The Money Mustache Community

Learning, Sharing, and Teaching => Ask a Mustachian => Topic started by: damyst on October 28, 2016, 12:55:10 AM

Title: How much should we worry about identity theft?
Post by: damyst on October 28, 2016, 12:55:10 AM
Wannabe early retiree here. My family's FIRE strategy is based on owning less, living more, and investing our surplus income in a mix of public and private securities.
With the growth of our stash in recent years, I've become a bit wary of the fact that all our assets are, in effect, just records in computer databases out there.
I'm in software myself, so I know just how ephemeral and brittle those sequences of ones and zeros can be. It frankly feels like a very shaky foundation to build your future upon.

Let's assume for now that the financial service providers have their houses in order, and won't suddenly lose track of our assets due to natural disaster or human incompetence.
That leaves outright theft.
I'm not talking about Russian hackers breaking into a server somewhere and attempting to make purchases with random victims' credit cards.
I'm referring to experts targeting your individual account, forging your identity documents, potentially showing up at your bank pretending to be you, ultimately escaping with a large chunk of your wealth.
Many people in the FIRE crowd have stashes worthy of attention from sophisticated criminal players.

Questions:
1. Is anyone else losing sleep over this? If not, why?
2. Any specific practices or services that you're using to protect yourselves against theft?
Title: Re: How much should we worry about identity theft?
Post by: oldladystache on October 28, 2016, 01:57:58 AM
I don't worry a lot but for that reason as well as the possible technical glitch that could mess up things for a while I have my assets in a couple totally separate places.

Of course while that diminishes the possibility that they will make off with everything it doubles the chance they will get something.
Title: Re: How much should we worry about identity theft?
Post by: GizmoTX on October 28, 2016, 08:34:47 AM
We just put a credit freeze at Experion, Equifax, & Trans Union for DH, DS, & me for $90 total. Cheap insurance. It would be free if we had experienced identity theft but who wants to wait for that. Already our IRS returns have had some questionable activity, so we're applying for its PIN security program. We use a crosscut shredder & are working on more secure passwords.
Title: Re: How much should we worry about identity theft?
Post by: Yankuba on October 28, 2016, 09:05:12 AM
You can set up challenge questions with your broker-dealers and investment advisors so when a person calls and claims to be you they have to answer a question you set up - something they won't know. You can also set up alerts for all transactions and money movements. As soon as you see activity that isn't yours you contact the financial institution and they reverse it.

I also froze my credit - it's a pain if you want to get credit or do credit card churning but it prevents people from taking a loan in your name. Not sure how it works with student loans - from what I understand if someone takes out a student loan using your information it's a beast to get it cleared up.

RSA tokens and two factor authentication are also good ideas for financial accounts.

I also get the IRS PIN mailed to me each year so fraudsters cannot file a fake return in my name.

My data was breached (I'm a federal employee) so my office gave us one of those identity theft protection services and I also pay $9 per person per month for LifeLock. 

There's lots of stuff you can do to protect yourself
Title: Re: How much should we worry about identity theft?
Post by: Syonyk on October 28, 2016, 02:05:24 PM
I've lost my identity so many times, from so many different sources, that I just don't care anymore.

It's absurdly difficult to "cash out" in bulk - same problem with credit cards.  Cashing out 1 credit card?  Easy.  Cashing out 40 million?  Forget it.
Title: Re: How much should we worry about identity theft?
Post by: katsiki on October 28, 2016, 02:42:06 PM
Curious about this also.

I use a number of monitoring services but have considered Lifelock, freezes, etc.
Title: Re: How much should we worry about identity theft?
Post by: Frankies Girl on October 28, 2016, 03:26:14 PM
The following is strictly my opinion, but my husband and I were ID theft victims back before they made it easy to report/clean up your mess left by the theft. It took me about 6 months and locking down our credit to clean up all the issues (total freeze was free on all credit for 7 years since we were victims). FYI, it was at a car dealership, although they never admitted fault, they had a guy apparently sweep a bunch of loan applications into his bag before quitting and moving away (and selling the info likely).

Lifelock is useless. They even had to settle a lawsuit about their claims of preventing or stopping ID theft "before it happens" or some such nonsense. I had it for years, and they never really did anything. So pay for it if you like the semblance of security, but it's similar to having an alarm sign in your front yard - will deter the casual theft and make you think you're protected, but will do nothing against a pro that is actively trying to steal from you.

The best thing you can do is:
1. Freeze all of your credit so no new accounts can be opened;
2. Monitor your accounts on a weekly (average) basis;
3. Use strong passwords that can't be figured out by anyone, and change them every year minimum, (and use 2-factor authentication if available), and
4. Minimize the way you access your information (don't log in on public wifi to check your accounts for instance, and don't save login name/PW on any device - phone, computer, tablet...) and how often you put it out there (applying for credit means giving someone access to your financial info/SS/work history, so be very vigilant with whomever you do business with about how they handle your information).

I check my accounts daily using Mint. I can see instantly when and where a credit card was used, see the balances in our accounts, check our investments... whatever. If I need to check in depth, I log into my investment accounts after checking in with Mint. We also have alerts on our credit cards - they shoot us an email when it's used someplace like a gas station or for a purchase amount over a certain $ amount.

I don't lose any sleep worrying over the chance that someone might hack my accounts. If that happens, they'll make me whole; it's in their security coverage. Banks have FDIC insurance (up to 250K/account), investment firms have SIPC if the firm fails. Any fraud caught on the cards, and they make it right instantly. As long as I'm doing my part not being careless with my information and monitoring it for any oddities, there's nothing more I can do, so why freak out about it?

The alternative is to be a tin-foil hat crazypants and buying gold bars to bury in the back yard, and frankly I don't think I'd sleep any better going that path, as inflation will definitely steal my money with more certainty than any hacker or thief... and nobody is gonna pay you back for that loss. ;)

Title: Re: How much should we worry about identity theft?
Post by: damyst on October 29, 2016, 04:55:44 PM
Thanks to everyone who commented so far. You raised some suggestions I wasn't aware of, and I'll definitely look into them.

Some responses concerned types of credit fraud. Correct me if I'm wrong, but it seems like credit fraud is more likely to lead to hassle and embarrassment, rather than unrecoverable loss of the stash?

The scenario that concerns me the most is that someone logs into my online account(s) and wires the funds to an overseas destination (which is most likely closed shortly after).
They couldn't do this simply by gaining access to the account, since the system won't let you transfer funds out to an arbitrary recipient not authorized in advance.
But what if they did pre-authorize the recipient, using the same process I would use if I were doing it legitimately? E.g. by sending the request to the broker by fax or letter, complete with a (stolen) picture ID and my (forged) signature? How do you protect against that?
And how would frequent monitoring the account help, since you won't see anything amiss until the damage has already been done?

Frankies Girl says she's not worried about this because the brokers and banks are insured. But the insurance only applies if the loss was the institution's fault, not yours. And an insurer will definitely pursue every avenue for pinning the blame on you before paying out a six-figure sum.
Title: Re: How much should we worry about identity theft?
Post by: Indexer on October 29, 2016, 06:18:30 PM
I use to work in banking and I dealt with several situations where clients had their ID stolen.

IMO the VERY best defense against ID theft is to aware and alerted. You can never 100% prevent it, but in most cases if you catch it quickly it can be reversed easily. I would take some free alerts over paying for lifelock every time.

I saw several cases where people caught it within 48 hours, they contacted the credit agencies and closed any affected accounts. No big deal.

The worst cases were the ones where it went on for months before anyone noticed.

"But what if they did pre-authorize the recipient, using the same process I would use if I were doing it legitimately? E.g. by sending the request to the broker by fax or letter, complete with a (stolen) picture ID and my (forged) signature? How do you protect against that?"

Perfect example. If someone did all that and you didn't know about it... you are in for a very big headache. You should still get your money back, but its going to require a lot of hours of work on your part. However, if you were alerted to it within 48 hours you could call the broker and tell them it was false. Now in this specific case if you catch it quick most companies can reverse the transfers as fraudulent. Hopefully the institution on the other end put a hold on the new deposit. Most do. If they don't, that is their problem, not yours. Moral of the story: when you get those brokerage transaction confirmation emails pay attention.

Let's use Vanguard as another example. Let's say someone hacked your account and created a fake bank to transfer the money to. Vannguard notifies you by email anytime you make changes like that. If you check your email, you know. If you try to log into Vanguard they probably changed the password. You can't get in. Big red flag. CALL Vanguard. They are alerted to the fraud. Problem solved! :)

A lot of free credit score software available through credit cards will send you alerts if you sign up. The last time I applied for a cash back credit card I received notifications from three different sources within 24 hours. This will even alert me if my address is changed. A lot of credit cards can have alerts set where they will text you anytime X happens. X could be a $100+ transaction, or your balance exceeding $1000, or your bill not being paid in advance, etc. I have multiple set up on each card and they text me the balance each morning so I can see in the text history my balance changing day by day.

"Frankies Girl says she's not worried about this because the brokers and banks are insured. But the insurance only applies if the loss was the institution's fault, not yours. And an insurer will definitely pursue every avenue for pinning the blame on you before paying out a six-figure sum."

The process to 'cash out' a six figure sum, at any institution is extremely complex, and would be caught. Lets say the fraudster transferred your Vanguard money to a fake account at Wells Fargo. Wells is going to put a hold on that money, and Wells isn't going to let someone walk in and take out 100k in cash. They are also going to heavily question any 100k check that is written, especially on a new account that doesn't normally have 100k in it. Everything electronic or by check can be traced. Even if they tried to buy something expensive, lets say 100k in cars or jewelry, the seller isn't going to take a personal check. They will want a cashier's check or a wire, both of which need the bank's sign off which brings us back to any six figure cash out transaction being treated with extra attention. Until the money is in cash or spent(ex. jewelry/visa cards) the fraudster can be caught and the transactions reversed. This is why being ALERTED is so important. If you catch it within 2 days you are good. If you catch it within 7 days you are highly likely to be good. Within 30 days....  you should be fine, but lets hope it was a small amount. Outside of 60 days... your odds of getting your money back aren't as favorable.
Title: Re: How much should we worry about identity theft?
Post by: Syonyk on October 29, 2016, 07:43:31 PM
On the computer security side of things, a dedicated Chromebook for banking is a cheap bit of insurance against malware.
Title: Re: How much should we worry about identity theft?
Post by: damyst on October 30, 2016, 02:03:25 AM
Thanks very much Indexer, this is precisely the kind of insight I was hoping to gain by posting here. I'm sure it will be useful for others too!
Title: Re: How much should we worry about identity theft?
Post by: Indexer on October 30, 2016, 06:38:44 AM
Thanks very much Indexer, this is precisely the kind of insight I was hoping to gain by posting here. I'm sure it will be useful for others too!

You're welcome. I'm glad I could help.

Added bit of reassurance, the vast majority of the fraud cases I saw were smaller transactions. Fraudsters know big transactions draw more attention and trying to sell securities adds more steps(time), both of which increase the risk of getting caught. The most common types of fraud I saw included stealing credit card numbers, check fraud(normally $500-$2500 per check), and the most painful to clean up was tax return fraud. Someone files a fake return using your information. If someone files a fake return before you file yours, you have to prove to the IRS you are really you and this can turn into a nightmare. If you file first, the fake one gets rejected, and since they can't prove they are really you that is normally the end of it. I try to file my taxes each year pretty early for this very reason. In many cases I'm filing before I get the forms saying how much interest I paid on my mortgage, my HSA contributions, etc. You can normally calculate this yourself if you have good records, and if by some chance you are wrong you can file an amended return.

On the computer security side of things, a dedicated Chromebook for banking is a cheap bit of insurance against malware.

I will second this.

Anytime you turn a chromebook on and off it clears everything. To my knowledge turning a Chromebook off and on again is akin to completely clearing a normal PC and then booting it from the original boot disk. It clears everything. Except instead of hours, a Chromebook does this in about 10 seconds. It also treats everything suspicious, like a virus, until proven otherwise. They can't run downloadable programs, like excel, which means most viruses couldn't run on a Chromebook even if they made it past the other defenses.

I use a chromebook for all my financial transactions, and I just make sure to restart it first. You can restart one in under 30 seconds so it's not a big deal.
Title: Re: How much should we worry about identity theft?
Post by: Syonyk on October 30, 2016, 08:32:27 AM
Not exactly,but close enough. Trusted boot is a great thing.

Turn off extension sync if you sign in, though. Or just use the guest account for financial stuff.