If you're an American looking to get one of the free credit reports guaranteed by the Fair Credit Reporting Act (FCRA), the site you want is AnnualCreditReport.com. Their phone number is 877-322-8228.
Ignore all other sites or offers unless you're looking for high-pressure inducements for pricey add-on services, or even flat-out fraud. Do you really want to be giving out your vital information, like SSN and DOB, to a potential scammer or some random unscrupulous type who would portray themselves as an official source for data as private as a credit report?
For more information about the reputability of credit report websites, read the FTC report on fake credit report sites.
April 23, 2007
April 3, 2007
Keep those grandfathered bank accounts
Remember the proposed "Know Your Customer" (KYC) rules, where the U.S. government was going to force banks and related financial institutions to develop a profile on each of the insitution's customers?
But Know Your Customer was defeated, right? Not so fast.
Know Your Customer rules have been quietly resurrected as two separate programs, with other benign-sounding names.
Meet Customer Identification Program (CIP) and Enhanced Due Diligence (EDD).
Customer Identification Program, or CIP, requires that financial institutions (including casinos, pawnbrokers, insurers and money transmitters) positively identify the individual or organization with which they have a formal business relationship. The actual CIP procedure will vary by institution, but will be documented.
CIP requires the following information on each customer: legal name, date of birth (DOB), street address, and taxpayer identification number. Taxpayer Identification Number, or TIN, is usually a Social Security Number for U.S. citizens, or a Social Identification Number, or SIN, for Canadians. For addresses, P.O. boxes and accomodation addresses are explicitly disallowed for accounts opened after October 1, 2003.
Almost all financial institutions require goverment-issued ID for the CIP process, although many banks are accepting the Mexican matricula consular card in an effort to garner the business of Mexican nationals who may not have identification documents issued by U.S. agencies.
Enhanced Due Diligence is a program where banks monitor their customer's activity on an ongoing basis for illegal activity or suspicion of illegal activity. Bank compliance officers are looking for evidence of terrorist financing, transactions with blacklisted entities, fraud, check kiting, identity theft, tax evasion and money laundering.
Enhanced Due Diligence screening is usually done by data mining account transaction records, looking for patterns that might be indicative of these crimes. Many firms offer software packages to help automate the data sifting, but similar results can be obtained with basic data analysis tools like a spreadsheet, as long as criteria are previously defined. It's worthwhile to keep grandfathered bank accounts that date from before the Patriot Act. These accounts, and accounts at the same institution, are not subject to Customer Identification Program requirements.
In other words, if you are a long-time customer of a bank, but that bank doesn't already have a full CIP profile on you, they are not required to collect all of the CIP information for you to open additional accounts or financial products with them. Sometimes bank procedures encourage account representatives to collect the information, but most do not.
Be aware that this only applies if you are a grandfathered, existing customer of the bank. If you have previously closed all of your accounts with that institution, you're classified as a new customer for purposes of the Customer Identification Program and will have to supply all of the ID and documentation required of a new customer. Accounts opened after October 1, 2003 cannot be opened with P.O. box or commercial mailbox, as many people used to do to preserve their privacy.
Keeping those grandfathered accounts around, with minimum balances if necessary, can save you from having to provide information that you'd rather not provide to open an account in the future. This includes keeping your old accounts open when you move, especially if you are going to open a new account at the local branch of the same institution at your new home or office.
Remember, though, to keep old account checkbooks and paperwork in a very secure location with the rest of your financial documents.
But Know Your Customer was defeated, right? Not so fast.
Know Your Customer rules have been quietly resurrected as two separate programs, with other benign-sounding names.
Meet Customer Identification Program (CIP) and Enhanced Due Diligence (EDD).
Customer Identification Program, or CIP, requires that financial institutions (including casinos, pawnbrokers, insurers and money transmitters) positively identify the individual or organization with which they have a formal business relationship. The actual CIP procedure will vary by institution, but will be documented.
CIP requires the following information on each customer: legal name, date of birth (DOB), street address, and taxpayer identification number. Taxpayer Identification Number, or TIN, is usually a Social Security Number for U.S. citizens, or a Social Identification Number, or SIN, for Canadians. For addresses, P.O. boxes and accomodation addresses are explicitly disallowed for accounts opened after October 1, 2003.
Almost all financial institutions require goverment-issued ID for the CIP process, although many banks are accepting the Mexican matricula consular card in an effort to garner the business of Mexican nationals who may not have identification documents issued by U.S. agencies.
Enhanced Due Diligence is a program where banks monitor their customer's activity on an ongoing basis for illegal activity or suspicion of illegal activity. Bank compliance officers are looking for evidence of terrorist financing, transactions with blacklisted entities, fraud, check kiting, identity theft, tax evasion and money laundering.
Enhanced Due Diligence screening is usually done by data mining account transaction records, looking for patterns that might be indicative of these crimes. Many firms offer software packages to help automate the data sifting, but similar results can be obtained with basic data analysis tools like a spreadsheet, as long as criteria are previously defined. It's worthwhile to keep grandfathered bank accounts that date from before the Patriot Act. These accounts, and accounts at the same institution, are not subject to Customer Identification Program requirements.
In other words, if you are a long-time customer of a bank, but that bank doesn't already have a full CIP profile on you, they are not required to collect all of the CIP information for you to open additional accounts or financial products with them. Sometimes bank procedures encourage account representatives to collect the information, but most do not.
Be aware that this only applies if you are a grandfathered, existing customer of the bank. If you have previously closed all of your accounts with that institution, you're classified as a new customer for purposes of the Customer Identification Program and will have to supply all of the ID and documentation required of a new customer. Accounts opened after October 1, 2003 cannot be opened with P.O. box or commercial mailbox, as many people used to do to preserve their privacy.
Keeping those grandfathered accounts around, with minimum balances if necessary, can save you from having to provide information that you'd rather not provide to open an account in the future. This includes keeping your old accounts open when you move, especially if you are going to open a new account at the local branch of the same institution at your new home or office.
Remember, though, to keep old account checkbooks and paperwork in a very secure location with the rest of your financial documents.
March 25, 2007
Residential WiFi mapping database revealed
Skyhook Wireless has been scanning American neighborhoods for WiFi access points and putting them into a database. So far they've got 16 million detected wireless access points, covering the majority of the U.S. and Canadian population.
Remember again, if computer privacy and security are more important to you than convenience, don't network without wires. Information is out of your control once it hits the airwaves.
March 12, 2007
Comparison of Prepaid Credit Cards
Ryan Barrett at snarfed.org has an updated essay on protecting your privacy with prepaid credit cards and gift cards.
February 21, 2007
Prescription Records for Sale
In January 2007, the new National ePrescribing Patient Safety Initiative (NEPSI) debuted with a high-profile article in Time magazine.
This web-based system is supplied free of charge to physicians, ostensibly to reduce prescription error rates. Revenue to pay for the information system comes from the participating pharmacies and insurers who save time and money.
Now there are accusations that this database has been developed to give drug marketers, insurance risk assessors, and employers access to patients' private prescription records.
According to a Government Health IT article, all the prescription records stored in the new NEPSI database are for sale:
In another article, Dr. Peel says that NEPSI sells data to large employers:
But Allscripts CEO Tullman denies that prescription data will be misused:
What can you do?
Ask your medical care providers if they use the web-based NEPSI electronic prescription system.
Consider refusing prescriptions for conditions that you would not want your employers or government to know about. Some doctors will give out samples to their patients, and this might be a sufficient quantity to forgo a formal prescription.
A cash transaction by itself won't keep you out of the NEPSI database because it contains patient information and the prescription itself, not just billing information like an insurer's database might.
This web-based system is supplied free of charge to physicians, ostensibly to reduce prescription error rates. Revenue to pay for the information system comes from the participating pharmacies and insurers who save time and money.
Now there are accusations that this database has been developed to give drug marketers, insurance risk assessors, and employers access to patients' private prescription records.
According to a Government Health IT article, all the prescription records stored in the new NEPSI database are for sale:
Security makes little difference because every identifiable prescription in the country is data mined and sold daily. Nobody needs to break into pharmacies to steal our prescriptions; they are for sale. For example, market intelligence firm IMS Health reported revenues of $1.75 billion in 2005 solely from the sale of prescription records, primarily to drug companies.
In another article, Dr. Peel says that NEPSI sells data to large employers:
In 2006, the national Blue Cross and Blue Shield Association announced its Blue Health Initiative to aggregate and sell the claims, medical and prescription data of all 79 million enrollees to large employers. This database will include far more detail than e-prescription records, making the sales of Blues data worth far more than the billions in revenue from selling e-prescription records alone.
But Allscripts CEO Tullman denies that prescription data will be misused:
Patients and physicians will have unique access to all the information. It's not our data. We don't claim it's our data. [...] Google will have no access to data we receive as part of the electronic prescribing process.
What can you do?
February 9, 2007
Laptop data searches at border checks
U.S. courts have approved border agents' search of traveler's laptops without articulable probable cause.
Indications are that U.S. and Candian customs officials are searching laptops for pornography and obscene material.
Some travelers report being asked if the laptop they were carrying was a personal or company unit. Presumably, corporate laptops are less likely to be checked for obscene material than personal units are.
Authorities also have the ability to conduct forensic computer searches at border crossings and have done so in the past.
Data transmitted across national borders via the Internet is more strongly protected than data hand-carried through Customs checkpoints, because wiretaps must comply with the requirements of Title III, 18 U.S.C. §§ 2510-2522, or the Pen/Trap statute, 18 U.S.C. §§ 3121-3127. The few advantages of hand-carry are totally lost if one cannot be assured that the data hasn't been copied, or that software or hardware spying mechanisms haven't been implanted within it.
Travelers with sensitive or legally privileged data will want to Customs-proof their laptop before crossing a controlled border. Strong encryption is the best tool to protect data that must be hand-carried through Customs instead of residing on a remote server. Some organizational IT departments are investigating hardware hard-disk encryption, sometimes combined with hardware biometric readers.
It is unclear at this time whether a traveler can be forced to divulge a password. One privacy wonk has suggested wearable or concealable USB drives as a measure of protection.
Indications are that U.S. and Candian customs officials are searching laptops for pornography and obscene material.
Some travelers report being asked if the laptop they were carrying was a personal or company unit. Presumably, corporate laptops are less likely to be checked for obscene material than personal units are.
Authorities also have the ability to conduct forensic computer searches at border crossings and have done so in the past.
Data transmitted across national borders via the Internet is more strongly protected than data hand-carried through Customs checkpoints, because wiretaps must comply with the requirements of Title III, 18 U.S.C. §§ 2510-2522, or the Pen/Trap statute, 18 U.S.C. §§ 3121-3127. The few advantages of hand-carry are totally lost if one cannot be assured that the data hasn't been copied, or that software or hardware spying mechanisms haven't been implanted within it.
Travelers with sensitive or legally privileged data will want to Customs-proof their laptop before crossing a controlled border. Strong encryption is the best tool to protect data that must be hand-carried through Customs instead of residing on a remote server. Some organizational IT departments are investigating hardware hard-disk encryption, sometimes combined with hardware biometric readers.
It is unclear at this time whether a traveler can be forced to divulge a password. One privacy wonk has suggested wearable or concealable USB drives as a measure of protection.
February 3, 2007
The power of data mining
An exercise in finding subversives through Amazon.com wishlists illustrates the power of data mining:
It used to be you had to get a warrant to monitor a person or a group of people. Today, it is increasingly easy to monitor ideas. And then track them back to people. Most of us don't have access to the databases, software, or computing power of the NSA, FBI, and other government agencies. But an individual with access to the internet can still develop a fairly sophisticated profile of hundreds of thousands of U.S. citizens using free and publicly available resources. Here's an example.
There are many websites and databases that could be used for this project, but few things tell you as much about a person as the books he chooses to read. Isn't that why the Patriot Act specifically requires libraries to release information on who's reading what? For this reason, I chose to focus on the information contained in the popular Amazon wishlists.
Subscribe to:
Posts (Atom)