Articles of Interest
States Offer Consumers New Tool To Thwart Identity Theft
Consumers Largely Unaware of Credit Freeze
By Brian Krebs washingtonpost.com Staff Writer Wednesday, May 9, 2007; 6:31 AM
George Fitzgerald never imagined he would take on the nation's largest financial services industry and win. But his upstart coalition of consumer and business groups did just that when they took up the cause of identity theft victims in Delaware, winning passage last September of a state law enabling residents to opt out of America's instant-credit economy.
Delaware became the seventh state to enact a law enabling consumers to "freeze" their credit reports as a means of preventing identity thieves from establishing new, fraudulent lines of credit. Altogether, 33 states and the District of Columbia have secured such rights for their citizens, and more states are considering similar measures.
Credit freezes can be an effective, if blunt, tool to fight identity theft. A freeze directs the three major credit reporting bureaus to block access to a consumer's credit report and credit score. While a freeze does little to stop abuse with existing accounts that have been compromised by criminals, it can limit victims' total exposure, saving them the time and expense of clearing new, fraudulent accounts from their records.
In securing a freeze law in Delaware, Fitzgerald, a 66-year-old retired insurance salesman, achieved a victory for consumers in what is perhaps the nation's most corporate-friendly state. Delaware lawmakers have fought hard to woo companies with business-friendly tax laws, and the state's legal system has rendered landmark pro-businesses decisions. More than 300,000 corporations are chartered in the state, as well as some 60 percent of Fortune 500 companies and half of publicly traded U.S firms. Six of the top 10 banks with the highest volume of credit-card lending are located in the First State, including Internet banking giant ING Direct and MBNA, the second-largest issuer of MasterCard and Visa credit cards.
The pro-business climate extends to the workings of government. Proceedings and debate on legislation in the Delaware House and Senate are closed to the public and media. Outsiders are allowed to participate by invitation only.
Fitzgerald's story, retold through his eyes and others who witnessed the process, offers an insider's look at the politics behind the identity fraud problem, which affects more than 10 million Americans each year at a cost of more than $50 billion, according to the Federal Trade Commission.
Taking on the Credit Giants
By February 2005, only California, Louisiana, Texas and Vermont had laws allowing credit freezes. Texas and Vermont reserved their laws for identity-theft victims who could produce police reports as proof of their misfortune.
California and Louisiana allow any consumer to obtain a freeze, but consumers are required to pay $10 to each of the three major credit bureaus for the privilege. They also must pay additional fees to unlock their files if they later apply for a loan or line of credit. Consumer applications must be sent via certified mail to each bureau. The applications must include a raft of documents, such as a copy of the applicant's driver's license and credit-card information.
Fitzgerald, a volunteer member of the Delaware Credit Union League, experienced identity theft first hand in 2004. In doing research about the topic, he learned about California's freeze law and decided he wanted to bring it to his state.
Fitzgerald rang his friend Dave Bakerian, executive director of the Delaware Bankers Association, and asked how he could convince a state lawmaker to take up the cause. Bakerian told him that his toughest challenge would come from the Consumer Data Industry Association, a powerful group representing companies like ChoicePoint, LexisNexis parent company Reed Elsevier and more than 250 other companies trading in consumer data.
Following Bakerian's advice, Fitzgerald phoned CDIA lobbyist Christopher DiPietro. Fitzgerald recounted that he had a polite but unproductive conversation. Toward the end of the 10-minute discussion, Fitzgerald said he asked what it would take for the CDIA to support a credit freeze bill in Delaware. According to Fitzgerald, DiPietro chuckled and said CDIA's main policy goal for 2005 was exactly the opposite.
"He said to me, 'We're not going to give you any support for this Delaware bill. In fact, I'll tell you our objective for 2005 nationally. We are going to drive a stake into the heart of the four states that have already passed these laws. That's what we're going to do.'"
DiPietro denied ever making the statement. A CDIA representative said DiPietro did not speak for the national organization.
Fitzgerald brought the idea to his local Republican state representative, and met with aides to the state's Democratic governor. Both expressed interest, but little progress was made until late April. That's when Fitzgerald received a phone call from an aide to the governor. He was informed that Sen. Robert Venables, a populist Democrat from the rural, southern Delaware, planned to introduce a credit-freeze bill in May modeled after California's pioneering statute.
Prior to the initial hearing on the bill in June 2005, the bill had official support from two organizations, a local credit union and ING Direct, a huge online banking operation whose executives feared that the identity-theft wave hitting consumers might undermine faith in Internet-based financial services.
Venables said he was unprepared for the fierce opposition his bill engendered.
"The banks, the insurance companies, credit bureaus and retailers really came out of the woodwork and fought hard against it," he said. "I thought it was good for them and the banks. I thought with all the ID theft going on, people might even get to the point where they'd be afraid of using the [banking] system. I thought that since the credit bureaus were making a bundle of money off of trading consumers' information ... that they should offer a way to protect that information."
For a few months, Fitzgerald said it appeared as though the CDIA was on track to meet its objective. The Delaware freeze bill languished for the remainder of the legislative session. Meanwhile, CDIA lobbyists turned their attention to fighting a similar bill in New Jersey, urging lawmakers there to model their proposal on Vermont's law, which provided freezes only for identity-theft victims.
By May 2005, Delaware was alongside Maryland, New Jersey and Massachusetts in debating credit-freeze legislation. Advocates affiliated with the U.S. Public Interest Research Group who attended individual state hearings said the CDIA opposed credit freezes for all but confirmed victims of ID theft, and that the organization would only support a bill modeled after the Vermont law.
But by early July, New Jersey had bucked the CDIA and enacted a freeze law that addressed what consumer advocates saw as the biggest shortcoming of the California measure -- that consumers had to wait three days after unlocking their credit file before they could apply for new lines of credit. New Jersey was the first state to require a "fast thaw" provision allowing consumers to unfreeze their credit files within 15 minutes of supplying a pre-arranged, four-digit personal identification number to the credit bureaus. Additionally, the state's new law allowed consumers to use e-mail or the Web in addition to U.S. mail to unlock their data.
Abigail Kaplowitz Field, a legislative advocate for the New Jersey PIRG who worked with Fitzgerald in shepherding Delaware's measure, said that without a quick-thaw provision, few consumers would take advantage of a credit freeze because many businesses will not authorize new, on-the-spot accounts, such as for a new cell phone, without access to a consumer's credit file.
"If someone invaded your home, you'd buy a new lock for the door, but it wouldn't do you much good if every time you unlocked your door you had to pay a fee and wait three days in the cold before going inside. A freeze should really operate like a lock on your front door," Field said.
The New Jersey law wasn't a total loss for financial data brokers. The credit bureaus won a two-to three-year delay in implementing the 15-minute thaw requirement. In addition, New Jersey residents still must file requests for credit freezes through certified mail, which generally adds another $10 to the cost of filing a freeze as consumers must send separate letters to each credit bureau.
To Freeze or Not to Freeze...
Under federal law, individuals have the right to place a 90-day "fraud alert" on their credit files. They also are entitled to a free copy of their credit report from each of the three big credit reporting bureaus annually. However, unlike a security freeze, a fraud alert merely notifies the consumer if an inquiry has been made against his or her credit file. It does not prevent identity thieves or other businesses from accessing a consumer's credit file or obtaining new lines of credit under false pretenses. Consumers who can provide police reports proving they are victims of identity fraud are eligible for a seven-year fraud alert.
Consumers also can order a copy of their credit report at annualcreditreport.com or sign up for credit-monitoring services over the phone or the Web. Consumers are not allowed to file for a credit freeze electronically. While some states have enacted laws that eventually will allow consumers to request and thaw a freeze electronically, bureaus still have at least a couple of years to implement those requirements.
Critics of the consumer-reporting agencies say credit bureaus oppose freeze laws because they threaten to curb the billions of dollars they reap from credit monitoring services. The services, which the credit bureaus offer for prices ranging from $6 to $12 per month, are designed to alert consumers if someone applies for credit in their name or makes an inquiry on their credit file. More than 11 million Americans subscribe to credit monitoring services, according to Javelin Strategy and Research.
Consumer advocates note that credit-monitoring services will not stop identity thieves from opening new lines of credit in a consumer's name.
"This expensive service gives you a report of all the things that are happening to you as a consumer but they don't do anything to stop new accounts from being opened," said Michelle Jun, a staff attorney with the San Francisco office of Consumers Union. "I think [the credit bureaus'] big concern is a lot of customers will start using the freezes as they gain more awareness of them, but the bureaus aren't really making that information easily available."
CDIA President and Chief Executive Officer Stuart Pratt said credit monitoring and fraud alerts are effective tools for consumers who want to remain informed about activity on their credit file, without the inconveniences of a credit freeze. In most cases, consumers who have frozen their credit must wait at least three days after thawing their file before applying for new credit, or opening a retail account, for example.
"I've intuitively always thought that credit freezes may be too rigid for many consumers, because it really does stop you from engaging in a lot of transactions that you have to do in normal, everyday life," he said.
Pratt said the bureaus have insisted that credit-freeze requests be submitted via certified mail as a way to provide authoritative documentation. "The key to [requiring a written request] is to make sure we have a record of what the consumer asked for, so that we have something to show [the consumer] who comes to us angry because they can't unfreeze their credit fast enough or they don't remember doing it in the first place."
Pratt said it should be harder for consumers to thaw a credit freeze than it is to place it, noting that more than 40 million Americans move, change their last name or other identifying information each year. He added that alterations in a consumer's record often demand more rigorous re-verification of the consumer when he or she requests a thaw on a frozen credit file.
"If I chose to freeze my credit report, I'd expect the bureau to do a good job verifying me if I later wanted to unfreeze it," Pratt said. "I think consumers are willing to tolerate a number of steps to make sure we verify them. It's really no different from getting on a plane these days. The difference between customer service and a freeze is much more about security than it is about ease of use."
Advocates for swifter and more convenient credit freezes and thaws, he said, often gloss over these important operational details. "These folks want to have their cake it and eat it too, but the reality is that security and customer service don't always operate co-terminously."
The CDIA says there is little indication that consumers are taking advantage of the freeze laws already on the books. The group claims that as of the first quarter of 2007, only about 50,000 consumers nationwide have requested a credit freeze.
But Adam Goldberg, a senior legislation representative with the AARP, said that's because the credit bureaus have erected hurdles for consumers seeking a freeze. Goldberg said he had difficulty finding any information about consumers' rights to a security freeze on two of the three credit bureaus' Web sites.
"They did have a great deal of prominent information about products that consumers could buy, such as credit monitoring services and links that consumers could use to purchase copies of their credit reports," Goldberg said.
Consumer groups say the credit bureaus' policies on credit freezes are indicative of an industry that is not structured to deal with consumers.
Ed Mierzwinski, program director for the PIRG's federal office, said the credit bureaus are "doing their darndest" to weaken state credit-freeze statutes.
"We believe that fighting for things like certified mail and long implementation time frames are indicative of an industry that simply doesn't want to have to hire the customer service people they need to be able to interact with the public," he said.
Goldberg, who has worked with advocates in more than a dozen states to enact freeze legislation, said that in 2005 the CDIA and the credit-reporting agencies shifted their strategy. They no longer were outright opposed to credit-freeze laws; instead, they worked to convince states to allow the bureaus to charge as much as possible when consumers place, lift or remove credit freezes.
"The credit reporting agencies clearly want consumers to pay more for the security freeze than we certainly think they should," Goldberg said. "But given that those same agencies collect all of this sensitive financial data about consumers and then turn around and sell it, we think they should also have the obligation to protect the consumer, and that's where the security freeze comes in."
The Delaware Bill's 15 Minutes of Fame
When Fitzgerald heard about the New Jersey law in July 2005, he contacted state Sen. Venables and urged him to include the 15-minute unfreeze language in the bill he introduced in the Delaware legislature.
"The American Bankers Association and the banks up to this point were claiming that a credit freeze was going to be end of those good deals, that local farmers weren't going to be able to do their spring plowing or get a new tractor quickly if the old one breaks down," Fitzgerald said. "But the 15-minute provision ended all that talk, and it's what ultimately caused the banks to drop their opposition and go neutral on this bill."
Convinced he could bring more business groups on board with the 15-minute proposal, Fitzgerald opened up the phone book and began cold-calling industry groups and trade unions. Within a few months, Sen. Venables coalition of supporters grew to nearly 100 members, ranging from heavy hitters like the AARP and the American Civil Liberties Union to smaller outfits like the Paralyzed Veterans of America and a local anti-abortion group.
In August 2005, Fitzgerald had a chance meeting with Larry Blanchard, senior vice president of CUNA Mutual Group, a $14 billion company that serves as a leading insurer for most of Delaware's credit unions and a large portion of federal credit unions nationwide. When the discussion turned to Fitzgerald's credit freeze efforts, he said Blanchard became interested. The executive explained that CUNA was suffering a 300 percent loss ratio due to rising identity fraud costs associated with several major data breaches at nationwide retail chains.
At a 300 percent loss ratio, for every dollar the company was earning from member premiums, CUNA was paying $3 in claims for fraud costs related to identity theft cases.
CUNA indicated it would support the bill if Sen. Venables included a provision that would force credit-card processors and merchants to pay $3,000 per violation for storing consumer credit card data for any length of time longer than necessary for processing a customer's payment transaction. CUNA Mutual recently had filed a suit against BJ's Wholesale Club for holding some 40,000 customer credit cards that were compromised in a 2004 data breach.
By the end of 2005, the legislative playing field on credit freezes had changed dramatically. Eight had passed credit freeze laws by that point, and bills to give consumers the right to freeze their credit files had been introduced in nearly 40 other states.
When Venables reintroduced his bill in January 2006, he included language on the 15-minute thaw provision and the data-breach penalties sought by the banking industry. In April, supporters and opponents of the new bill convened an unofficial meeting to see if there were any compromises that could be struck to improve the bill's chance of passage.
Faced with opposition from insurance providers and private investigators, Venables agreed to include language that would allow private investigators, banks and insurance companies to access information contained in the first few lines of a consumer's credit report, including name, address, Social Security number and credit score.
With that allowance, banks and credit-card companies would remain free to offer new lines of credit to consumers who had opted for a credit freeze. According to U.S. PIRG, the average U.S. household receives nearly 100 offers for new credit cards and loans each year.
It also was at that April meeting that Fitzgerald said he was approached by DiPietro. The CDIA representative offered to support a state freeze law modeled after California's measure, which does not include the 15-minute thaw option for consumers.
"I said to him, 'Why would I accept a California law when I can have this New Jersey model?' I told him that had he come to me with that offer back in February of 2005, I'd have jumped on it then. But now what they were offering was a step backwards for us."
In late May, the 15-minute thaw bill passed the Democratic-controlled state Senate unanimously. Supporters expected a tough battle for the bill in the Republican-dominated House. But a month later, during a hearing on the measure in the House Banking Committee, there was a surprise. Among those testifying in favor of the measure was the owner of the largest automobile dealership in the committee chairman's home district.
Retailers had strongly resisted the original credit-freeze bill that was modeled after the California law, fearing it would limit consumers' access to instant credit. Delaware has no sales tax, and its huge outlet malls are a major destination for many bargain shoppers from surrounding states. After the bill was changed to include the 15-minute thaw provision, retailers effectively dropped their opposition, Fitzgerald said.
"What it ultimately came down to was that we had neutralized most of the previous opponents, and the credit bureaus were left alone in their opposition to the bill," he said.
The bill made it to the House floor, where lawmakers approved it 40-0 after stripping out the fines for merchants that fail to secure their customers' data. Gov. Ruth Ann Minner (D) signed it on June 30, and it became law that September.
Since the Delaware law was enacted, a number of states have moved to improve their credit-freeze laws. New Mexico, Utah, West Virginia and Wyoming enacted 15-minute thaw requirements. Other states have sought to lower the amount citizens must pay to place, lift or remove a credit-file freeze. Montana's freeze now has the lowest fee in the nation; it's $3 to establish and lift a freeze at each of the major credit bureaus. Vermont and Illinois subsequently expanded the right to a freeze to all citizens, not just identity theft victims. The legislature in Washington did the same, with the bill currently awaiting the governor's signature. A similar effort is underway in Texas.
Consumers Union estimates that by the end of this year, about 40 states will have enacted credit freeze laws. For the states without them, it sees hope in a data-breach bill currently before the U.S. Senate. That measure would give consumers the right to freeze their credit at a cost of $10 per bureau. The measure would do nothing to interfere with state freeze laws already enacted.
Shortly after the Delaware bill became law, Fitzgerald decided to take it for a test run by freezing his credit. Pretending to be a Delaware citizen with no knowledge of the law, he asked what he needed to do to establish a credit freeze. The customer service representative told him he needed to assemble the necessary documents and send them via certified mail. Fitzgerald then challenged the credit bureau to find in the statute where certified mail was required. It wasn't. He had quietly removed the language from the bill before the measure was approved by the Delaware Senate.
"I'd scratched that portion out, and I guess they never noticed," Fitzgerald said. "It was another minor victory."
© 2007 Washingtonpost.Newsweek Interactive
