IDENTITY THIEVES WILL PERFECT THE "INSIDE JOB"

Wikipedia defines the “inside job” as “…a crime, usually larceny, robbery or embezzlement, committed by a person with a position of trust who is authorized to access a location or procedure with little or no supervision, e.g., a key employee or manager.” It goes on to identify former employees knowing the company’s layout as potential perpetrators. In Wednesday’s post, “IDENTITY THEFT INCREASES 47 PERCENT IN 2008 OVER 2007,” I quoted a just published report by Identity Theft Resource Center (ITRC) finding that Insider theft doubled in 2008 over 2007. When the times get bad, the bad get smarter.

At the end of 2008, there was an article from MSN Money with some facts that are both scary and eye-opening. It stated that 18 percent of the corporate world saw an increase in monetary theft among employees, with another 41 percent unsure. Here’s a statement that should jar any company: “Employers are hot targets for theft because workers "…know their systems, controls and weaknesses, and they can bide their time waiting for the right opportunity." This from Jack L. Haynes Int’l, supplier of workplace crime-prevention services.

And the employees guilty of the biggest heists frequently are the most highly trusted. These are the ones who can get into company computers and make off with your names and personal data. They are close to it every day, often with unlimited access. I am not just talking about junk mail databases of millions of names and private information, but also non-junk mail companies that also warehouse your sensitive data. Folks, there are few corporations out there that don’t maintain thousands of personal records on their customers and/or employees.

A Pricewaterhouse study even found that senior-level workers that had been around over seven years were responsible for 25 percent of all reported internal fraud. Most are men and they are well educated. Jack L. Haynes Int’l reports that about one out of every 28 employees was apprehended for stealing in 2007. Combined, these are all the ingredients for a disaster if the downturn in the economy gets worse and more people get desperate.

TechNewsWorld said it back in 2007: “A ticking time bomb of sorts is hidden away in the cubicles and workstations of many businesses. When it goes off, the personal financial information of customers and workers could be laid bare.” Yet one more survey provided some of the most significant findings. A Compuware commissioned study by Ponemon Institute revealed that 75 percent of all breaches in the U.S. were caused by insiders, while only one percent by external hackers.

So what’s the solution?

Bring the consumers of this country together to demand that Congress and the new administration get together to pass legislation that gives consumers control over their names and personal data. In the same bill, allow for compensation to the name-holder when it is sold to encourage individuals to assume this new protective responsibility. Now is your time to be heard. Contact your U. S. Representative; your Senator; The White House.

IDENTITY THEFT INCREASES 47 PERCENT IN 2008 OVER 2007

If you thought you had seen the worst of the identity crisis, think again. A report just released by the Identity Theft Resource Center (ITRC) shows 656 breaches disclosed in 2008 compared to 446 in 2007, a whopping increase of 47 percent. Like The Dunning Letter has been saying since mid 2008, the bad guys are just getting started, and, unfortunately, they are getting better. ITRC breaks the breaches down into five groups: Business had 36.6%; Education 20%; Government 16.8%; Healthcare 14.8%; and Financial Institutions 11.9%. While Government improved from first to third, Business took over this unenviable position.

The most frightening figures proving the sheer recklessness of all data collectors is that only a pitiful 2.4 percent of all breaches had encryption, and just 8.5 percent had password protection. Folks, we are in year three of this identity dilemma which started when the ChoicePoint data hit the fan in February of 2005 and brought this whole mess out into the open. Apparently the term “what does it take” is completely lost on those who collect, manipulate and sell our names and personal data.

ITRC breaks data loss down into five methods: insider theft; hacking; data on the move; exposure; and subcontractor. Further, they divide the latter by financial institutions, general business, education, government and healthcare. In last Monday’s post, “JUNK MAIL NEEDS REGULATION…AND NOW!” I talked about data on the move in the junk mail industry, specifically from mailing list/data brokers. Hundreds of thousands of names and private information sent to the wrong address and never retrieved. It would be an ID thief’s dream if he or she knew how to locate this gold mine…and eventually they will learn.

Electronic breaches still maintain a significant lead over paper breaches: 82.3% versus 17.7%. Insider theft has doubled in 2008 over 2007, which leads me to believe that more employees are discovering the value of the sensitive data they handle. Although I have absolutely no confirmation that this has ever happened, it seems to me that it would be terribly easy, and almost impossible to detect, an intentional shipment of a storage disk with consumers’ private information to a pre-arranged “wrong address,” delivering it right into the hands of identity thieves.

ITRC reports that 41.9 percent of data breaches in 2008 went unreported; down from the last figure I could find where a 2006 Ponemon Research survey said it was 79 percent. The current estimate means that hundreds of breaches not being reported could be yielding the loss of millions of consumers’ personal records that we do not know of. When you combine that with the number of ID theft victims that do not report their loss, the results could be astronomical.

One of the recommendations from ITRC is that when sending data from one location to another, it should be encrypted. When only 2.4 percent of 2008 breaches had encryption, their suggestion sounds like a cry in the wilderness. Like we have learned over the last eight years, business is not going to regulate itself. Only federal legislation is going to get the job done, and we are fast running out of time.

JUNK MAIL NEEDS REGULATION…AND NOW!

Two articles recently from junk mail industry publication, Direct, caught my attention, because they forecasted the possibility that more data breaches could eventually originate within that business. The first, “Why Direct Marketers Switch Jobs-Often,” quotes a recent study that says “…entry-level people work for 10 to 12 companies.” These are the folks that actually handle the processing of your names and personal data for junk mailers’ advertising campaigns. The typical employee spends about 2.8 years with a company, which isn’t unusual in the current marketplace.

So how can this potentially affect the mishandling of your names and private information? Part of the problem is obvious with the regular turnover of people serving in that capacity; training is limited and experience is short. In my 35 years as a list/data broker, I personally witnessed situations where data storage devices were laying out in the open at catalog companies, list/data brokers, and computer facilities where millions of consumer records were processed daily.

There is no doubt in my mind that security has increased at every level since the 2005 ChoicePoint debacle, but this is still an entry-level clerk’s position, and you do get what you pay for. Privacy Rights Clearinghouse (PRC), one of the country’s leading privacy advocates, has “A Checklist of Responsible Information-Handling Practices” on its website. The Direct Marketing Assn. (DMA) has its own “INFORMATION SECURITY GUIDELINES“ Any company, junk mail or non-junk mail that follows these guidelines would have a reasonably secure environment for its personal data.

As an example, they both recommend establishing a center for privacy control and putting one person in charge. PRC suggests doing penetration studies regularly to determine if the crooks can get through your security network. The DMA advises that junk mailers should insure that all third-party handlers of their data take responsibility for securing their data. Both PRC and the DMA stress making sure private information is secure in transit from one location to another. And herein lays one of the biggest dilemmas in junk mail.

Once again during my tenure as a list/data broker, although the clerk handling our list order(s) had a typed “ship to” address right in front of them, somehow in the process of transferring that to their list order instructions, they sent it to the wrong address. Since by the time we received confirmation of this it was out of their door into the hands of UPS or FedEx, it was impossible to stop. It was re-shipped but on occasion when we asked the clerk if they found the other data storage device, the answer was almost always no.

The second article from Direct was just as unnerving since it stated that nearly half of all junk mail companies have a hiring freeze, and 20 percent of them are planning to reduce staff. Obviously this is happening in all industries and cannot be helped in the down economy. Which brings me back to the headline, above, that accentuates the need for regulation. The government should establish guidelines for the handling of names and personal data by the mailing list business, much more stringent than those already on the books.

Billions of sensitive data records are handled by junk mailers each year, yielding these companies $4 billion of revenue on an annual basis. It’s time to put some of this back into protecting the consumer.

YOUR NAME AND PERSONAL DATA IS WORTH LESS IN 2009 THAN LAST YEAR

As a sign of the times, a recent headline on MSNBC said: “Even porn industry hit by slumping economy.” Currently residing in Arizona where golf courses are as plentiful as convenience food stores, I had heard from a friend that golfing has followed the trend. But I was more than amused when Worldata, a large junk mail list/data broker, published the results of its latest List Price Index, which is a survey documenting how much junk mailers pay for mailing lists with your name and private information. There was a significant decline across major categories of lists such as books, CDs, consumer magazines, and general merchandise buyers.

If you want to see the full report of to what degree your sensitive data is precariously peddled around the U.S., even around the world in some cases, go here. If you want me to paint the poignant story for you, read on. Almost four years ago when I launched The Dunning Letter, I contacted a number of sources from the Direct Marketing Assn. (DMA) to junk mail industry publications like DM News and Direct to learn the total revenue the list business raked in from your names and private information. Not only did they not know—or, at least, they weren’t telling—but they suspiciously wanted to know why I wanted to know.

In most cases it was made clear to those asked that the information was for a piece I was writing on the industry. Doors slammed shut and telephones went “click,” which basically ended my efforts to acquire this figure from those who could most accurately determine the annual results. After a couple of months assembling numbers from a conglomeration of reports provided to the public by the DMA, and doing research through the archives of DM News and Direct, I was able to create my own formula and arrive at the total. It was determined that every year the junk mail list business grosses around $4 billion from the sale of consumer names and personal data.

I am all for free enterprise, but why is this a one-way path to the pockets of junk mailers when they would have nothing to sell if not for the name-holder? That’s YOU, of course. Most of my regular readers have heard this over and over, but why not share the wealth with those without which no revenue would be possible? Another interesting formula I have come up with reveals that if half the $4 billion was placed in a simple interest-bearing account for the name-holders, at age 65 they could supplement their retirement with an additional $607 monthly.

Getting back to a sign of the times, with pension plans and Social Security in jeopardy as they are, has someone got a better idea? If so, please come forward. My contention is that with a new administration in Washington, it is time to get back to individual rights, and there is nothing more individual than our sensitive data.

VISHING, PHISHING, SMISHING. THEY ALL SPELL TROUBLE FOR THE CONSUMER.

Continuing with the Liz Pulliam MSN Money column, red flags should have gone up all over the place when the crooks were developing their latest method of stealing our sensitive data. They would have if we had a CIA-type surveillance of the Internet underground. And why not? With the economy tanking, and identity thieves rushing to take advantage of the situation, this would be the perfect time for industry to step in and form a consortium to infiltrate the bad guys. The cost would be small across the board, and the results could be significant. It’s an idea that could happen; that is, if business is really serious about securing our private information.

Vishing is the latest consumer scam that is a spin-off from phishing, which is when the ID thief sends you an e-mail, claiming to be a legitimate company with the idea of heisting your sensitive data. Vishing, on the other hand, uses the telephone or cell phone to do the same thing by leaving a voice or text message that says your bank or credit card account has been compromised. Recipients are told to call a toll-free number where they are instructed to dial in credit card or bank account numbers, including PIN numbers.

It suddenly occurred to me while writing this article that one of the most unique factors in the identity crisis is the number of names we have had to come up with, almost on a daily basis, just to keep up with the spate of consumer scams.

Vishing has been around for a while, but has recently picked up speed according to a December 2008 FBI report identifying new techniques exploiting the software used in the scam. Asterisk is free software used with Voice over Internet protocol (VoIP), which allows the bad guys to call multiple numbers leaving their automated messages. You should never reply to these calls; neither banks nor credit card companies use this form of communication to contact customers. One documented incident as late as mid-January 2009 used American Express as the target company.

In another article in The Washington Post by computer security columnist, Brian Krebs, he outlines “The Anatomy of a Vishing Scam.” Krebs leads with a reality that has been troubling to Internet providers and users for some time; the fact that there are gaping holes in our technology that allow these breaches. It could lead one to believe that the scam artists are much smarter than the technicians that maintain our names and personal data. The piece confirms the use of the VoIP software, and documents the sophistication used by the crooks.

As an example, one group of attacks were directed to financial institutions’ customers’ cell phone numbers, but restricted to only the geographic area served by the bank to maintain credibility. After compromising a web site to serve as their host, they downloaded the phone numbers that would receive the vishing messages and they were on their way. What is frightening is the fact that Lawrence Baldwin, who was brought in to investigate the attacks, learned that from one server alone about 4,400 people actually called the bogus number, and worse, 125 of those (2.8 percent) entered their full credit/debit card number, expiration and PIN.

Like P.T. Barnum said: “There’s a sucker born every minute.”

CAUTION ADVISED ON POTENTIAL FOR ID THEFT IN THESE TOUGH TIMES

If you think the heisting of our sensitive data has already been as bad as it can get, then think again. Preying on the elderly and the suckers among us is bad enough, but taking advantage of bad economic times—which much too often still involves the elderly—is a step that establishes the identity thieves as the worst of the scumbags. But this is the normal approach for the greedy, and we should have anticipated their plans. However, their tactics and modern technology seem to move at a pace just ahead of law enforcement, which is unfortunate for the consumer.

Liz Pulliam Weston’s column on MSN Money, as usual, does an excellent job of taking us from the present into the future of where we can expect to go with the identity crisis. Yes, we had fewer victims in 2007 (2008 results are not out yet) by .67 percent. The Javelin Research report goes on to recount just where your private information breaches are coming from: 33 percent lost or stolen wallets; 23 percent lifting your pin or credit number while looking over your shoulder during a transaction; 17 percent by your family or friends; 12 percent online; and 7 percent resulting from data breaches.

Pulliam has indicated in her piece the fact that ID theft resulting from data breaches ranks last, but let me point out that, even in last position, it produced just-under 600,000 victims in 2007. At $5,720 each, that’s $3.3 billion lost by consumer fraud, and 14.7 million hours wasted by them in repairing their credit. Of course this is only one method of stealing your stuff. One can only wonder if all this has taken its toll on the productivity of the American worker. It has certainly established its position in whittling away at the family budget of those affected.

The article has some good points on how to protect your personal data from maintaining a file of credit card telephone numbers in case of loss, to whether or not you should freeze your credit. I strongly urge you to read this piece in its entirety for a wealth of facts that will help keep your identity safe. In particular is a section on ATM use, and the protection of your pin numbers due to the fact that the crooks are increasingly targeting bank accounts. You close one door they open a new one immediately in their quest to steal our private information. What Pulliam is saying—as is about every privacy advocate in the world—be vigilant any time you are in the process of a financial transaction.

Pulliam also covers the latest twist on “phishing,” which is when the bad guys send you an e-mail, claiming to be a legitimate company with the idea of heisting your sensitive data. The new spin on this is called “vishing,” which involves leaving a voice message on your telephone landline or cell phone, or text messaging your cell phone. That’s next time.

WHAT DOES THE BERNIE MADOFF SCANDAL HAVE TO DO WITH ID THEFT? MORE THAN YOU THINK

Bernie Madoff awoke one morning in his East Side apartment to face two FBI agents. Special Agent Theodore Cacioppi asked him: “We're here to find out if there's an innocent explanation," referring to reports his investment firm had stolen billions from its customers. Madoff replied: “There is no innocent explanation.” And that is one of the comparisons to identity theft; the only reasoning in either case is the greed of an individual that overrides all common sense and decency.

When the tanking economy prompted many of Madoff’s investors—which included big names like real-estate magnate Mortimer Zuckerman, Nobel laureate Elie Wiesel, Sen. Frank Lautenberg, Hollywood director Steven Spielberg and Zsa Zsa Gabor, some, close friends—to pull out their money, the fraud was finally discovered. Employees actually went to his apartment where Madoff admitted the fraud. His two sons, also among the shocked employees, called the Securities and Exchange Commission, which tipped off the FBI, according to a New York Daily News article.

Thus, the second comparison to ID theft. According to Javelin Strategy & Research, almost half of identity fraud is perpetrated by friends, neighbors, employees, family members or relatives.

Bernie Madoff is charged with the biggest Ponzi scheme ever, costing his victims $50 billion that many experts believe is a complete loss. Coincidentally, almost $50 billion was lost to identity theft in the last Javelin survey, this through a network of crooks that come across almost as sophisticated as Madoff. The point here is that it would be near-impossible to protect against an investment conspiracy like Madoff’s, since years of reputation and friendship were used to pull off the scam. Of course, questioning the spectacular results being experienced in such a down economy would have helped.

On the other hand, it is possible to prevent identity theft by giving consumers control over their names and personal data, and compensating them when it is sold to encourage taking over this new responsibility.

In the meantime, I thought we might start a “Buddy System” to help friends, relatives, even strangers if they will listen, to guard their private information from the bad guys. You remember summer camps when you went swimming and everyone was assigned a buddy for both of you to watch each other. Of course, today’s breast cancer buddy system is one of the most prominent and successful.

As a privacy advocate who lives the part every day, I am amazed at the number of people I run into who either do not understand the basics of protecting their sensitive data, or are of the group that thinks it could never happen to them. In other words, it is at the bottom of the priority list, and is likely to stay there until public recognition is aroused. Perhaps those of us who understand the problem can pass the word around of just how important it is to safeguard our private information.

Just tell them if they don’t, and their identity is stolen, it could cost them $5,720 and at least 25 hours to take back their credit. That’s the facts, folks.

SHADY CHARACTERS ABOUND IN THE IDENTITY CRISIS

Remember the old days when we used to think of something on the black market being either jeans, CDs, videos, even body organs? Now there’s a new player on the block and they are interested in your name and personal data. It’s a well organized, calculated business to acquire all the consumer private information that can be had, either easily, or no matter how much effort it takes to get it. The idea is to steal your sensitive data, and, rather than capitalize on what they have themselves, the thieves sell it around the Internet underground to thousands of takers who then proceed to cop your identity.

Newsweek had an article last December, by Benjamin Sutherland, quoting a French security specialist who estimates there are several hundred online marketplaces just bursting with your latest personal data. My take is that number is conservative. It’s the general run of information that is available. Bank accounts that go for 5 to 10 percent of your balance. But credit cards are the most in demand, garnering around $450 for 10 accounts if you are in the U.S. or Western Europe. Like any other commodity, it is quality that determines the final price.

Naturally, I still believe that my concept of giving consumers control over their names and private information would put an end to this black market trade. Let’s set up a scenario where the crooks have stolen your personal data, including your Social Security number, and have sold it extensively to the underground.

The next move by the bad guys who bought your private information would be to open all the new accounts they can before being discovered. Then, either make purchases in your name or go for whatever cash is available in the credit line. Regardless, you’re on the line for the dirty dealings until, and if, you can prove it is ID theft. But wait…resulting from federal legislation, you were given the right to control your sensitive data, and through a process of approval necessary, whenever your private information is used, you have the ability to stop any and all transactions, ultimately spoiling the heist.

If you want to see the mechanics of how this control over your name would work, go here.

Since much of the thievery of our private information originates outside the U.S., it is sometimes near impossible for the American government to identity the bad guys, must less get the country to take action against them. As an example, in a 2006 study of phishing, 4 percent came from Great Britain, 6 percent from China, 8 percent from India, and 14 percent from South Korea. It is a well known fact that a great deal of identity scammers reside in Russia. In case you’re wondering, phishing is sending an e-mail posing as an established company to get the receiver to give up sensitive data.

In a crooked reseller’s market, the number of times your personal data is sold is unlimited, which means that there are endless possibilities where your identity can be breached and stolen. This is all escalating to a point where current methods of protecting the individual’s identity are proving useless. If someone has a better idea than giving consumers control over it, let them come forward. Pretty soon it will be too late.

DUMBING DOWN ON PRIVACY

A Penton Media junk mail online publication, Chief Marketer, looks at the future of Direct Marketing after the election. Lots of plans, but nary a mention of how the industry would strive to improve sensitive data security. Of course we wouldn’t want it to be top priority, with identity theft running at the head of the consumer fraud class. With the Direct Marketing Assn. trade group downsizing recently, there is even less oversight for junk mailers who push the envelope or even commit outright deception. Hopefully, the age of “let business police itself” went out the door with George W. Bush. Sorry, but it is obvious from the economic mess we are in right now that has affected so my industries that greed at the top has more appeal than doing the right thing. With around 60 million junk mail households in the country, they have the right to expect that this business lives up to the highest standards in handling their names and private information. Therefore, I hope that the new administration will consider some regulation of junk mailers when it addresses the identity crisis…and soon! Wrong conclusion on new Better Business Bureau strategy. First of all, I don’t believe the BBB is consumer oriented enough; it is clearly more in the corner of business. But an article on MSNBC by Eve Tahmincioglu, misses the point completely about the new agency’s approach. The author takes them to task over a revision in rating businesses that sets up a report card system (A thru F) that is much easier to interpret when deciding to deal with a company or group. She even makes a statement in the piece that proves my point. She says: “Before, if you were a business owner all you had to do was get yourself off the unsatisfactory list and you'd be okay with customers.” A few years ago when the qualifications were “satisfactory” or “unsatisfactory,” I questioned the “satisfactory” rating of a “get rich quick” junk mail company for having a large, and I mean large, number of complaints. The BBB’s answer was that, with regard to the number of complaints in relation to the amount of business they did, the formula considered them OK. Having spent over 25 years as a junk mail list/data broker at the time, I knew that their “amount of business” was reported as the number of suckers that responded to an appeal that promised they would get rich overnight. No wonder the proportion worked in their favor. The new system would probably give them as F, at least a D. Here we go again with another anti-identity theft bill. OK, at least it is designed to make it harder for the bad guys to get your Social Security number. Senators Judd Gregg (R-NH) and Dianne Feinstein (D-CA) introduced the bill in January, according to junk mail publication, Direct. Called the Protecting the Privacy of Social Security Numbers Act, it prohibits the sale, purchase or display of a Social Security number by any person without the number holder’s consent. That’s good for legitimate business, but what about the Internet underground that could care less about federal legislation. Why can’t these lawmakers just realize that there is only one way to end the identity crisis? Give consumers control over their names and personal data, and compensate them when it is sold to encourage the acceptance of this new responsibility.

WILL PRESIDENT OBAMA TAKE ACTION ON THE IDENTITY CRISIS AND WHEN?

First, let’s all congratulate our new President, and wish him well in the next four years. It has become painfully obvious since the election just how much Barack Obama will need our support, and he has made it clear on several occasions, there is only so much government can do. The rest is up to the people, as once again we can expect that their voices will be heard by a new administration that is telling us it wants our input.

As a matter of fact, the Obama transition team established a website where consumers can ask questions of President Obama, while suggesting what should be done in the next four to eight years. Change.gov has already taken more than 76,000 questions from over 103,000 people, and you can be next. Naturally, I have asked the President if he would consider federal legislation that would give consumers control over their names and personal data. The top questions so far are would Obama investigate the Bush/Cheney administration for its wrongdoing and would he favor legalizing marijuana?

According to a 2007 article in junk mail industry publication, DM News, a then Senator Obama sent a letter to the Federal Trade Commission in May of 2007, suggesting they increase their efforts to protect elderly citizens from telemarketing scams. It was directed at junk mailers who took advantage of seniors, and was a result of the New York Times article that same month covering the problem. You can see a copy of his letter here. Junk mail data broker, InfoUSA, was singled out as providing lists of older Americans to telemarketing fraudsters. Lists with titles like, "Suffering Seniors" (people with cancer or Alzheimer's disease); and "Oldies but Goodies" (gamblers over 55 years old).

When I worked as a list/data broker, the list business had a nickname for them: the “gullibles.”

Robert Gellman, a privacy and information policy consultant and DM News columnist voiced concern this kind of publicity would “play negatively” for junk mailers. In response to a spokesman for InfoUSA, Stormy Dean, who was quoted as saying, “When it comes to these telemarketer scams, how a list purchaser uses a list is out of our control," Gellman commented that this position was wrong, that InfoUSA had a problem and should acknowledge it.

My comment: It is Dean’s kind of attitude that sends chills down the spines of privacy advocates, confirming once again that the junk mail industry does not exercise adequate security to protect the identities and sensitive data of its customers.

No matter what direction the Obama administration takes on behalf of privacy, particularly the identity crisis—I am not naïve enough to think it ranks up there with the problems of the economy, the Iraq War, or the mideast situation—but if something is not done soon to protect the public’s sensitive data, the entire infrastructure of the American family will be in danger.

The new President asked for our help; let’s give it to him in the form of suggestions you might have on this important issue.

WHO OWNS YOUR NAME AND PERSONAL DATA? ACCORDING TO THE JUNK MAIL LIST INDUSTRY, THEY DO

Surprised? Probably not. Some of you don’t care, many don’t want to worry about it, a lot think it doesn’t make any difference. You’re all lumped into a category I call the “Apathetics.” Oblivious to what is happening to your private information until you’re hit with identity theft...and then it’s too late. Mailing lists are a big business, bringing in an annual gross figure of around $4 billion. That’s a number I worked on for several months, using my own formulas and sources of data because junk mailers won’t tell anyone how much this profit center is worth. My figures are based on 35 years as a junk mail list/data broker, so you can see they do have credibility.

Naturally, list owners—as they refer to themselves—are quick to protect this revenue stream that produces approximately 60 percent profit. Keep in mind, this is actually a by-product of the purchase you made of a product or service from some junk mailer. Somewhere in the order form, almost hidden at times, you will be told that your name—not mentioned, but including private information in some instances—will be “shared” or “exchanged” with other reputable mailers. Never, will they come right out and say that they sell your name up to 50 times in a year, based on each purchase you make. Some let you opt out of this, yet others, even some large junk mailers, do not.

The way they protect this gold mine is by forcing other junk mailers to sign a “list rental agreement” with terms that restrict the selling of your name and address. That’s good for the consumer since most contracts prevent sending you pornography, or fraudulent offers. But also included in each arrangement is the verbiage stating that your name, address, possibly personal data, being sold to the other junk mailer remains the exclusive property of the list owner. Although, perhaps, a technicality to define who originally collected the names and addresses, most junk mailers take this literally as a mandate of their sole proprietorship of our private information.

As an example I picked one of the largest list/data brokers to prove the point. Worldata, out of Boca Raton, Florida clearly states in their agreement that the List Renter “…agrees that this information is the exclusive property of the List Owner.” “Information,” of course, is your name, address, maybe personal data. In the beginning you can see that this is a current instrument used by the junk mail industry today because of the 2009 dateline.

Don’t get me wrong. I don’t think the individual should own their name and private information either, due to the number of con artists out there that would take advantage of those who are vulnerable. My concept is that your name and personal data should remain as a free spirit, much akin to how the airwaves used to be in delivering broadcast media. Like the radio and TV stations that transmit the programming do, consumers should have control over their sensitive data. And, they should be compensated when it is sold to encourage taking on this new responsibility.

However, it will be impossible to sell this concept as a federal law until American consumers convince their congressional leaders they want control over their names and private information. Only then will we stem the tide of junk mail industry lobbyists that somehow have prevailed upon Congress that they are the rightful owners of America’s individual identity.

WILL FEDERAL TRADE COMMISSION CHANGE ITS TUNE TO PLACING CONSUMERS BEFORE BUSINESS UNDER PRESIDENT-ELECT OBAMA?

It can’t get much worse; I’m talking about George W. Bush’s rein over making sure the business community takes complete preference over the lowly consumer. We were simply pawns to this man and his renegade posse that almost put this country in an economic stupor. But rather than rail over the incompetence and deplorable decision-making by “W,” let’s look at how the Federal Trade Commission can change its tactics back to the agency that is supposed to stick up for U.S. citizens in the marketplace.

Of course, my primary concern is over the individual’s privacy, specifically how this relates to the identity crisis. It won’t be long before Javelin releases its 2008 report on identity fraud, and I expect, with some exceptions, it won’t look nice. As an example, in 2007, although down almost 10 percent from 2006, ID theft victims still numbered 8.4 million, and lost $49.3 billion, also down somewhat from the earlier year. The average fraud amount in 2007 went down to $5,720 from $6,278 in 2006, and on average it took you 25 hours to solve your predicament. Even if it improves in 2008 by proportion, we still have a long way to go in resolving the identity crisis.

In October of 2002, a warning headline in junk mail industry publication, DM News, “List Industry Could Be Next Target for the FTC,” cautioned junk mailers that investigations could be underway soon into some of the questionable techniques used by data brokers to sell your names and personal data. Howard Beales, then, director of the FTC’s bureau of consumer protection, said in an October 24, 2002 meeting, “We’re very interested in pursuing investigations involving lists and list brokers.”

As a former junk mail data broker for 35 years, I filed a request with the FTC in Sept. of 2003 under the Freedom of Information Act for more specifics on this meeting, but received little because there really wasn’t much more than what was covered in the above article. Knowing what I know about the selling of mailing lists, I could have turned the get-together into a consumer rumble for the rights of individuals to their sensitive data.

Beales did say they had caught Eli Lilly releasing e-mail addresses for 600 users of Prozac; Microsoft did not maintain the level of security promised for its Passport System; and American Student List Co., along with National Research Center for College and University Admissions sold students’ names, addresses and dates of birth in the marketplace after promising they wouldn’t. All meaningful consequences to our privacy, but still not addressing the root problem: the fact that thousands of junk mail companies out there have consumers’ names and private information, most of which still think it is their "proprietary" property, to do with as they please. As if the individual name-holder has no rights in this issue, except an opt-out section in most junk mail offers that is, at best, misleading.

As far as I can tell, that was the end of any meaningful investigations into the secret world of selling names and personal data. By the way, Howard Beales resigned from the FTC about two years later and returned to academic life.

Next time: data broker and junk mail company contracts written to maintain ownership of your names and private information.

THE TIME HAS COME TO HOLD EXPERIAN ACCOUNTABLE

Most posts in The Dunning Letter result from bringing you current events, with some analysis on how they relate to your privacy. On other occasions, such as today, there is a necessity involved that dictates speaking out. The opportunity that presents itself is one of far-reaching concern over the credit bureau Experian, and its level—or lack of—customer service.

On August 18, 2006, I did a post, “Experian Denies My Right to Dispute Credit Report Problem,” after which I have received a parade of comments (28 to date on just this post), e-mails, and visits to this blog with searches titled “Experian dispute.” Earlier in August of 2006, I had done another post, “Level of Competence at Experian Credit Bureau Found to Be Low,” that documented my personal experience of having my credit report go temporarily missing from the paid service I used, Credit Manager, which normally provided 24/7 access online.

In other words, I had uncovered a rash of complaints against Experian, that did not appear to be anywhere near as prevalent with the other two credit bureaus, Equifax and TransUnion.

Speaking of TransUnion, they had their bout with the government and lost, all the way to the Supreme Court. Back in 1992, the Federal Trade Commission filed suit against TransUnion for selling information that was taken from their consumer credit database. The country’s highest court agreed with the FTC, and the practice was stopped.

But in the last couple of weeks I have received at least five comments, some desperate, accompanied with numerous e-mails, from exasperated victims of Experian’s abominable customer service. I can’t imagine what is taking the FTC so long to take action against this credit bureau; The Dunning Letter, alone, has recommended on numerous occasions that Experian casualties file complaints with the FTC.

I even posed this question with a top privacy advocate who also has no idea how long it will take the agency to wake up. This source does emphasize: always file a complaint because eventually the number will be too large to ignore.

This all brings me to an article I read recently in a junk mail industry publication headlined: “Experian Lays Off 130.” Agreed, this was not the company’s credit bureau operation, but rather the marketing arm for selling their database with well over 200 million consumer names and private information. Things like age, income, whether you drink or gamble, what your ailments are and the medications you take for them. The list goes on numbering hundreds of personal things this company knows about you and sells on a daily basis.

The irony of this is, why couldn’t Experian retrain these people and use them in the credit bureau’s “customer service” department, instead of putting them out of work? Anything would be better than the attention the public is getting now.

Experian’s last reported six month period revenues in 2008 generated $1.04 billion in revenue and $251 million is profit. Total company employees number 15,500, less 130. You’d think out of 15,370 people Experian could find someone to handle you complaint.

Maybe it’s time this action made its way to the Supreme Court.

NOW WE HAVE TO WATCH THE ONES WHO ARE SUPPOSED TO WATCH OUT FOR ID THEFT

If you have become a victim of identity theft, it’s your local police department that you turn to by filing an identity theft report as required by the Fair Credit Reporting Act. You will no doubt have to give law enforcement your date of birth, which they will enter into the report, which could eventually become available to others. And that is the problem. Connected to your name and address—also in the report—your date of birth is one of the primary elements the crooks need to steal your identity.

In a recent article from the Arizona Republic, in some cases Phoenix Police censor critical personal data, such as your date of birth and Social Security number, and sometimes they don’t. Apparently, in a lot of incidents the DOB is necessary to narrow the search down to the exact person being looked for when additional investigations are conducted. The state of Arizona does have a law that protects residents’ private information, and the Phoenix City Manager says the city “began restricting public documents, at the request of city attorneys, to comply with an Arizona law designed to protect residents’ personal information.”

Other police departments confirm that date of birth is necessary to prevent mistaken identities, and this is supported by private individuals and companies who have to access these records for business purposes. What we have here is one of those situations that can give privacy advocates a bad case of heart burn. This, combined with an active terrorist movement, plus bad guys that seem to find new and better ways to rob us each day, provides a real dilemma. And it doesn’t appear that either side is willing to give in completely, nor should they.

If your state has a law protecting this sort of personal data collection, please share it with us all, and provide any information you might have on what your local law enforcement jurisdictions collect and make available to the public.

Somewhere in the future, either technology will give us the ability to solve the identification process without giving up the family private history. Or, Congress will eventually implement the Real ID Act. You remember this fiasco, the one that requires each state to come up with an ID card that is standard by federal guidelines. The Act was delayed in 2008 with an extension to December 31, 2009. I wouldn’t have bet on anything of this nature backed by the Bush administration, but perhaps Obama’s “heads” can figure out a way to ID each of us without potentially giving away the farm.

What I do know is that with each announcement of this type, we get closer and closer to the time when the data burglars won’t have to spend more than a few seconds to determine from where to steal your private information. The way things are going, it’s only a matter of time before the crooks compile their own “Directory of ID Theft Sources.” And with public apathy toward the identity crisis continuing at a steady pace, those sources will persist and become more valuable each day.

TARGET DEMANDS YOUR DATE OF BIRTH TO PURCHASE WINE

Just before this last Christmas, my wife was shopping in a Target store when she realized she needed a gift for an upcoming party. Since a good California wine is always acceptable, she headed for the liquor section, eventually finding what she wanted. At the checkout stand the clerk asked her for her driver’s license to confirm that she was over 21. My wife looks great and they did card her at restaurants up into her late 30’s, but the fact is she will be 65 this month and anyone with common sense would know she is over 21. Willing to show the ID, she quickly withdrew her license when the clerk indicated she was going to scan it into Target’s database. The purchase was, of course, cancelled.

We had already gone through this earlier with Safeway re. the cashing of a check. Even earlier it had been OfficeMax, who wanted to scan my wife’s driver’s license number to return an ink cartridge just because the purchase date was older than 30 days. Back in October of 2007, I did a post on Albertsons/OSCO when they sold our family’s personal data, including medication information, to the pharmaceutical industry. Their pharmacy, OSCO, also once asked me for my Social Security number for their database, which I refused as did my wife in the other incidents. But back to Target.

Since the store manager was clueless over why they had to scan the date of birth into their database saying over and over—“it’s just store policy”—my wife opted to buy the wine somewhere else, and, of course, it was my decision to tell this story to the President of Target by e-mail. I explained to him how complete the Arizona license is with identifiable info, including a picture, and that checking it should be sufficient. An afterthought, however, was that they might not trust the judgment of their clerks, but that is another complete story.

I had my answer within two hours from Joe, who wouldn’t give me his last name due to security purposes. They are worried about Joe, but not what might happen to my wife’s sensitive data once it is in their database. By the way, all that is necessary to commit identity theft is your name, address and date of birth, and I don’t have remind you how many companies had their customers’ private information raided in 2008. Some big names include: Hannaford Bros. (Eastern) Supermarket Chain, 4.2 million personal records; Countrywide Mortgage, 2 million; Starbucks 97,000. Target gets “A” for response time but “F” for policy.

Agreed, companies have to be careful who they sell booze to, but it borders on the ridiculous when the separation in the components in question—this case age—is 45 years. Rethinking my earlier statement of not trusting the clerk’s judgment, it is obvious they don’t even trust the store manager to make this decision, much less update them on the specifics of the policy.

In closing, Joe did tell me that Target only keeps the birth date after swiping the driver’s license, and that the company has a new policy under consideration in relation to this kind of incident. But added that he couldn’t guarantee quick action. Until that new policy is enacted, our family has decided to stop buying any alcoholic beverages at Target, and only other products there not available at other stores at comparable prices.

JUNK MAIL TRADE ASSN. DOWNSIZES

The Direct Marketing Association’s (DMA) mission is advocacy for responsible marketing, something they call “The Power of Direct.” The statement goes on to cover a number of benefits offered to its membership like research, education and networking opportunities to improve their junk mail. If they are really looking for improvement, the DMA should be the leader in finding out just how to get rid of the 98 percent which is junk mail and ends up in the trash.

By the way, the vast consumer population who make junk mail purchases—about 60 million households nationwide—does receive attention from the trade group, but not the kind the DMA’s more than 3,600 members get. It is a trade association paid by these some 3,600 junk mailers to keep the market free from regulation of an ultra secretive industry. So where are the advocates for these 60 million households that buy direct? We are out there, like The Dunning Letter, Privacy Rights Clearinghouse, Green Dimes, Junkbusters, and more. So why isn’t this enough?

Because Congress, the states and the media look to the DMA to tell them what, if anything, is wrong with junk mail. In my opinion the DMA has never really leveled with the public about the collecting and selling of consumer names and personal data. The DMA’s mail preference list is a joke since only its small membership is required to use it. There are thousands of junk mailers out there that aren’t members, including some major mailers.

A couple of years ago I challenged the DMA president to allow consumers in to the Chicago annual convention to ask list and data brokers just what they were doing with our names and private information. Not even the courtesy of an answer. In checking the DMA’s site, you will find a proliferation of figures including how junk mailers spent $173.2 million plying their trade in 2007, but you won’t find any mention anywhere of the $4 billion that is made annually by the list business from selling your sensitive data.

What this is all leading up to is the fact that the Direct Marketing Assn. has recently announced it will layoff from 18 to 21 workers. And you say…what difference does that make to me? From my 35 years experience in junk mail, it sounds like consumer protection, already inadequate, will suffer even more by the release of a key employee, James F. Conway, vice president and counsel for corporate and social responsibility. Conway was responsible for the DMA’s “Commitment to Consumer Choice (CCC)" program, an initiative requiring that members practice new, higher standards of corporate responsibility.

It would appear that junk mail customers will just have to sit back and take the hand they are dealt, that is until they are willing to stand up to this industry and federal regulators and say they’re tired of this treatment and won’t take it anymore.

JUNK MAIL IS ALL ABOUT…JUNK MAIL

What has always bothered me as a past direct marketing consultant and data broker is that junk mail doesn’t have to be…junk mail. There are ways to prevent at least a large portion of that 98 percent that goes in the trash to be eliminated before it happens.

One way is predictive modeling that identifies small geographical areas that are prone to making purchases through the mail. Another is an opt-in list of households that want mail, even screened further by the type wanted like apparel, food, electronics, etc. There is, of course, the do-not-mail list that could be enacted by the Federal Trade Commission, similar to the do-not-call registry that has been tremendously successful; which, by the way, did not put the telemarketing industry out of business as predicted. And now we have several states that are attempting to pass their own do-not-mail laws.

Newsweek did a recent article, “To Postal Workers, No Mail is ‘Junk,’” predicated on the fact that these workers are afraid any limitations on the sending of junk mail will cost them their jobs. Like telemarketing, I feel sure they will survive, although, perhaps, with a somewhat downsized postal system.

What is going on here is an event similar to the petroleum industry fighting alternative sources of energy, with all the subsets of businesses that would also be affected by a downturn. Junk mailings support a number of thriving suppliers that produce products and services needed to mail an advertising offer. Companies like paper mills, computer facilities, lettershops, and of course the list business, to name a few. They, as oil, telemarketing and the postal workers look only at their side of the dilemma.

How about the typical junk mail consumers numbering over 60 million households nationwide? It’s their name, their unique address, and their personal data that is being bantered about in the marketplace with little concern over its security. Don’t they have a right to say how that private information is used, and how much junk mail they want to receive? Of course they do.

With emphasis on profits—and list sales are a goldmine for junk mailers amounting to over $4 billion annually—the consumer rarely gets any consideration from the direct marketing industry or our congressional leaders. If “main street,” which seems to be one of the most popular buzz words in the current presidential campaign, doesn’t react in force and with organized efforts, it probably will never happen.

Most junk mailers refuse to spend the money for predictive modeling; some even still think it’s hocus pocus. The opt-in list was tried twice and failed, and the FTC isn’t likely to start a do-not-mail registry with the lobbying efforts of the Direct Marketing Assn. along with its junk mail membership, as are states not likely to get any similar meaningful legislation enacted. So what is the answer?

The public must demand control over its names and personal data that will allow it to decide what mail it wants to receive. At the same time, the junk mail customer should be paid when his or her name is sold to provide incentive to take on this new responsibility. In the long run this could increase the number of people using direct mail, and even satisfy most of the postal service employees.

FROM TACKY TO BAD TASTE

Some time ago, I responded to something sent to me by Jillian Coleman because I had a gut feeling about her offer. It is another of those get-rich messages that makes you feel that the only thing you have to do to become rich is to buy her program. Of course, I have been bombarded since then with e-mails that attempt to sell self-help programs—a term we used in the junk mail industry to indicate people looking for the “free lunch—with proposals for everything from real estate to having my own Internet cash machine. After 35 years as a junk mail data broker, methods like this that really work are few and far between. But that is not the point of this post.

On September 13, the day Hurricane Ike hit the Texas coast, Coleman was on the Internet contacting supposed suckers like me with a folksy lead-in of four paragraphs about how her family had suffered in the storm. This preceded her pitch in the next paragraph telling readers how she wanted to help her neighbors get low-cost government loans and grants. All you had to do was buy her self-help program for $597 including a HUGE discount of $300, apparently in honor of Ike. She listed her website not once, but three times.

Coleman did say early-on that “part” of every sale was going to organizations assisting in the Ike aftermath. She didn’t say how much or who. Now that is just what a hurricane victim needs, a pricey system to search for loans or grants when many of them couldn’t even find their house. She makes one last pitch before giving her website for the last time. But this is only the beginning.

On September 15, Coleman is back with more of the down-home approach—it works folks, believe me—with another diatribe about Texas’ “Third Coast” and its “miles of beaches and barrier islands, dunes, and sea grass that curve along the Gulf of Mexico.” The pitch starts in this e-mail saying she is donating money, but she wants to do more. And that can happen if you buy in to yet another offer headlined as an Internet cash machine. No, I don’t have the slightest idea what this has to do with hurricanes either. Billed as the “Hurricane Ike Sale for our Neighbors,” it sells for the discounted price of $1,497. There are four links to make your purchase.

There is yet one more pitch on September 17; you’ll note the separation of two days between each e-mail to let the victims, who probably don’t even have a computer left for Internet access, to absorb the gist of this amazing benevolent appeal. I decided to probe further, and came up with some interesting additional information on Coleman and her Austin, Texas company, Live Oak Tree, LLC.

Another of her offers was featured on the Ripoff Report: “Coleman & Associates; GrantMeRich.com.” Samuel of Plantation, Florida complains to the online consumer organization in this headline: “Coleman & Associates; Grant Me Rich.com Stay Away From Coleman & Associates Grantmerich.com Scam Artists! They Have Refused to Refund My Money 1 Year after I returned their USELESS product!!! Austin Texas.” Apparently Samuel purchased Coleman’s “Ike special,” New American Land Rush, and to say the least, he thought it was “useless” and wanted his money back.

Jillian Coleman may be the most legitimate company in Austin, TX, but at the very least, you have to admit this approach is very tacky and reeks of bad taste. There’s more, however, another follow-up on September 27, and a comparison of how these people come out of the woodwork, from Katrina to Ike. Next time.

On September 15, I did a review of Grant Hall's book, Privacy Crisis: Identity Theft Prevention Plan and Guide to Anonymous Living. This post is the second in a series of guest articles in which I feel readers will have interest. Grant's insight into financial institutions will open your eyes, and make you think before your next trip to the bank.


Bank of “Arrogance” and the Privacy Crisis
by Grant Hall

Whose money is it anyway?

Why do Americans have to jump through hoops and provide every conceivable piece of personal information known to computers to pseudo government agents, a.k.a. “bankers” in order to store their currency? Why is a prospective customer met with an “army” of resistance whenever telephone inquiries are made about the once simple procedure of opening a non-interest bearing checking account? And, why does it take three to five employees of a bank and thirty to sixty minutes to gain the information that was once accomplished through a three minute conversation with an entry level banking clerk?
Recent numbers of U.S. banks on the F.D.I.C. watch list increased to 117 in the second quarter of 2008 from 90 in the first quarter of 2008 (Ellis and Luhby, 2008) and in spite of the catastrophe looming, banks and bankers have not made efforts to boost customer satisfaction through better customer service in the opinion of this author and according to this author’s small-sample, empirical study conducted in August 2008.
The author spoke to twelve “bankers,” employed at various regional, money center and local banks and spent an average of thirty-seven minutes on each call during the month of August, 2008. An additional six banks were contacted that did not answer their telephones and these calls were routed to voice mail. Messages were not left for return calls by the author and this study is based on the twelve banks and “bankers” who were available for telephone calls during business hours in August, 2008.
Study results revealed that no first responders (clerks, tellers, assistant managers) could answer all questions asked by the author relating to opening a non-interest bearing checking account for a Trust of which the signer would be the Trustee. Note: Trust accounts are considered “personal” accounts by bankers according to the author’s experience.
Once supervisors or bank managers came to the telephone, the conversation continued with questions necessarily repeated from first responder contacts. Three of the twelve were able to answer all questions concerning the opening of the aforementioned “personal” bank account. A third telephone contact was necessary in six of the twelve telephone contacts. Three of the twelve contacts required a fourth or fifth person or advised having someone call the author back.
Based on the study results, it is clear that service has deteriorated to an unacceptable level at banks And, since banks neither know their business (requirements for opening a basic account) and do not offer acceptable customer service-based on this author’s study and his conclusions-an interpretation in part based on his opinion, why should anyone use them for storing their money?
All twelve banks mentioned said “no” when asked if they would cash a customer’s check if he/she did not have an account with the bank.
The conclusion is therefore drawn from this August, 2008 study that banks are not in the business of providing acceptable and good customer service. This is the opinion of this very experienced author and is based on this study and other studies. Further, employees who field questions by telephone (clerical, assistant mangers) –from numbers one to three who speak to prospective customers-do not know requirements for a basic “trust” checking account. This conclusion and the fact that bankers-executive and management do not know the source of their funds and cannot define the Federal Reserve Bank (Hall, 2006) may cause many customers to hesitate about opening a bank account for personal use.
As the author has explained in Privacy Crisis, there are other options besides commercial banks for storing cash.
Check cashing stores combined with the use of an anonymous safe deposit box will enable the privacy advocate to keep money anonymous-without the probems associated with banks and bankers. A useful resource for an anonymous safe deposit box is 24-7 Private Vaults and their web site is www.24-7PrivateVaults.com

References
Ellis, David and Luhby, Tami, 2008, Problem Bank List Keeps Growing, www.CNNMoney.com
Hall, Grant, Privacy Crisis: Identity Theft Prevention Plan and Guide to Anonymous Living, eBook, available at: www.PrivacyCrisis.com 2006, James Clark King, LLC
Copyright: James Clark King, LLC, September 8, 2008

DECLARATIONS FOR PRIVACY

I ran into a couple of things recently that deserve mention for readers with an urgent interest in protecting their privacy. The first is Grant Hall’s E-book, Privacy Crisis: Identity Theft Prevention Plan and Guide to Anonymous Living, 390 pages packed with a concept so different than most of today’s privacy advocates that it demands recognition. He asks the basic question of why we should have to give up all of our sensitive data just to survive at the existence level in the present-day financial world. That’s true! In order to conduct any business that requires a payment for merchandise or services, if you don’t have the cash in hand, you must reveal the family history to obtain credit. But Grant says there is a way to solve this problem by using cash, and he shows you how this can be done. I suggest you go to the link above and check out Privacy Crisis to see if this approach is for you. And look for an article soon by Grant Hall on this blog: Bank of “Arrogance” and the Privacy Crisis.

The second is a recent post, The Ultimate Guide to Internet Privacy Law: 100 Must-Read Resources, rich with information broken down into guides and articles designed to protect your online privacy. They are the latest privacy scams and security breaches from the news and blogs, authoritative information on online privacy law from academic and research sources, privacy rights organizations, government resources, and some great information for kids and teens. They were even kind enough to include The Dunning Letter in this group. I know about many of these sites, and can see that the collection was put together with some thought. Check out their site, and you can even leave comments if you have ideas on this subject.

We will probably never have enough available advice for protecting our privacy, since the trend in identity breaches just keeps on rising each year, and shows no real signs of receding. So my advice is to make the best of whatever you can find that is legitimate and authoritative.

Today marks the first of the guest articles from contributors whose specialties are in keeping with the philosophy of The Dunning Letter. Sergei Limberg has a history of advocating for consumers, as the following article illustrates.

Driving in Circles: Lemon Law and Extended Warranties

By Sergei Lemberg


For a long time now, Jack has done an enormous public service in the realm of consumer privacy and identity theft. Over at LemonJustice.com, my colleagues and I are working for consumers in a slightly different arena: lemon law.

All too often, consumers are victimized by car manufacturers when the automaker can’t or won’t fix a serious defect in a new car. We’re not talking about annoying problems like speakers that aren’t installed properly, but rather defects that make the vehicle unreliable or unsafe. Every state has what’s called a lemon law, meant to protect new car buyers from just these kinds of defects. Unfortunately, though, most people don’t understand their lemon law rights, or know how to go about preserving them.

Because each state’s lemon law is different, it’s easy for people to become confused. Generally speaking, though, most states cover new passenger vehicles that are intended for personal use. Typically, lemon laws dictate that, in order to be considered a “lemon,” a vehicle must have serious defects that occur within a certain time frame, such as during the first year or the first 12,000 miles – whichever comes first. There’s also a requirement that the vehicle has been taken in for a certain number of repairs (such as four times for the same problem) or has been out of service for a certain length of time (such as a cumulative total of 30 days). Often, there’s a requirement that the manufacturer has to be notified via certified mail and given one last opportunity to make the repairs. If the automaker can’t fix the problem, they’re required to give the consumer a refund or replacement vehicle.

This is the point where consumers need to make a lot of noise. Understandably, manufacturers don’t want to acknowledge that they have a lemon, and have legal teams that are dedicated to fighting lemon law claims. Often, they make people jump through hoops until the time limit for getting compensation expires, then walk away with smiles on their faces. If you think you have a lemon, you should contact a lemon law attorney after the second or third repair attempt. He or she can help guide you through the final steps that will legally establish your vehicle as a lemon. Because most lemon laws say that the manufacturer has to pay your attorney’s fees in a successful claim, representation shouldn’t cost you a dime.

But that’s only one of the ways that people are victimized in relation to their vehicles. The other is through extended warranty scams. The New York Times recently ran a great article on extended warranties, which basically said that about two-thirds of people end up paying more for the warranty than they save in costs associated with repairing their cars. It also pointed out that it’s best to avoid third-party extended warranties, as you’ll be out of luck if the company you purchase from goes out of business.

This issue of third-party warranties intersects with privacy issues, since extended car warranty companies buy lists of names and snooker them into buying meaningless warranties. Chances are, you’ve received pre-recorded calls, letters, or emails warning you that the warranty on your vehicle is about to run out and that you need to “act now” to protect yourself. Usually, the company bought your name from a list broker and is betting on your naivete to scam you into buying something you don’t need.

From a lemon law perspective, even legitimate extended warranties aren’t so great. They’re simply service contracts, so a manufacturer’s repeated failure to fix a problem is hardly ever actionable.

Sergei Lemberg, Esq., focuses his practice on Lemon Law, Consumer Fraud, Auto Warranty and Auto Injury litigation. He is licensed to practice in New York, Massachusetts, and Connecticut. He can be reached at: 1-877-77-LEMON (1-877-775-3666)or e-mail contact06@lemonjustice.com

THE BASIC CASE REHASHED AGAINST JUNK MAILERS WHO SELL YOUR SENSITIVE DATA

Today is my day to jump on the soapbox, and bombard readers with another warning about how your name and sensitive data are collected in an industry where profits rank far above security. Even though it has been said countless times, it deserves another outing, particularly with identity theft still soaring.

If there is one thing that should be remembered by junk mail shoppers, it is that when you order a product or service from a junk mailer, or request information from a non-junk mail company, your name and private information is the real prize in the transaction. Unbeknownst to many consumers, that sensitive data is rushed at lightening speed to a computer facility where it is prepared to be sold, often within 24 hours. Sure, they will deliver your product, or service, or requested information, but that is almost an afterthought to many companies that survive from the marketing of your names and personal data.

And that is not the purpose for which you gave them your name, address, telephone number, credit card account, etc. You gave it to them to deliver what you asked for, not sell it to 50 other junk mailers that, if you should order something from them, will sell it to another 50 companies, and on and on. I also mention non-junk mailers because they are quickly catching up with the traditional list business in collecting names and private information, also putting it up for sale. The most glaring example of this is pharmaceutical companies who buy your prescription data from your local pharmacy.

And the process does not end with the information you provide the junk mailer. Not satisfied, they go to major data brokers like ChoicePoint, Acxiom, Experian, Equifax and TransUnion to enhance the information they already have on you. Things like your age and income, home value, credit cards you carry, children’s names, where you work, what you drink and read, and whether or not you gamble. The last I checked, there were a minimum of 250 known demographic and lifestyle characteristics that could be added to your name and address.

There are now around 60,000 lists on the market that gross over $4 billion each year by the junk mail list industry. Most of these lists are not regulated by the Direct Marketing Assn. (DMA), so they are free to do what they please with your name and personal data. Most are honest, but it is the group of renegades that will sell your private information to unethical and dishonest companies that ply us with fraudulent offers, then vanish into the night.

Selling mailing lists has created a life of its own, and with the way new technology is evolving, every day there are new ways to suck up every morsel of private information available on each of us. Although I cannot confirm this, I bet that there is a new database filled with consumer sensitive data born every hour. Maybe even more often. Question if you will, but we have entered the age of Orwell’s Big Brother.

REAL ID ACT GOES DOWN IN FLAMES IN ARIZONA

I am proud of my state for passing a law (AZ House Bill 2677) that basically prevents the enactment of the Real ID Act in Arizona. I am equally proud of Governor Janet Napolitano, a Democrat, for signing it into law on Tuesday, June 17. In case you have forgotten, the Real ID Act mandates a universal driver’s license issued by each state, with personal data on each individual citizen to be compiled in a national database of sorts.

This massive amount of private information on individuals will be controlled by the Dept. of Homeland Security (DHS) and the agency has already said it might add to the state-supplied driver’s license data. I remind you that the government is responsible for 20 percent of all data breaches.

In the beginning, DHS said that non-compliance would prevent state’s residents from participating in some federal programs, most importantly, not being able to board airline flights through the federally operated Transportation Security Administration (TSA). But in January DHS Secretary Chertoff said that other forms of identification will be acceptable to fly. DHS had originally granted an extension for compliance to all states until December 31, 2009, and then, again in January 2008, further extended it until 2014, 2017 for those over age 50. More info from DHS here, and a detailed explanation from Wikipedia here.

Homeland Security says this is not a national ID card, but what else can you call it? With a shared pool of information containing the most sensitive of personal consumer data available to all the states plus the federal government, and one similar ID card carried by every citizen in the U.S. as their identification, I’ll let you decide what we call it. Anyway you label this planned monstrosity, in the end it will still result in a new, ready-made source for identity thieves.

Aside from invading the privacy of every American citizen, the cost that would be borne by states is prohibitive. In a joint report from the National Governors Association, National Conference of State Legislatures, and American Association of Motor Vehicle Administrators, the cost nationwide would be more than $11 billion. When DHS handed down the final regulations on compliance in January of this year, several observers indicated the delayed deadline would do little to ease funding concerns, according to GovTech.com. The delay is thought to reduce that $11 billion to about $4 billion, however.

Jeremy Meadows, senior committee director for the National Conference of State Legislatures confirms that, “despite the concessions, DHS didn’t heed a number of other requests from states. Funding and privacy concerns appear to have gone ignored.”

Homeland security hasn’t yet made a final decision on just how the central collection of personal data will be organized, as well as how it will be shared. At this point it is very confusing re. what the level of intrusion into individual privacy will be. What we do know is that if the Real ID Act does take effect, that alone will be an invasion of our privacy. See more FAQs on Real ID here.

CYBERSPACE PROVEN UNSAFE FOR SOME BY INTERNET CRIME COMPLAINT CENTER

It’s always been going on, but the Internet is “fast becoming the new nexus for fraud, scams, and identity theft—and the losses appear to be mounting.” This is a quote from the April 4, 2008 Internet Crime Complaint Center (IT3), as reported in ConsumerAffairs.com. IC3 is a partnership between the FBI and the National White Collar Crime Center. The report claims that American consumers lost $239 million during 2007 in Internet-based fraud schemes, up from $198 million in 2006.

Investment and retirement scams were highest with a median loss of $3,547 per complaint; check fraud at $3,000 per; and the historic Nigerian scam at $1,922. California leads in fraud perpetrators, followed by Florida and New York; 75 percent of the perps are male. And you will likely be contacted by e-mail by the scammer, followed by Web site visitation, then telephone or instant-messaging chats.

The Nigerian, or 419, scam dates back to the 1980s when the oil-based Nigerian economy declined, and unemployed college students started hustling first businessmen in the west, then spread out to consumers in general. They started with letters, faxes, or Telex, then graduated to e-mail as the preferred way of contact. The number “419” refers to the article of the Nigerian Criminal Code dealing with fraud, according to Wikipedia. The lesson here is the simplicity it takes to create a full-blown, worldwide scam, dreamed up by students with nothing to do, resulting in losses to victims in the millions.

The bad guys are using the same means of contact that are used in the junk mail industry to sell their products and services, thus, a familiarity by the recipient if they also shop by junk mail. I don’t know what customer profile selection the Nigerian used in acquiring 163,000 names from ChoicePoint in February of 2005—the beginning of the ID theft debacle—but as a former data broker, my guess is “opportunity seekers,” called a “mooch” list. So named because of the gullibility of the people on the list who are known for responding to offers that are in fact too good to be true.

The FBI, supported by outside security analysts, says the reported crimes received by IC3 is only a fraction of what is really occurring. This is a result of both business and consumers not reporting incidents for a number of reasons, including the time necessary to do so. Still, the FTC has determined that consumer fraud in 2007 totaled $1.2 billion, averaging $349 per individual.

Chris Hoofnagle, senior staff attorney to the Samuelson Law, Technology & Public Policy Clinic and senior fellow with the Berkeley Center for Law & Technology, a known privacy expert, has found in an initial study that “many of the world's largest corporations' customer records were the most frequently pilfered for identity theft and related fraud.” But he adds that this is only a first attempt and that further research is necessary.

This is a point I have been making for three years of blogging, based on 35 years in the junk mail industry observing the negligent handling of consumers’ names and personal data. When you combine this carelessness in the business community, including health care and the government, with the explosion of Internet technology and growing sophistication of the identity thieves, you have a potential disaster in the making.