So I Gave Utility Company Access to a Frozen Creddit to Open an Account Do I Need to Freeze It Again
I spent a few days final week speaking at and attending a briefing on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in U.s.. 1 gripe I heard from several presenters was that identity thieves increasingly are finding means to open new mobile telephone accounts in the names of people who accept already frozen their credit files with the large-3 credit bureaus. Here's a look at what may be going on, and how you tin can protect yourself.
Carrie Kerskie is director of the Identity Fraud Found at Hodges University in Naples. A big function of her chore is helping local residents reply to identity theft and fraud complaints. Kerskie said she's had multiple victims in her expanse recently complain of having cell phone accounts opened in their names fifty-fifty though they had already frozen their credit files at the big three credit bureaus — Equifax, Experian and Trans Wedlock (besides as distant quaternary bureau Innovis).
The freeze process is designed so that a creditor should not be able to see your credit file unless you lot unfreeze the business relationship. A credit freeze blocks potential creditors from being able to view or "pull" your credit file, making it far more difficult for identity thieves to apply for new lines of credit in your name.
But Kerskie's investigation revealed that the mobile telephone merchants weren't request whatever of the four credit bureaus mentioned in a higher place. Rather, the mobile providers were making credit queries with the National Consumer Telecommunications and Utilities Exchange (NCTUE), or nctue.com.
Source: nctue.com
"Nosotros're finding that a lot of phone carriers — even some of the larger ones — are relying on NCTUE for credit checks," Kerskie said. "It's mainly telephone carriers, but utilities, ability, water, cable, whatsoever of those, they're all starting to use this more than."
The NCTUE is a consumer reporting agency founded pastAT&T in 1997 that maintains data such as payment and business relationship history, reported by telecommunications, pay TV and utility service providers that are members of NCTUE.
Who are the NCTUE'southward members? If yous call the 800-number that NCTUE makes available to get a free copy of your NCTUE credit report, the option for "more information" virtually the organization says in that location are four "exchanges" that feed into the NCTUE's organization: the NCTUE itself; something chosen "Centralized Credit Check Systems"; the New York Data Exchange; and the California Utility Exchange.
Co-ordinate to a partner solutions folio at Verizon, the New York Data Exchange is a not-for-profit entity created in 1996 that provides participating substitution carriers with access to local telecommunications service arrears (accounts that are unpaid) and terminal account data on residential terminate user accounts.
The NYDE is operated by Equifax Credit Information Services Inc.(yes, that Equifax). Verizon is one of many telecom providers that use the NYDE (and retrieve that AT&T was the founder of NCTUE).
The California Utility Exchange collects customer payment information from dozens of local utilities in the state, and also is operated by Equifax (Equifax Information Services LLC).
Google has well-nigh no useful data available about an entity called Centralized Credit Check Systems. It's possible it no longer exists. If anyone finds differently, please go out a note in the comments section.
When I did some more than digging on the NCTUE, I discovered…wait for information technology…Equifax also is the sole contractor that manages the NCTUE database. The entity's site is too hosted out of Equifax's servers. Equifax's current contract to provide this service expires in 2020, according to a press release posted in 2022 past Equifax.
Cerise Light. Light-green LIGHT. Ruby Low-cal.
Fortunately, the NCTUE makes it fairly easy to obtain any records they may have on Americans. Only phone them up (1-866-349-5185) and provide your Social Security number and the numeric portion of your registered street accost.
Assuming the automated organisation can verify you with that information, the system so orders an NCTUE credit report to be sent to the accost on file. You tin as well asking to be sent a free "hazard score" assigned by the NCTUE for each credit file information technology maintains.
The NCTUE likewise offers an online process for freezing one'due south study. Maybe unsurprisingly, nonetheless, the process for ordering a freeze through the NCTUE appears to be completely borked at the moment, thanks no dubiety to Equifax's well documented abysmal security practices.
Alternatively, information technology could all exist office of a willful or negligent strategy to continue discouraging Americans from freezing their credit files (experts say the bureaus brand most $1 for each time they sell your file to a potential creditor).
On April 29, I had an occasion to visit Equifax'southward credit freeze application page, and found that the site was being served with an expired SSL certificate from Symantec (i.e., the site would not allow me browse using https://). This happened because I went to the site using Google Chrome, and Google announced a decision in September 2022 to no longer trust SSL certs issued by Symantec prior to June 1, 2016.
Google said it would do this starting with Google Chrome version 66. It did not keep this plan a underground. On April 18, Google pushed out Chrome 66. Despite all of the advance warnings, the security people at Equifax plainly missed the memo and in so doing probably scared most people away from its freeze page for several weeks (Equifax stock-still the problem on its site former afterward I tweeted about the expired certificate on Apr 29).
That's considering when i uses Chrome to visit a site whose encryption certificate is validated past one of these unsupported Symantec certs, Chrome puts up a dire security warning that would almost certainly discourage most casual users from continuing.
The insecurity around Equifax'south own freeze site probable discouraged people from requesting a freeze on their credit files.
On May 7, when I visited the NCTUE'south page for freezing my credit file with them I was presented with the very same connexion SSL security warning from Chrome, warning of an invalid Symantec certificate and that whatever data I shared with the NCTUE'southward freeze page would non be encrypted in transit.
The security alert generated by Chrome when visiting the freeze page for the NCTUE, whose database (and apparently web site) also is run by Equifax.
When I clicked through past the warnings and proceeded to the insecure NCTUE freeze form (which is worded and stylized nearlyexactly like Equifax's credit freeze page), I filled out the required information to freeze my NCTUE file. See if you can gauge what happened side by side.
Yep, I was unceremoniously declined the opportunity to practise that. "We are currently unable to service your request," read the resulting Web page, without suggesting alternative means of obtaining its study. "Please effort again later."
The message I received later trying to freeze my file with the NCTUE.
This scenario will no dubiousness be familiar to many readers who tried (and failed in a like fashion) to file freezes on their credit files with Equifax after the visitor divulged that hackers had relieved it of Social Security numbers, addresses, dates of birth and other sensitive information on virtually 150 1000000 Americans last September. I attempted to file a freeze via the NCTUE's site with no fewer than three unlike browsers, and each time the form reset itself upon submission or took me to a failure folio.
And so let'southward review. Many people who have succeeded in freezing their credit files with Equifax have yet had their identities stolen and new accounts opened in their names cheers to a lesser-known credit bureau that seems to rely entirely on credit checking entities operated by Equifax.
"This just reinforces the fact that nosotros are no longer in control of our information," said Kerskie, who is also a founding member of Griffon Forcefulness, a Florida-based identity theft restoration business firm.
I observe it hard to disagree with Kerskie's argument. What chaps me well-nigh this discovery is that countless Americans are in many cases plunking downwards $3-$10 per bureau to freeze their credit files, and yet a huge player in this marketplace is able to go on to profit off of identity theft on those same Americans.
EQUIFAX RESPONDS
I asked Equifax why the very aforementioned credit bureau operating the NCTUE's data exchange (and those of at least 2 other contributing members) couldn't detect when consumers had placed credit freezes with Equifax. Put simply, Equifax'south wall of legal verbiage below says mainly that NCTUE is a carve up entity from Equifax, and that NCTUE doesn't include Equifax credit information.
Hither is Equifax's full statement on the matter:
· The National Consumer Telecom and Utilities Exchange, Inc. (NCTUE) is a nationwide, fellow member-endemic and operated, FCRA-compliant consumer reporting agency that houses both positive and negative consumer payment data reported by its members, such as new connect requests, payment history, and historical account status and/or fraudulent accounts. NCTUE members are providers of telecommunications and pay/satellite boob tube services to consumers, as well as utilities providing gas, electric and water services to consumers.
· This information is available to NCTUE members and, on a express footing, to certain other customers of NCTUE'south contracted exchange operator, Equifax Information Services, LLC (Equifax) – typically financial institutions and insurance providers. NCTUE does not include Equifax credit information, and Equifax is not a member of NCTUE, nor does Equifax own whatsoever aspect of NCTUE. NCTUE does not provide telecommunications pay/ satellite boob tube or utility services to consumers, and consumers do not apply for those services with NCTUE.
· Every bit a consumer reporting bureau, NCTUE places and lifts security freezes on consumer files in accordance with the state law applicable to the consumer. NCTUE besides maintains a voluntary security freeze program for consumers who live in states which currently practise non have a security freeze police force.
· NCTUE is a split consumer reporting agency from Equifax and therefore a consumer would need to independently place and lift a freeze with NCTUE.
· While land laws vary in the manner in which consumers tin can place or lift a security freeze (temporarily or permanently), if a consumer has a security freeze on his or her NCTUE file and has non temporarily lifted the freeze, a creditor or other service provider, such as a mobile phone provider, generally cannot admission that consumer's NCTUE report in connection with a new account opening. However, the creditor or provider may be able to admission that consumer'due south credit study from some other consumer reporting agency in order to open up a new account, or decide to open the account without accessing a credit study from any consumer reporting bureau, such as NCTUE or Equifax.
PLACING THE FREEZE
I was able to successfully place a freeze on my NCTUE report by calling their 800-number — ane-866-349-5355. The message said the NCTUE might charge a fee for placing or lifting the freeze, in accord with state freeze laws.
Depending on your country of residence, the price of placing a freeze on your credit file at Equifax, Experian or Trans Wedlock tin can run between $3 and $10 per credit bureau, and in many states the bureaus too can charge fees for temporarily "thawing" and removing a freeze (according to a list published by Consumers Marriage, residents of four states — Indiana, Maine, North Carolina, S Carolina — do not demand to pay to place, thaw or lift a freeze).
While my dwelling house land of Virginia allows the bureaus to charge $ten to identify a freeze, for whatever reason the NCTUE did not assess that fee when I placed my freeze request with them. When and if your freeze request does go approved using the NCTUE's automatic telephone arrangement, brand sure you lot have pen and newspaper or a keyboard handy to jot down the freeze PIN, which you will need in the result you ever wish to lift the freeze. When the system read my freeze Pivot, information technology was read so quickly that I had to hit "*" on the dial pad several times to repeat the message.
Information technology'southward bluntly absurd that consumers should e'er have to pay to freeze their credit files at all, and however a recent written report indicates that near 20 percent of Americans chose to do so at one or more than of the three major credit bureaus since Equifax announced its breach last fall. The total estimated price to consumers in freeze fees? $1.4 billion.
A bill in the U.South. Senate that looks likely to laissez passer this twelvemonth would require credit-reporting firms to let consumers place a freeze without paying. The free freeze component of the bill is just a tiny provision in a much larger banking reform bill — South. 2155 — that consumer groups say will ringlet dorsum some of the consumer and marketplace protections put in place after the Great Recession of the last decade.
"It's part of a big banking bill that has provisions we hate," said Chi Chi Wu, a staff attorney with the National Consumer Constabulary Center. "It has some provisions not having to do with credit reporting, such every bit rolling dorsum homeowners disclosure act provisions, changing protections in [electric current law] having to do with systemic risk."
Sen. Jack Reed (D-RI) has offered a bill (Due south. 2362) that would invert the current credit reporting system by making all consumer credit files frozen by default, forcing consumers to unfreeze their files whenever they wish to obtain new credit. Meanwhile, several other bills would impose slightly less dramatic changes to the consumer credit reporting industry.
Wu said that while South. 2155 appears steaming toward passage, she doubts any of the other freeze-related bills will go anywhere.
"None of these bills that practise something actually strong are moving very far," she said.
I should notation that NCTUE does offer freeze alternatives. Just similar with the large 4, NCTUE lets consumers identify a somewhat less restrictive "fraud alarm" on their file indicating that verbal permission should be obtained over the telephone from a consumer earlier a new account can be opened in their name.
Here is a primer on freezing your credit file with the large three bureaus, including Innovis. This tutorial besides includes advice on placing a security alert at ChexSystems, which is used by thousands of banks to verify customers that are requesting new checking and savings accounts. In addition, consumers can opt out of pre-approved credit offers by calling 1-888-five-OPT-OUT (1-888-567-8688), or visit optoutprescreen.com.
Oh, and if you don't want Equifax sharing your bacon history over the life of your unabridged career, y'all might want to opt out of that programme as well.
Equifax and its ilk may ane twenty-four hours finally be exposed for the digital dinosaurs that they are. But until that day, if you care about your identity yous at present may have another freeze to worry about. And if you lot make up one's mind to take the step of freezing your file at the NCTUE, delight sound off about your experience in the comments below.
Source: https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/
0 Response to "So I Gave Utility Company Access to a Frozen Creddit to Open an Account Do I Need to Freeze It Again"
إرسال تعليق