Maybe in theory. In practice, not so much. The last time I had a freeze in place it messed with all kinds of things. I couldn't even open a My USPS account because the identity verification wouldn't work. I've been through this sort of thing a bunch of times. I'm kind of an unwilling expert on what really happens after PII is stolen.
I have a MyUSPS account and don't recall having to provide a SSN, and therefore there was no credit check. I pay with a credit card, though, so I wasn't requesting a separate extension of credit. Any time a merchant performs the more extensive inquiry, they're going to hit the freeze. Regardless, these types of events are not frequent for most folks, so any inconvenience is minimal compared to having to change the SSN everywhere it's used. And even if the SSN is changed, I'd still want the freeze to prevent extensions of credit when the new SSN is inevitably stolen.
Right. Which means the financial institution is supposed to do additional verification. The problem is that none of them want to do it. It's too much like work and requires an actual human rather than a robot to get involved. So forget about opening any sort of legitimate account online because you're not worth the time it would take for a human to look at your faxed documents.
Actually, with a fraud alert, the institution is supposed to call you to verify the activity. That seems pretty simple. Likewise, doing a targeted and temporary "thaw" of your profile with a credit bureau is pretty basic, but obviously you have to plan ahead in both cases if you're the one precipitating the credit inquiry. Most of our online accounts are paid using a credit card, so there's no request for SSN nor credit bureau inquiry.
Overall, though, I agree that the call-in verification is weak in many places. Name, address, and last 4 of SSN are typically what I get asked. Lazy. The thief(s) already have that info, so we could have account numbers changed 10 times and it wouldn't matter. Fortunately, our home bank won't give more than very basic information over the phone, regardless of how well our identity is verified; they force us into the branch for any transfers or material changes. We keep very little balance in our checking account, have overdraft protection turned OFF (despite the bank's effort to convince us to turn it on), and money cannot be deposited or withdrawn from our savings account using the debit or ATM card even if someone has the card and knows the PIN. Most--but not all--of our online accounts use complex secure passwords and have some type of two-factor authentication enabled. Nevertheless, we have notified our home bank of the situation.
With respect to credit card accounts, there is essentially no fallout except for the minor inconvenience until a new card arrives in the mail. I've had one of my cards skimmed in the past couple of years, and I suspect that I know where it was done, but of course I can't prove it. I had a credit card account in the past that was CONSTANTLY being stolen, which lead me to believe that it was an inside job. After the third or fourth time in a year with the same bank, it did get to be a hassle, so I just closed the account.
It's an especially good idea when you consider that probably 99 percent of banks allow their CSRs to pull up customer information using the SSN. This could allow the miscreant(s) who have your wife's information to perpetrate more frauds by randomly calling banks and impersonating your wife.
I'm not sure that there is a real risk here except with entities where we have existing accounts. Any bank or business where we don't have an account would hit the credit freeze when they did a credit inquiry. Of the institutions where we have our cash and investments, both of them have rather extensive (annoyingly extensive) identity verification processes for call-ins over the phone. Also, our post-paid cellular carrier won't even discuss our account over the phone without PIN-code verification--I've tried to convince them to bypass this on a couple of occasions, and both times they've refused to acknowledge anything about the account without the correct PIN. Obviously, all of this extra information could be stolen, too, but most of it is unique to each institution so unless ALL of it is stolen, the damage would be limited. I'm not organized enough to keep all of this information in one place.
I guess the good news is that identity theft "awareness" is substantially better than it was even a few years ago, but it's still far from where it needs to be with many companies. Heck, it's 9 months since the supposed "liability shift" for non-EMV credit cards, and most retailers either don't take them or don't require their use. And, I still encounter online web sites which can't handle long or complex passwords/phrases or special characters, and don't offer good two-factor authentication.
In my wife's case, I suspect that the perpetrators are after "easy money" using her information. Once they hit the credit freeze, her information will quickly be demoted. If she were a prominent figure where other malicious intent could be a factor, I'd probably be more concerned, but trying to navigate around credit freezes and other obstacles seems like it would be too much work when there's an abundance of other "easy money" information out there.
JKG
