+ Be written in plain language; + Include the name and contact information of the agency breached; + Provide a list of the personal information reasonably believed to have been subject to the breach; + Spell out the date of the breach, the estimated date of the breach or the date range within which the breach occurred; + Specify whether the notification was delayed as a result of a law enforcement investigation; + Offer a general description of the breach incident; + Provide toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a Social Security number or a driver's license or California identification card number; + Include information about what the organization has done to protect individuals whose information was breached; + Outline steps individuals may take to protect himself or herself.

For the roughly 185 million U.S. consumers with debit cards, the recent security breach at arts-and-crafts retailer Michaels Stores offers yet another cause for concern. The reports allege that the thieves did more than simply steal debit-card information from stores in 20 states they used it to take money from customers' bank accounts. This isn't the first time debit-card information has been stolen, but these kinds of crimes are becoming more common and more serious. The Michaels thefts follow a similar case last summer at Aldi Inc. grocery stores that reportedly led to customer reports of debit-card fraud. Year-to-date, debit and credit cards make up 20% of all consumer data breaches, up from 11% during the same period last year, according to the Identity Theft Resource Center. Debit-card fraud losses incurred by banks hit a record $788 million in 2008, according to the latest estimates from the American Bankers Association, due mostly to stolen and counterfeit debit cards. "This is going to get worse you're going to see more bad guys out there looking for debit card information," says Jay Foley, executive director at the ITRC.

Experian has announced it will be reporting "positive" rental data from its RentBureau® division into the traditional credit files. Experian states this will help the 50 million underbanked consumers, such as college students and recent immigrants, to build credit with on-time rental payments. Query what happens when someone falls behind in their rent. Will that be a ding on their credit?

In the past, the FTC only required consumer credit reporting companies (Experian, Equifax and TransUnion) to handle credit report disputes (they would in turn communicate with the furnisher directly).

This is a substantial change, at least on paper, to one of the biggest areas of consumer credit problems and identity theft. How it will work in practice, and whether it will improve things for consumers, remains to be seen.

From FTC.gov:

Furnisher Rules: These rules call on companies that furnish information to consumer reporting agencies to improve the accuracy of information they provide. They also give consumers the right to dispute errors in their credit reports directly with the furnishers of the information, in addition to disputing errors with consumer reporting agencies. The rules take effect July 1, 2010.

Identity fraud still grew by 12% in 2009, although less quickly than in 2008 (22%). However, cases are also getting reported and resolved more quickly.  Javelin reports 11.1 million U.S. adults were victims in 2009 and the total fraud amount increased by 12.5 % to $54 billion. Average fraud resolution time dropped 30% to 21 hours, and nearly half of the victims file police reports, resulting in double the reported arrests, triple the prosecutions, and double the percentage of convictions in 2009.

Note that Javelin differentiates between identity theft (the loss of data) and fraud (the misuse of the data), which is the optimal way to look at thing.

Read more at Bank Info Security.

Computerword is reporting

Security researchers at a company called NetWitness Corp. have unearthed a massive botnet affecting at least 75,000 computers at 2,500 companies and government agencies worldwide.

The Kneber botnet, named for the username linking the affected machines worldwide, has been used to gather login credentials to online financial systems, social networking sites and e-mail systems for the past 18 months, according to NetWitness.

A 75GB cache of stolen data discovered by NetWitness included 68,000 corporate login credentials, login data for user accounts at Facebook, Yahoo and Hotmail, 2,000 SSL certificate files and a large amount of highly detailed "dossier-level" identity information. In addition, systems compromised by the botnet also give attackers remote access inside the compromised network, the company said.

"Disturbingly, the data was only a one-month snapshot of data from a campaign that has been in operation for more than a year," NetWitness said in a statement announcing the discovery of the botnet late yesterday

My reading of this is that these breaches are much bigger and worse than they've even discovered so far. And this is the new normal we can expect for some time. Huge amounts of attacks and breaches going after corporate and government secrets originating from criminal gangs or governments.

More from the Wall Street Journal.

The IRS has released Notice 2009-93, announcing a pilot program allowing filers of information returns to truncate an individual payee’s identifying number on paper statements for calendar years 2009 and 2010. An individual identifying number is a social security number, individual taxpayer identification number or adoption taxpayer identification number. The provision applies only to information returns in the 1098, 1099, and 5498 series. It does not apply to employer identification numbers (EINs) in the format xx-xxxxxxx. The notice also requests public comments by May 1, 2010.

Under this optional program, payers may replace the first five digits of identifying numbers with asterisks or the letter x. For example, a social security number could appear as xxx-xx-1234. This will enable better protection of personal identifying information for the recipients.

To see the requirements for participating in this pilot program, see Notice 2009-93. The notice also contains instructions on making public comments.

Of course, all this won't solve the problem that full SSNs are often a deterministic number, within a range, if one knows the last four digits.

The thief just needs to reach into your mailbox (if you have a "rural mailbox" that is standalone) and grab one statement. Now they have your name, address and account number. The real trick comes next: they turn your statement over, fill in the change of address form on the back and mail it in! There is NO authentication by the credit card compainies for this change of address and telephone. Any idiot can do it and it has zero security. If the thief tried to call to change your address, they'd have to enter your SSN, possibly mother's maiden name, and a PIN/password (if you have one and you should). That's too many hoops for the typical thief to jump through. But using the change of address form on your paper statement is as easy as it gets. I don't know of a single credit card company that notifies you when you change your address using that form (if you do, please let us know in the comments). Frankly, it should be a best practice to notify the cardholder before changing the addres, or at least sending a postcard to the OLD address after changing it.

So, the takeaway is this: go to paperless statements (or get a locking mailbox). I know many of you use the paper statement to remind you to pay your bills. I empathize with that need. But nearly every card issuer has an online service that will 1) send you an email notifying you that your statement is available, and 2) notify you several days before the payment is due (if you haven't paid yet).

I know this first hand because it has happened to me and it is no fun trying to unwind the mess.

Truston was profiled, for the second year in a row, in the Javelin Strategy & Research research report on identity theft service providers, entitled "2009 Consumer Identity Protection Services Scorecard". The report has an analysis of the top identity theft protection services and is based in Javelin's well-respected consumer ID theft survey.

Other companies featured include Equifax, Experian, TransUnion, Affinion, and Identity Guard (Intersections, Inc.)

Read more in the press release. ]]> http://www.mytruston.com/blog/truston/truston_profiled_in_id_theft_service_pro.html http://www.mytruston.com/blog/truston/truston_profiled_in_id_theft_service_pro.html Truston identity theft idtheft javelin report research Sat, 20 Jun 2009 11:10:05 -0800