The Proverbial Identity Theft Bus Will Run You Over!

Think about a time when you had a single credit card lost or stolen and how much of a pain that experience was. Now imagine if your entire wallet was lost or stolen and the exponential magnitude of pain in the patootie that would be for you.

If you are a subscriber to identity theft protection disservice providers, they are the custodians of a subscriber’s (this means you!) entire portfolio of financial account information, credit cards numbers, current and former address history, family names, social security number, power of attorney and everything else you care to chuck into their systems. To make matters worse, you can now add web site account user names and passwords.

What you now have is a cornucopia of identity theft and cyber criminal fun all in one place, neatly packaged up for hackers in one convenient location. Referring back to my wallet analogy, the database entrusted to these identity theft protection disservice providers is bigger than your wallet; it’s now your entire financial and personal history.

Not only are these providers reckless, they are incompetent from a cyber security and consumer protection perspective. Further proof that you are precariously about to be swinging in the wind is to only look as far as their advertisements and marketing campaigns. They seem to think that it makes great advertising to ridicule Russian hackers or other cyber criminals portrayed as troglodytes.

When you poke a stick into a hornets’ nest, eventually you are going to get stung. In doing so, these identity theft protection disservice providers risk the subscribers mother lode of personal identity data for the sake of theatrics. You may recall a rather stupid marketing stunt by a CEO with a bullhorn shouting his social security number out. He could not prevent his own identity from being stolen 12+ times and counting. How can they protect subscribers?

Now comes a bigger consumer problem that would add insult to injury. Have you ever looked at the policy acknowledgement for your financial institution? I’ll share some current language to Chase which states:

“We may at our option change the parameters for the password used to access the Online Service (“Password”) without prior notice to you, and if we do so, you will be required to change your password the next time you access the Online Service. To prevent unauthorized access to your accounts and to prevent unauthorized use of the Online Service, you agree to protect and keep confidential your Card number, account number, PIN, User ID, Password, or other means of accessing your accounts via the Online Service. The loss, theft, or unauthorized use of your Card numbers, account numbers, PINs, User IDs, and Passwords could cause you to lose some or all of the money in your accounts, plus any amount available under your overdraft protection credit line, or draws on your credit card account. It could also permit unauthorized persons to gain access to your sensitive personal and account information and to use that information for fraudulent purposes, including identity theft. If you disclose your Card numbers, account numbers, PINs, User IDs, and/or Passwords to any person(s) or entity, you assume all risks and losses associated with such disclosure. If you permit any other person(s) or entity, including any data aggregation service providers, to use the Online Service or to access or use your Card numbers, account numbers, PINs, User IDs, Passwords, or other means to access your accounts, you are responsible for any transactions and activities performed from your accounts and for any use of your personal and account information by such person(s) or entity. If you believe someone may attempt to use or has used the Online Service without your permission, or that any other unauthorized use or security breach has occurred, you agree to immediately notify us at 1-877-242-7372, (J.P. Morgan Online clients only, call 866-265-1727 or 302-634-5115 for international clients).”

Here is another from Wells Fargo which states the same:

“You are responsible for protecting your password and account information by not disclosing your personal account information to others (including your ATM PIN, online username, and password).”

I can’t help but see the proverbial bus that will run over consumers when an identity theft protection disservice provider is breached. Consumers will look to their banks for assistance and the banks will refuse to cover the damages. It’s not due to consumer negligence. It’s due to custodian negligence and deceptive business practices of these identity theft protection disservice providers.

Look before you leap!

Lazarus Alliance is Proactive Cyber Security®