The breach ticks me off – this never should have happened. Clearly Equifax has some major vulnerability in their system which they should have known about and protected. A credit bureau should be utilizing the highest level of security at every level. Your information with them should be as secure as a vault. On top of that, to add insult to injury, three of Equifax’s executives (including the CFO) sold nearly $2 million worth of stock after the breach, but before they told the public about it. That’s right – here’s a timeline for you:

• Between mid-May and July, 2017 – breach happens
• July 29, 2017 – the hack was discovered
• Aug 1-2, 2017 – executives sell almost $2 million worth of stock
• Sept 7, 2017 – the public is informed of the breach (thank you, Equifax, for waiting more than a month before letting us know)
• Sept 8, 2017 – Equifax stock drops by double-digits

Equifax cliams that these executives had no knowledge of the hack when they sold their shares, but I don’t buy it. You’re telling me the CFO didn’t know about this? If he didn’t know, then who did? I’m sure that the timing of the sale will be part of any investigation.

The breach has happened, though, and you need to take specific steps to be sure you protect yourself. Let me warn you now, the few hours you spend on this are not going to be the most fun, but it is critical you take care of it now. It will be much, much worse if you wait and are a victim of identity theft.

I’ll try to make it as easy as possible for you with links and instructions.

• First, don’t sign up for the protection that Equifax is offering. It’s garbage and only lasts a year, and, unless you opt-out of it, means you can’t be part of suing Equifax later on. I also don’t trust the company that just had the biggest data breach in history to be able to protect my data. Pass. Due to the severity of the breach, they should offer identity theft protection for life.

• Sign up for Credit Karma (https://www.creditkarma.com/). You will get free credit scores and free monitoring of your credit reports. If anything unusual happens, they will contact you. It’s a free service and you should sign up for all adult members of your family.

• Place a credit freeze on all three of your credit bureau files. A credit freeze is THE SINGLE MOST IMPORTANT THING YOU CAN DO TO PROTECT YOURSELF. It literally locks your credit bureau files so NO ONE, including you, will be approved for new credit. A thief could have your information and they will apply rapidly for credit, all of which will be denied. They will eventually move on. Depending on the state you live in, there will be a $0-$15 fee to set this up, and you need to do this for each adult member of your family.Here are the links:
  https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp
  https://www.transunion.com/credit-freeze/place-credit-freeze
  https://www.experian.com/freeze/center.html

  Because millions of people are setting these up the systems are not all working. I was able to set up Equifax and Experian, but not TransUnion. I will keep trying throughout the next day or so, and if it doesn’t work I will take care of it via mail.If you need to apply for credit later, you can un-freeze your reports for a limited period of time, after which is will re-freeze.

• Place a fraud alert on your accounts. This is simply an extra step that puts an alert on your credit report that you might be a victim of identity theft, and that they need to call you before any transactions can be approved. It only lasts 90 days, but you can put the alert on there repeatedly. I already have a note on my calendar 90 days from today to renew the alert. You only need to place the alert with one company then they will place the alert with the other two. I recommend you use TransUnions fraud alert system – I found it to be the easiest one: https://www.transunion.com/fraud-victim-resource/place-fraud-alert

• Sign up for Zander Insurance identity theft insurance. For $145 a year it protects your entire family, including your children. They have a 100% recovery success rate and protect you against all types of ID theft, including tax fraud, medical ID theft, and, of course, financial fraud. If your identity is stolen as a result of the Equifax, or any other breach or identity theft, they will take over and fix everything. It is well worth every penny. You can sign up for that here: https://www.zanderins.com/idtheft2

• Speaking of children, does it make sense to freeze their reports? The credit bureaus don’t want you to be able to do that, but some states have made it mandatory. All three bureaus are falling in line, but none will allow you to do it online. TransUnion will do a search, for free, to see if your children have credit reports. You can find that here: https://www.transunion.com/credit-disputes/child-identity-theft-inquiry-form.

• Utah is taking things one step further – they have set up a Child Identity Protection Program through the Attorney General’s office that registers your children’s Social Security numbers as a number belonging to a minor, which will help protect their data. You can find that program here: https://cip.utah.gov/cip/SessionInit.action. If you live in a different state encourage your attorney general to create a similar program. Because I live in Utah and have this option, along with the Zander protection, I don’t feel that I need to freeze their credit, but if I lived outside of Utah I would absolutely take that step.

• Because credit card numbers were stolen, I recommend calling the toll-free number on the back of each credit card you have and requesting a new number. It’s a pro-active step you can take to prevent unauthorized charges in the future.

Again, I realize this isn’t fun – it’s a lot of work to set these things up, but I wouldn’t delay. Take a couple of hours today and get all of this done. Taking these steps is like building a brick wall between you and identity thieves.

What about identity theft monitoring or insurance? Does it make sense to purchase it?

An important note up front – no product or company can protect you from having your information stolen. The most common way your data is stolen is through data breaches. If you have a Yahoo account, for example, some of your data has already been stolen and, as we have learned recently, it has probably been sold several times over.

That doesn’t mean there aren’t steps you can take to secure your information better (see last post for ideas), but having identity theft “insurance” doesn’t prevent your data from being stolen any more than having auto insurance keeps you from being involved in an accident.

Let’s take a look at each of the various types of identity theft protection – monitoring, insurance and recovery.

MONITORING SERVICES

Monitoring services alert you when someone else might be using your information. Services generally include:

• Tracking activity on your credit report
• Sending you an alert when your personal information (bank account, Social Security number, driver’s license number, passport or medical ID) is being used
• Access to credit reports and/or scores

No company or service can monitor all activity on all websites and merchants, but most of these companies do their best to monitor your personal information at as many places as possible.

IDENTITY THEFT INSURANCE

Identity theft insurance pays for out-of-pocket expenses incurred for recovery, which may include:

• Postage, copying and notary fees
• Less often, lost wages and legal fees

A few important notes about identity theft insurance:

• This type of insurance almost never covers stolen money or other financial losses
• There is generally a deductible
• There is no payout if the loss is covered by any other types of insurance, such as homeowner’s or renter’s insurance
• The majority of people who are involved in identity theft have almost no out-of-pocket losses. Most people pay little to nothing to copy or print things at home, postage is cheap and notary services are usually free at your bank. By the time your deductible kicks in you are unlikely to gain anything.

RECOVERY SERVICES

Recovery services help you deal with the effects of identity theft after it happens. Services generally include:

• Assigning a case manager to help you work through the process
  • With some plans you actually grant authority for the case manager to act in your name, with others they guide you through the process
• Placing a fraud alert on your credit file
• Placing a security freeze on your credit file
• Helping you prepare letters to send to collectors
• Closing any tampered or fake accounts and opening new ones

Let’s take a look at two specific companies – LifeLock and Zander Insurance.

LifeLock[i]

Standard protection is $10 a month or $109 annually. Prices go up to $29.95 a month for premium services.

Basic services include:

• Website surveillance
• Cancel credit cards if stolen
• Send alerts when your information is being used
• Replace stolen funds up to $250,000 (only what the bank won’t replace)
• Spend up to $1,000,000 on lawyers, accountants or others to restore your previous status

Zander Insurance

Zander is $75 year ($6.76 a month) for an individual or $145 a year ($13 a month) for family protection.

Zander operates their protection plan on the premise that financial identity theft is only one of more than 15 types of identity theft. There is also Social Security, criminal, employment, medical, tax refund and other types of fraud, many of which won’t be discovered by monitoring. In many cases you won’t know you have been a victim until you get a letter from the IRS or a doctor bill or even a warrant for your arrest.

Their focus is on identity theft recovery. Services provided include:

• Up to $1,000,000 reimbursement for any stolen bank funds or unauthorized electronic funds transfer (only what the bank won’t replace)
• Unlimited legal fees if needed
• $0 deductible
• Contact banks, bureaus, insurance companies and doctors for you

What I Recommend

No strategy is perfect, but this is my plan:

• Use CreditKarma.com for monitoring (they send me an e-mail anytime something changes on my credit report)
• Use YNAB (youneedabudget.com) to review my bank and credit card transactions daily
• Shred any documents with financial or personal information
• Use https://www.optoutprescreen.com/ to stop receiving most pre-screened credit card offers
• Put a security freeze on my credit bureau reports
• Check one credit report every 4 months on annualcreditreport.com
• Copy the front and back of all cards in my wallet
• Use a service such as LastPass.com to manage and use different, secure passwords on each website
• If my wallet is stolen or I am a victim of a breach place a 90-day fraud alert on my credit bureau accounts
• Sign up for Zander’s plan for recovery services (I believe it is worth the $145 a year for the services they will provide)

If you have taken all of these steps but choose not to sign up for recovery services, the FTC has created a new website that will help you recover. It generates pre-filled letters and walks you through exactly what you need to do to recover. You can find the website at http://www.identitytheft.gov.

[i] For both LifeLock and Zander be sure to review their services before signing up. Services may have changed since this article was written.

Identity theft really is a problem that affects millions of people each year. It causes untold numbers of hours and dollars to fix the problems.

While it is impossible to stop all identity theft, there are some simple steps you can take to protect yourself better.

Shred Documents with Your Personal Information

You should shred any document from a financial institution, any pre-approved credit card offers, and any other documents with your personal information on it. Shredders that shred in long strips don’t work – thieves can tape together the strips (and will tape them together) and get your information or apply for credit. Some sites suggest simply tearing up and throwing away pre-approved credit card offers. Does that work? Check out this site for your answer:

http://www.cockeyed.com/citizen/creditcard/application.shtml

Use a cross-cut shredder to make sure it is fully destroyed.

Opt-out of Receiving Pre-Screened Credit Card Offers

On the website https://www.optoutprescreen.com/ you can opt-out of receiving pre-approved credit card offers. Eliminating these from your mailbox is one less thing for thieves to be able to steal.

Protect Your Social Security Number

Don’t carry anything with your Social Security number printed on it. Check your wallet or purse to see if you are carrying your social security card OR any other item with your Social Security number printed on it. Thieves really only need this one piece of information to steal your identity, so taking steps to keep it safe will help you keep your identity safe.

Don’t reply to “Phishing” E-mails

Never reply to e-mails for requests for any personal information, even if it looks like it is coming from your bank. Your bank will never request personal information via e-mail.

Put a Credit Freeze on Your Credit Report

One of the most effective things you can do to protect your identity is to freeze your credit. A credit freeze prevents the information in your credit file from being reported to anyone.

If a thief does steal your identity they can’t open new credit because your record is frozen. This will also prevent you from opening new credit unless you plan ahead and “unthaw” your credit report for a period of time.  Credit freezes and unthaws do cost money, but think of the money spent like an insurance policy. Here are the websites to freeze your credit report:

https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp

http://www.experian.com/consumer/security_freeze.html

Check Your Credit Report

It is important that you check your credit report on a regular basis. You can get one free copy of each of your credit reports annually by visiting www.annualcreditreport.com. A strategy I use is to check one of the reports every 4 months – that way I am checking it out on a regular basis. If there are any errors or accounts you don’t recognize you need to take steps right away to get it taken care of.

Pay with Cash

A while back I got a call at 7:30 in the morning on a Saturday from the Fraud Department at my bank. My credit card number had been used for an online purchase that seemed uncharacteristic (it was a Jewish dating site), and the Fraud Department was calling to find out if my wife or I had used our card there. We had not, so they immediately closed down the card and issued a new number. When we tried to figure out how it happened we realized that the most likely scenario was when we used our debit card the last time we ate out. When the waiter/waitress takes your card and disappears with it for 2-3 minutes it is easy for them to snap a photo of the front and back using their cell phone. We now pay with cash anytime we eat out.

To review, you can help prevent identity theft I recommend that you:

• Shred documents with your personal information
• Opt-out of receiving pre-screened credit card offers
• Protect your Social Security number
• Don’t reply to “Phishing” e-mails
• Put a credit freeze on your credit report
• Check your credit report
• Pay with cash

What about identity theft insurance? Is it worth the cost? I’ll review what it is and my opinion about it in my next post.

Your credit score plays a larger factor in your life than you might realize. For example, your credit score is a factor in:

• The rate you pay for loans
• The deposit you pay for utilities and your cell phone
• Your auto insurance
• Getting the job you want
• Getting into the apartment you want

In addition to all of these benefits of having a good score, monitoring your score regularly can also alert you to potential problems. If an account was opened in your name that you are not aware of, you could be a victim of identity theft.

There are several ways to monitor your score, but one method stands out due to its ease of use, how comprehensive it is, and the price (it’s free). That tool is Credit Karma.

Here is how Credit Karma describes their services:

Our goal is to help you understand your credit and get more out of it. Along with providing free credit scores, reports and monitoring, we offer insight into what it all means and show you product recommendations, like credit cards and loans, based on your credit profile.

Basically they pull a copy of your credit report and scores from TransUnion and Equifax, and you can check it as often as you want (the website recommends weekly). You can then go in to detail about the six factors that determine your score (credit card utilization, payment history, derogatory remarks, age of credit history, total accounts and credit inquiries), along with recommendations for how to improve in that area.

For example, if the website shows that you have a poor ranking in credit card utilization you can click on that area and it will show how utilization is calculated, how much of a balance you are carrying on each card and several tips for improving in that area.

You can also run simulations to see how different scenarios would affect your score. For example, you can simulate what will happen to your score if you close a particular card, or pay your balances down or make a late payment.

Questions about Credit Karma

Is it secure?

Yes, it is secure. You do have to enter your social security number for them to be able to pull your report, but they take your data security very seriously. You can read about their security practices here: https://www.creditkarma.com/about/security.

Doesn’t pulling my credit hurt my score?

Yes and no. A hard inquiry (such as applying for a loan) does affect your score (only to a small degree, though). However, a soft inquiry does not. A soft inquiry is when you pull your own report, or your employer does, or a company like Credit Karma does. Reviewing your report and score on Credit Karma will have no effect on your score.

Will Credit Karma sell my information?

No. Their privacy policy restricts them from selling your information.

How is it free?

Credit card and loan companies pay for targeted advertising on the site. You will see recommendations specific to your situation and score. For example, when I logged in today it showed my four recommendations for credit cards, based on my credit score. I find their advertising very unobtrusive.

Check out Credit Karma today at https://www.creditkarma.com/.

NOTE: This will be the first in a series of articles about financial planning tools. I will review the tools that I have researched and use for my personal finances. If you have other tools you use to manage your money, please share them in the comments or in an e-mail.

• The National Retail Federation reports that we spend about $52 billion on Black Friday. [i]
• IBM, who tracks online transaction sales, reported that we spend between $1.5 and $2 billion on Cyber Monday.[ii]
  

I personally am not a big fan of Black Friday, especially now that it is creeping onto Thanksgiving. It seems more and more companies put their sub-par products on sale for the weekend. I am also not a fan of standing in line for hours in the cold or being trampled or assaulted by people fighting over a phone or yoga pants, but that’s beside the point.

Today’s Tip is about the remaining shopping that you will be doing. A lot of people will shop online for gifts, and I want to make sure you do so safely.

Here are five tips for sale holiday online shopping:

1. Be sure the website’s purchase page is secure. It doesn’t matter if the rest of the site is secure or not, but be sure the page where you enter your credit card is secure. Here’s how you can tell – the browser should say https instead of http, and you should see a lock icon somewhere on the page. Here is what the Amazon.com sales page looks like:
   You can see both the https and the lock icon, which means it is a secure page.
2. Don’t purchase items from e-mails unless you can verify where they came from. I get deals in my inbox from Walmart, Target, Amazon and many other reputable companies. E-mail marketing is cheap and effective. However, I also get deals like this one:“Get the New 32GB iPad Sold for $31.08!”This is from an e-mail send by “Adison Greg” from some website that no one has ever heard of. When you get those emails don’t click any links in them, including the “unsubscribe” link. Delete them immediately! They are Spam and many have some kind of virus. If you don’t click on them you will be safe.
3. Use your credit card to purchase online. Never trust a website that doesn’t accept credit cards, or that encourages you to pay using Western Union or something like that. Your credit card has protection built in, as do websites like PayPal. If you never receive the item, you can file a dispute and your credit card company won’t charge you for the item.
4. This is a tip I almost learned the hard way – I got an email saying that my purchase of 2 Nexus 7 tablets being sent to California from Walmart had been cancelled because they couldn’t verify the shipping address.  Concerned, I logged into my Walmart account and sure enough, there was an order for two Nexus 7 tablets that were scheduled to be sent to some random address in California. After doing some research I found that this isn’t uncommon – hackers get into the databases of these websites and can try to order things using your account. This only works if your credit card is stored on the website. Walmart.com, for example, stores your card without asking if you want it stored – they do it automatically. I immediately changed my password and deleted my credit card from their system. I no longer store credit cards on any websites – it only takes a minute to enter the card number and I feel more secure that way. Each time I purchase on Walmart.com now I immediately go to my account and delete the credit card number.
5. Consider purchasing pre-paid shopping cards to purchase online. I know some people don’t like to use their personal credit card online, so they purchase pre-paid shopping cards and use that for all their Holiday shopping. A bonus is that you can set your limit and not spend any more than that.

Like many of you I do quite a bit of online shopping and will continue to do so. If you will follow today’s tips (especially tips 1-4) you can shop online with confidence.