In my last post, where I discussed the (likely) theft of my SSN from the State of Ohio, I briefly discussed the possibility of “freezing” my credit report. I’ve done some more investigation on how, exactly, this works.
Details seem to vary from state to state (Consumer’s Union has a nice summary), but you generally can write to each of the three major credit report bureaus, via postal mail, and request that your account be “frozen.” This will not prevent you from getting “pre-approved” credit-card offers. For that, you separately opt-out, although you can at least do it online. Once your request takes effect, most requests to access your credit report will be denied. There are a wide variety of exceptions, mostly related to people who you’re already doing business with, which strikes me as entirely reasonable.
Cost? If you’re the victim of identity fraud (and it’s unclear whether I meet that definition), it’s free. You include a copy of your police report when you’re writing your letters to each of the credit ratings bureaus. If not, the cost is $10 per bureau. Multiply by three, and that’s $30. You’re married and want to do it for your spouse? Add another $30. What if you want to temporarily (or permanently) lift the block? The price varies, but it’s comparable.
Here’s the problem with this system: let’s say you’re doing the sort of things for which people legitimately want to look up your credit report (e.g., borrowing money for a car, opening a new credit card, renting a new apartment, etc.). Particularly if you’re changing jobs, moving to a new area, and so forth, you’ll be doing a lot of this all at once. As a result, precisely when you’re most often giving out your SSN and thus increasing your vulnerability, you also have to disable the block on your account, exposing yourself to the risk of identity theft.
The proper answer, of course, is to arrange for SSNs to have no more value to an identity thief than your name and address. The unanswered question, then, is what exactly can replace it as an authenticator? One possibility, raised in the thread on car dealers who insist on fingerprints, is to require these sorts of transactions be notarized. A notary public‘s main function is to authenticate that a specific person signed a specific document. You already need a notary’s services when you buy or sell a house. Why not require their services for any transaction that involves a personal credit report? The answer, I imagine, is cost, both in time and money. Department stores would be unable to give you “instant credit cards.” Applying to rent an apartment would become more complicated and annoying. There would be more friction, all around, to get credit. However, if identity theft continues to be such a significant problem, maybe it’s a trade-off worth making.
(Aside: how, exactly, do you convince the notary of your identity? The answer varies, but it seems to involve a photo ID, signature, and in some cases a thumbprint. You could certainly imagine cutting the notary out of the process and pushing the same authentication process out to a cash register or wherever else, but this creates a trusted path problem. When a human notary is authenticating a paper document, there’s no question to anybody what, exactly, is being authenticated. If you give your biometric and ID card to a scanner in a store, you have no idea where that data is going and what, ultimately, is being authenticated on your behalf. Astute readers may see a connection between this and the need for election systems to have voter-verifiable paper trails, but that’s a discussion for another day.)
Leave a Reply