[conspire] Fwd: Equifax data theft - this is a big deal

[Rick Moen]

I wrote:

> 5.  Watch your existing bank acounts and credit card statements 
> like a hawk that's just gotten LASIK.  In fact, use online access so you
> catch such things even before the monthly statement gets cut.  In fact,
> keep doing this starting now, and keep doing it.
> 
> Susan's idea of notifications for any notable transaction seems a wise
> idea, too.

Another brief afterthought (and I still haven't had my coffee; fixing
that, now):  I recently caught a cycle of fraud starting on one of my
credit cards, and the pattern is illustrative of the way (I hear) this
usually works.

I was reviewing the monthly statement, and suddenly noticed some
small-dollar charges at businesses near San Diego followed by a
small-dollar charge at a car wash in Pacifica.  (There were five in
total.)  I'd not been anywhere near San Diego, and my idea of how to
wash a car is with a bucket and a sponge -- nor had I lent out my credit
card.  FYI, all five were at the sorts of places unlikely to check
signatures or require photo ID.  So, I reported the fraud by telephone
with my financial institution, who said they'd reverse the five
transactions and start an investigation, and would cancel my existing
credit card and send me a new one for a newly issued replacement
account.  I said, aren't you going to send me paperwork where I make an
affadavit?  The customer service rep said approximately yes.

I waited a week, and checked back online, because I was aware of a
common gotcha.  The gotcha is that reporting fraud by telephone does
_not_ protect your rights, part of the general truth that anything
serious must be done in writing and making telephone calls fails to
leave a legally useful record.  What I had noticed online was that the
five fraudulent charges had _not_ been reversed.  So, I called again 
(but also made immediate plans to do more than just call):

The new customer service representative said there was no record of the
fraud report I was told was being entered a week before, so the new guy 
entered one from scratch; I identified each of the five all over again.
It's unclear what happened to the earlier record, maybe a computer
glitch before saving; we'll never know.  The main point is I'd
remembered to verify, which turned out for once to pay off.  I _also_
told the representative that I was sending a detailed letter reporting
the five as fraudulent (and stating that the card had not been lent out,
and the charges had not otherwise been authorised by anyone in my
household, and that the card was still in my possessin and not lost, nor
had any photo ID been lost or stolen).  Which letter I finished after
the telephone call.

I never was sent any affidavit form, perhaps because my letter covered all
questions they'd need to ask.  (Basically, my letter served as the
affidavit.)  A few days later, I got a short form letter acknowledging
receipt of my letter, saying investigation would ensue, and the charges
in dispute reversed.  About two months further on, I got another,
equally curt letter saying investigation had concluded and the charge
reversal was now permanent.

But the real point I wanted to make is what _would_ have happened, if
I'd not noticed the five small unauthorised charges and taken immediate
action:  The people doing this were testing.

Credit card numbers that get tested in this way get sold, and the
purchasers would then hit the card with progressively larger fraudulent
charges, seeing how much they could get away with.

BTW, if your card is lost or stolen, Federal law limits your customer's 
liability to at most $50 per card if fraud is reported in some timely
manner after card loss, or $0 if it occurs after.  Many lenders exceed
these protections by having 'zero liability' policies, but not all of
them.  Anyway, it's a superb idea to keep with you an independent
record, separate from the card itself, of the 24 hour telephone
number(s) to call in the event of card loss -- and use that promptly.

I believe that the same $50 per card Federal limit applies to
unauthorised transactions.  For my card, I was 100% covered.

I am told that the $50 per card limit does _not_ apply to charges you
are alleged to have made in other countries, so please be particularly
careful when waving around your credit cards (and, even more so, debit
and ATM cards) abroad.