Social security numbers may be too easy to guess, especially for seniors

Brian Krebs has a story in The Washington Post, July 6, “Researchers: Social Security Numbers Can Be Guessed”, with link here.

The social security numbering system was never intended to be used for authentication, and older people may find that social security numbers are derived from other demographic data, or may have been given in sequence to family members. Identity thieves could make up algorithms to keep trying and guess the numbers.

The Social Security Administration has long cautioned private companies against using social security numbers as a prime identifier. Banks and financial institutions used to use them, but have tended to shift toward randomly generated user ids as well as passwords.

AOL also has a major story on "guessing social security numbers" with URL here. The article refers to a Carnegie Mellon report, which breaks down how the social security number has often been parsed. The first three digits of a Social Security number were called the area number and correlated to ZIP code. The middle two numbers were called the group number and were assigned within a "region", often consistently for years. Lists of assigned area and group numbers are available through Web sites associated with the Social Security Administration, the report said. In 1988, the government mounted an effort to assign social security numbers right after birth. The number system is rather like that of a library that changes its catalogue locations a few times over a long period.

Carnegie Mellon has a "SSN watch" website here.

Insurance Scores: less well known than FICO: learn about them!

Besides your credit score (such as FICO), another “measure” that can affect “your” life could be your Insurance Score, when you go to purchase homeowner’s or auto insurance. It’s not clear that it makes as much difference with renter’s insurance. I’m not sure if it is used for mortgage or title insurance, but it could make sense to use it.

Insurance companies use proprietary “top secret” formulas for the scores, and there seems to be less information about the score and less direct ways to address it than there are for FICO scores. One major purpose of assessing people with the Insurance Score as part of the application process is to assess a premium relative to risk, and to prevent anti-selection, both of which insurance companies say are essential to their business models.

However, all the literature around suggests that insurance scores are computed mainly from your credit report (the same items that contribute to a FICO score), and from the loss history for the property. A company called ChoicePoint maintains a database called C.L.U.E. (like the board game - actually the acronym means "Comprehensive Loss Underwriting Exchange") (FAQ) that relates to the claims experience for properties. Other items could enter into the calculation, such as the claims experience in a general neighborhood, and the risk of flood, earthquake, wind, or wildfire in an area, relative to the coverages offered (flood usually has to be purchased separately). For auto insurance, your driving record (moving violations – not certain about photo enforced items) would become the most obvious item, as well as some profile items like age and gender and marital status (which may be becoming less important than they used to be; wouldn’t a 21 year old trained to drive a military vehicle or operate an jet be a better risk than the average 21 year old behind the wheel?)

To some extent the subject is disturbing because identity theft could compromise an insurance score, and it may be harder to resolve. Yet many property companies offer identity theft insurance endorsement, even to the point of coverage wrongful conviction for a crime committed by another.

All of this sounds related to still other services, like Tenant Checks, which screen perspective renters and look at items such as prior evictions.

Social activists are properly concerned about the potential for redlining certain neighborhoods. Many metropolitan areas experience unusually aggressive crimes in some neighborhoods, associated sometimes with illegal immigration, drug cartels and gangs – to the point that the problem is a genuine Homeland Security issue and should not be just the responsibility of local law enforcement and the insurance business.

The literature, however, does seem reassuring that insurance scores do not directly concern themselves with personal issues (sexual orientation, for example), or religious or political beliefs, or other social diversity factors.

The major starting point for this subject is the Insurance Scores website.

Look also at About.com’s FAQ reference, and at Choice’s own reference (which offers a preview score for a small charge). These references indicate that one cannot easily get CLUE data on a property without legitimate purposes.

Where you shop affects your credit score -- really?

AOL Walletpop offers an article on how what you buy could affect your credit score. Companies are treating purchases made at second-hand stores or at pawn shops as indicative of poor credit risk, even though there are supposed to be regulations prohibiting the practice.

I think that the title of the article “What you buy affects your credit” and the picture of a generic dishwasher fluid on the strike page from AOL as misleading. It’s where you shop that may be a problem. The New York Times had reported on this problem in late 2008.

The story link is here.

Know how FICO scores are calculated: watch that "mix of accounts"

AOL today provided a “wallet pop” column on how your credit score is computed, by Janene Mascarella. I thought I would provide it on this blog, since id theft has often compromised credit reports and credit scores. The article is titled: “Are you clueless about credit scores? What you need to know.” The most interesting item for me was “mix of accounts”. The article reads “Ideally, the credit bureaus like to see a mortgage, an auto loan, and three to five credit cards.” I don’t have a mortgage or auto loan, although I could have either or both (particularly the latter) in the foreseeable future. (Yup, I ought to go Oprah and drive a hybrid.) In 1979, I did not get approved for a particular credit card (National Car Rental) partly because of "lack of home ownership." That soon changed.

I worked for Chilton in the 1980s, as a mainframe computer programmer-analyst. Chilton is an ancestor of Experian and at the time I worked tangentially on “risk predictor” which was the feed to Fair Isaacs.

The link for the article is here.

AOL offers ten basic tips for identity protection: No. 1 is watch what you put online to idenfity yourself; and watch the trash

Lisa Rogak, of CreditCards.com, has an entry on AOL walletpop today (Wednesday June 17) of “10 Things to Know About Identity Theft,” link here.

The main tip is not to give out a birthdate or home address or land home phone on any public website, including social networking sites, profiles, and online resumes. Use a UPS mailbox. If you have an Internet domain, do the same (private registration is even safer). Remember, however, that there are companies that sell unlisted information about people in low cost reports, probably barely within what my own Congressman (Moran, D-VA) says is “legally permissible.”

The advice considers the physical world of paper as dangerous, more so, than the Internet. Checkout counters and restaurants. Apparently a credit card number can sometimes lead to the whole identity being used.

An important defense is computer literacy: frequent inspection of online accounts. Get your money into well-managed and secure accounts (trusts are even safer) that you can check.. Computer and security literacy is particularly important for people who have to travel for work or family reasons.

ABC introduces "Card Cops" with alarming report of overseas ID theft

The Money section of ABC News and Nightline have an alarming report, June 3, “Thieves Snatch Billions in Credit Card Fraud: 'Nightline' Tracks Hackers in Underground Identity Theft chatrooms; How to Protect Yourself”.

The link is here. ABC tried an experiment and found that a fictitious credit card was siphoned in 15 minutes by crooks in Kiev.

The story mentions Dan Clements, of Card Cops, a company that tracks international identity theft, particularly in credit card numbers and bank account information. Sometimes accounts get set up in a person’s name that the person never knows about or gets bills for. Other times bank accounts are siphoned. Most of the activity is overseas, in Russia, or former Eastern European countries or Asia, mostly in poorer countries where youth have some indignation and gang-like incentive to steal and "prove themselves".

The story says that a lot of compromise happens with phishing of naïve Internet users, but a lot of “shoulder surfing” happens in retail establishments, involving dishonest (and perhaps underpaid) clerks.

The story recommends opening new cards with new account numbers rather than letting them renew automatically. They also recommend changing debit card pin numbers frequently.

Naïve users are more vulnerable than experienced people with Internet literacy. Other defenses include frequent checking of bank accounts and credit cards online, and frequent checking of credit reports. Does Internet activity make one a “target”, or is a moderate amount of “fame” a protection because the person becomes harder to impersonate and not get caught. It’s hard to say.

Still, I think that we can build systems to stop this if only we have the will and invest the resources.

Fortune suggests tips to protect yourself while job hunting

AOL today republished a Fortune article “Don’t Let ID Thieves Hijack Your Job Hunt.” The article is by Anne Fisher, and lists six ways to protect yourself.

The article suggests never giving complete identifying information (especially date of birth, as well as social security number and home address) on an online resume, social networking site, or anywhere else online. It’s perhaps a better idea to use a land UPS store address. Another tip is to watch for “too good to be true” job ads.

All of this seems to lean toward the idea of much more integrated presence online than in the past. Yet multiple “identities” online might help thwart fraudsters. So it’s a thorny question.