legitimate reasons to believe that they are at imminent risk.” (Network World, 2008.) I’ve heard that “identity theft occurs every 79 seconds.” Does that count?"

http://philosecurity.org/2009/02/02/identity-protection-racket

I don't normally say this...

But go feds!

http://blog.wired.com/27bstroke6/2008/10/darkmarket-post.html

"DarkMarket.ws, an online watering hole for thousands of identify thieves, hackers and credit card swindlers, has been secretly run by an FBI cybercrime agent for the last two years, until its voluntary shutdown earlier this month, according to documents unearthed by a German radio network."

Taking Ownership of Identify Theft

Just going to throw this out there.

I think everyone agrees that Identify Theft is a huge issue but no one seems to take ownership of it.

I would say there are two to three kinds of identify theft methods

1. physically stealing information, like out of your mailbox, or a waiter steals your CC number off your card receipt from dinner

2. data lost from electronic breaches/losses

3. phishing

In general, if the first two happen to you there is little you could have done about it. Yeah you can get a PO Box, yes you can pay with cash for everything, so that aside or even maybe if you have done that let's talk about #3.

With phishing, I had to have a lack of thought (or common sense) and enter PII into a phishing site "I" did that. No hacker MADE me do that, I did it.

So the point? Instead of saying "a hacker stole my identity" maybe we should start urging people to take ownership of their stupid ass mistakes and say "I lost my identity" when the situation warrants it. Taking ownership of mistakes generally leads to not making that mistake again where passing the buck off to someone else for the blame generally leads to a wasn't my fault mentality.

When someone loses a cell phone and a person finds it and makes calls we don't say someone stole their cell phone do we? We say I lost my cell phone and some jerk ran up the charges.

I do realize that some bad guy has to actually "do" the actual identify theft, but if you gave him the information, its not his fault your an idiot just his luck.

thoughts?