Why Should Equifax's Problem Be Your Problem Too?

So, roughly half the American population is at extra-high risk of identity theft after the Equifax security breach. In honor of the occasion, here's a reprint of an article I wrote ten years ago for a now-defunct alternative weekly in Connecticut, explaining how identity-theft laws actually benefit banks and credit-card companies at the expense of ordinary American citizens.

Thy Brother's Keeper (And Thy Bank's, Too)
Protecting the assets of wealthy lending institutions is your personal responsibility. Seriously.

By Jennifer Abel
Hartford Advocate
Thursday, September 27, 2007

Here's how the five stages of grief play out when you learn that your lucky self is at risk of identity theft because you're one of the 106,000 taxpayers whose names and social security numbers were on the laptop stolen from the Department of Revenue Services last month:

Denial: I don't believe this!
Anger: Dang government, always making innocent people miserable.
Bargaining: I'd give anything for competent leadership.
Depression: Yeah, right, that'll happen (sniffle).
Acceptance: I can't afford to move to Amsterdam.

Once you complete the final phase you can start taking steps to regain control of your destiny, by contacting either Equifax, TransUnion or Experian, the three credit-reporting agencies listed on the DRS letter, and telling it to put a credit alert on your accounts. Whichever agency you call is legally obligated to contact the other two on your behalf.

What's the benefit of a credit alert? According to a Sept. 14 press release from Attorney General Richard Blumenthal (who did not return our calls for this story), "Credit alerts require companies to make a good faith effort to verify the identity of anyone seeking credit or a loan. Alerts must be renewed every 90 days."

Envy me, reader, for the security that's temporarily mine: over the next three months minus the time it takes for this to get to print and thence to you, if anyone contacts the Gigantobank Corporation to say "Hi, I'm Jennifer and I'd like to take out several thousand dollars in high-interest, unsecured credit-card debt," Gigantobank has to make a good-faith effort to ensure it's actually me before burdening my credit record with a legal responsibility to pay them back this money.

This is a special privilege, not a default setting. After I activated it for myself by calling the first company listed on my DRS form letter, I made a few more phone calls in hopes of learning why anyone need bother with credit alerts anyway.


"Protect yourself from identity theft." That phrase, in quotation marks, yielded 141,000 hits in an online search. Take the quotes away and it's nearly two million. Who in America hasn't heard it at least that many times? It's a bona fide part of the zeitgeist. Yet the assumption behind it is false.

The classic identity theft scam works something like this: the thief manages to convince Gigantobank he's actually you, and borrows money in your name. It will be a very annoying and time-consuming process for you to straighten out the mess, but at least you're not liable for the money Gigantobank lost.

Read that last sentence again: it's not your money you're protecting. So how did it become your responsibility (or mine) to protect the assets of wealthy corporations which, in most cases, we've never even done a lick of business with?

The folks I spoke to said that expecting financial companies to make sure it's really you they're lending money to would bring the credit card industry to its knees, which would be an undesirable outcome.

Let's say you've just been informed of the presence of one or more previously unknown credit cards in your name. It's up to you to prove that it's not yours. No "innocent until proven guilty" assumptions apply. Why can't you just tell the company "I never borrowed this money, and if you think I did then prove it?" Why is the onus on you to prove your innocence?

"That's simple," said Jay Foley, executive director of the Identity Theft Resource Center. "The fact that your personal information was used to open the account."

But calling it my "personal" information sounds like a bit of a stretch these days, doesn't it? Given how commonplace identity theft cases and database security breaches are, it seems folly for credit-card companies and the like to continue pretending that on all God's earth, the only person who could possibly know my social security number and date of birth is me. My credit alert requires companies to make a good faith effort to ensure I'm responsible before loaning money in my name. Why isn't that standard practice?

Foley spoke for several paragraphs that boil down to: this would kill the credit industry as we know it. "If it fell to credit card companies to prove the individual opened the account ... if I walked into a Kmart, or a Wal-Mart, or a Sears," he'd no longer be able to apply for and receive on-the-spot credit.

Nessa Feddis, from the American Bankers Association, put it more succinctly. "If consumers were simply allowed to make the statement 'I owe you nothing' and avoid payment, all consumers could simply make the declaration and avoid paying legitimate debts."

Well, all consumers could certainly try that. But the assumption of innocence until guilt is proven hasn't prevented society from imprisoning criminals, most of whom vehemently deny having committed the crime for which they were convicted. It's up to the prosecution to prove guilt. Why isn't that the case with debts incurred via identity theft?

"Criminal transactions are far less frequent and presumably more serious than loan transactions," Feddis said. "Resolving every loan dispute would clog the courts and make loans far more expensive ... the burden of proof in a criminal case is stronger than in a civil case."

Speaking of civil cases, consider this: if a thief steals your identity, you are (at least) not required to pay the actual bills your identity thief rang up. But neither are you entitled to compensation for the dozens of hours you'll spend clearing up the mess. And if you're unfortunate enough to suffer additional financial consequences, like being denied a mortgage or even turned down for a job because of your unjustly low credit score, you can't sue for damages in a civil court. Why not?

"State laws often allow victims to get compensation from criminals," Feddis observed. "Whether the victim is entitled to compensation from others ... is a matter of state law and tort law. It is no different from any other case where someone incurs damages due to someone else's actions."

Oh, but it's very different from such cases. If I, as a private citizen, make an honest mistake that causes you to be rejected for a loan or denied a job, you can sue me for damages in civil court. But if you suffer this same consequence due to the honest mistake of a credit-card company or credit reporting agency, you have no legal recourse at all.

"Unfortunately, that's right," said Jay Foley. "As much as I hate to say that, that's true."

Hurricane Prep: A Sadly Clueless Anecdote

Apparently, there are a lot of people in my neck of the woods who not only don't know there's a good chance we'll get hit by Hurricane Irma (albeit a much weaker version than what Florida is supposed to get), they don't even know it's possible for Atlanta or suburbs thereof to be affected by hurricanes!

I had to get my car's emissions test done today, and the test center nearest to me is in the parking lot of the strip mall holding the Kroger where I usually shop. When I got there, the emissions center was closed, but the man there said it would re-open in 15 minutes, after the operator got back from the bank. So I walked over to Kroger, figuring it wouldn't hurt to pick up a few more granola bars and other non-perishable snack-type foods.

There were a few people in Kroger making what I suspect were storm-prep purchases, including at least three shoppers whose carts were chockful of cases of drinking water. But for every one person buying storm-prep or non-perishable stuff, there were four people buying things like "carts full of frozen dinners" or other things certain to go bad if we do indeed lose power for any significant length of time. (Personally, I haven't bought any frozen or refrigerated food for the past week, ever since Irma got her name and I realized I was in the storm's maybe-possibly zone of possibility; furthermore, I've been making a point of eating as much as I can out of my own freezer or refrigerator. I'm still annoyed by the memory of the $150+ worth of food I had to discard in Connecticut, after the Halloween blizzard of 2011 left me without power for almost a week.)

I bought a few things and then returned to the emissions center, which had a long-ish line by then; I had to wait 20 or 30 minutes for my turn. While the test was going on I made small talk with the operator (who seemed amazed that my 2002-model car was still on the road), and at one point he also expressed surprise over how many people were in line for the emissions test. So I said something like "Yeah, I came by a little earlier but the guy said it was closed until you got back from the bank, so I went to Kroger to pick up a few more hurricane supplies."

"What, you're going to Florida?" he asked in a surprised tone of voice.

"No, but the storm's forecast to hit us here on Monday," I said in an equally surprised tone.

He said that's impossible; hurricanes can't hit us here because we're too far from any beach. I agreed that we don't have to worry about storm surges, but told him we can still get winds and rain bad enough to lose power, and maybe have contaminated tap water too. I also mentioned that when Hurricane Opal hit 20 years ago, parts of Atlanta and its suburbs were without electricity for up to a week.

Judging from the look on his face, I'm about 95 percent sure he thought I was just bullshitting him, or possibly a shill for the Granola Bar, Bottled Water and Canned Food-Industrial Complex (similar to what Rush Limbaugh claimed to believe a few hours before evacuating his own Florida digs). He also did not believe me when I mentioned going through a couple of hurricanes in Connecticut, because, quote, "hurricanes don't go that far north." Which made me incredulous, and I mentioned Superstorm Sandy trashing parts of New Jersey and New York City a few years ago, but -- again, he seemed to think I was full of it. He seriously seemed to believe hurricanes can only ever be a problem for people who live in Florida, or within a mile or two of a southern-state saltwater beach.

For his sake, as well as mine and all my neighbors, I hope he doesn't learn otherwise the hard way, come early next week.