-Let's give a big round of applause
for Attorney General Bob Ferguson.
-Good morning, everybody. Thanks so much for having me
join you today, really appreciate it.
Thanks to Doug and to the whole team here with AARP.
It's been a great partnership
that we've had now for quite some time,
and as they probably told you, they take this show on the road
all around the state, in all corners of the state.
We're going to be in Spokane here I think later
on this summer,
and so we really appreciate all of you coming out
and hearing from the experts on how you can protect yourself
on the real challenges that we face.
So I've got a few slides. I'm just going to dive right in.
So I think some of you
have probably been to an event like --
Raise your hand if you've been to an event like this before.
I'm just kind of curious.
Okay, so a few of you have seen this picture
before then, fair warning.
So that's me and my mother.
Okay, so I have a rule for any slide presentation.
My teams knows there has to be at least one picture
of my mother or my children in every slide,
so you guys got the picture of my mom,
and so that's me and my mom.
I grew up on Queen Anne hill here in Seattle.
My father has passed away,
but my mother is still very much alive.
She's going to turn 90 next month,
so we're really excited about that.
We had a great Mother's Day, so I'm one of seven kids.
I have six boys and one long- suffering sister in my family,
and so I have this picture because it was a few years ago
now, not long after I become Attorney
General, when I went to go visit my mom.
She lives here in Seattle.
She lives in a retirement community,
and she, of course, obviously did not grow up
with the Internet or with e-mail or any of that.
She's a retired special education schoolteacher,
but she is interested in that technology
because she knows it's a way to stay in touch
with her many grandchildren and her children
who, of course, are spread all around the country,
so she wants to be able to access e-mail.
So I went to go visit her once a few years ago,
and she had an e-mail up on her computer,
and she said, "Bobby, I'm glad you're here.
I have this unusual e-mail from a friend of mine, Joan,"
and I know who Joan is, long-time family friend.
And I went to look at the e-mail,
and the e-mail says,
"Dear Betty," it's actually addressed to her.
"Dear Betty," it was like,
"I'm traveling in England," or something.
"I've lost my passport."
I forget the detail, but you know where this is going, right?
"Something has happened.
I need money desperately so I can get home.
Will you send me $500 or $1,000?"
And my mom was puzzled by that mainly
because she knows Joan well
and knew she wasn't traveling, right?
Truly, right? She knew she wasn't traveling.
They would've talked about it, but she still was --
It looked like a real e-mail to her, right?
And so I said, "Mom, I'm sure it's a scam," right?
And so she called Joan up.
Joan had not realized.
Joan was at her home, had not realized someone
hacked into her computer, hacked into her e-mail,
had sent these e-mails out to other people,
and that's how people get scammed,
and so one thing I just will emphasize
is just by virtue of being here,
you are obviously very aware of the challenges
that we face right now with data breaches,
with your personal information being compromised,
and I just really encourage you,
and I'm sure others have encouraged you,
to take the information you have and use it yourself,
but share it with folks you know.
You know, not every 90-year-old woman
has a son who's the Attorney General
stopping by to check on her, right,
to make sure she's not being scammed, right?
So you can play that same role with your friends
who may not have a support network in place,
may not have children coming by,
may not have neighbors coming by to check on them,
and we see it over and over and over again, 100 times over,
1,000 times over, people who fall victim to scams
who you just think, "How could it happen?"
But we see how it happens. It happens all the time,
and the results are really heartbreaking.
We have this great partnership.
I just want to emphasize this again.
You know, Doug and I are often on the road
speaking with TV interviews or radio interviews
or speaking to folks, but AARP does fantastic work.
We so appreciate all the work they do in partnership
with the folks in my office.
So I'm going to talk about a few things,
and I'll be brief on each one of these,
but I'll talk about data breaches in our state.
I'll give you some numbers around data breaches
which we have,
what to do if you're impacted by a data breach,
how to protect your digital information,
what to do if you think your information has been stolen
and what my office is specifically doing
in regards to data breaches.
So data breaches, of course,
occur when your personal information is compromised.
I was just talking to a news reporter before coming in here,
and he asked, "Hey, have you ever been impacted by this?"
Heck, yeah.
My niece had -- There was, like,
this IRS scam for a while where people got information
and filed tax returns in your name.
That happened to my niece.
My wife and I are very involved with the Catholic --
Our kids go to Catholic schools.
We're very involved with the school, volunteering,
and the Archdiocese of Seattle had a big data breach
where folks who were volunteers with the archdiocese
had their information compromised.
That was us, so once those data breaches happen,
your information is then compromised,
and that can, of course, be used to steal your identity,
file your tax returns or separate you
from money in your bank account.
So these are data breaches in Washington State,
so one thing we did is, we proposed a law.
My office proposed a law
to the state legislature a couple years ago
because we realized that compared to other states,
Washington's laws in terms of requiring businesses
to have up-to-date technology
to protect your information was way behind,
and in Washington State,
let's say the archdiocese has that data breach,
or Target has a data breach.
There was no requirement for those companies to notify
my office that such a data breach had occurred.
There was no deadline by which they had to notify
consumers that those data breaches had occurred,
and time is of the essence when a data breach occurs.
You can protect yourself, so the law was changed.
We proposed a change in the law,
and one of those changes involved informing my office
when a data breach occurs.
So this gives you a sense of it.
The numbers on the bottom are the number of consumers
impacted, overall about 3 million.
This is just in the last year, about half the state
impacted by data breaches.
It's a huge, huge amount of folks,
and here is what we see in terms of how they happen,
the cause of the data breach.
This just gives you a sense of scale.
The yellow section which is, what,
maybe about a quarter of it, theft or mistake.
Somebody breaks into your car, steals your laptop.
A mistake, you know, that can happen.
A malicious cyber attack is the most significant way
in which this can happen,
so these are ways in which we see data breaches going on.
This was on the bill signing for that legislation,
so let's talk about, how do you know when a breach affects you?
If you have any suspicion that that has happened,
you need to take immediate action,
and folks here I know will be talking about that,
but let's talk about a couple things you can do.
One is, check your credit report with all three major credit
reporting agencies, and this is considerate credit freeze,
I would say strongly considerate credit freeze.
The good news is, the state legislature just passed a law
this year that makes those credit freezes free,
and I suspect others have talked about it already,
and so I won't go too much into that,
but that's a change in state law
that makes those credit freezes free
if you know your information has been compromised,
and just be diligent about checking your bank
and credit card information.
Take a look and make sure those charges make sense to you,
that nothing unusual is going on,
so you just can't be a passive individual
when it comes to your information through your bank,
through your credit card, through those places
where you are having your finances are flowing.
I think I was hearing the previous speaker go,
"Know who you're giving your personal information to."
He was talking about tech support, if I recall.
I was overhearing a little bit, talking about tech support.
We had a large case against a company
based in India called iYogi.
This is not part of my slide, but just to give you an example
of how tech support works, if folks Googled
"Microsoft tech support,"
this entity, iYogi, would come up,
and what would show on the Internet,
it looked as if they were affiliated with Microsoft.
They are not, or HP. They are not.
There's no connection, okay?
But they made it look like they were Microsoft's trusted
tech support entity,
and so if you called iYogi, here is what happens.
You call them up.
They say, "Okay, in order to look at -- "
You're calling because your computer is running slow,
or you think you have a problem.
They say, "Great. We need to access your computer remotely
so we can see what's going on."
The consumer then gives them access to that computer,
and then all of a sudden,
things start popping up on your computer.
You have a virus.
Bad things are happening.
That's iYogi doing that to your computer because they're inside,
and then they tell you to solve that virus,
they're going to sell you a needed software to deal
with that that costs $300 or $400.
It was a scam.
You had no such virus going on,
but once they had access to your computer, right,
they get you in the door by thinking they're connected
with someone you trust, Microsoft.
You call them.
You give them access, and now these things start popping up,
and then they sell you software you don't need.
My team at the Consumer Protection division
did an investigation.
We bought new computers, new operating systems,
and called iYogi up and said,
"Hey, our computer is a little slow.
Can you help us out?"
Things start popping up literally saying,
"Oh, you've got viruses."
It was a brand-new operating system just off the shelf.
We just opened it up, and that's what happened,
so we brought a lawsuit against them
that has now largely shut them down.
They advertised themselves as the largest tech support
in the world,
and we were able to largely shut them down,
but it's very, very difficult because these companies
are sometimes overseas, and a case like that is complex.
I'll spare you the details, but it takes a lot of work
to reach a company like that and impact them in that way.
So you're probably hearing some of this from others,
so I won't go too much into it, but just make sure you know
who you're giving your information to.
If your bank calls you up,
hang up and call your bank back up.
Then you know you're calling your bank.
Just take steps that seem logical to you
to protect your information and these common-sense steps
I suspect you're hearing from others as well.
If you believe someone has stolen your identity,
call the company where you think this has occurred.
Place a security freeze or a fraud alert
on your credit report and report it.
This says to the FCC -- Report it to my office as well,"
to our consumer protection division.
Most of the cases that we bring in my consumer protection team
come from an individual notifying my office,
and sometimes the person didn't fall for a scam, right?
They just said, "Hey, this thing happened. It was suspicious.
I want you to know about it," and that helps my team monitor
what's going on, what we're seeing.
It helps us take action on different cases.
So I mentioned this data breach law that we have strengthened,
and that is providing us a great deal of information
that we can provide back to consumers,
so I don't know if I have a slide coming up on this,
but if you're curious, we issue a report now
based on all those companies must notify us
when they have a data breach.
My team compiles all that information each year
and puts it into an annual report.
I think we've issued two of those reports now.
Maybe it's three, so if you're ever curious
about what kind of data breaches are going on,
how many people are impacted,
and you can see if those are companies
you've provided your personal information to, it's there.
It's on our website.
You should feel free to check it out,
and it's excellent information.
We can also, there's an education component
which this event is about,
but my office can also, as in the case of iYogi,
we can file lawsuits against companies
and hold them accountable.
Two main ways in which we do that:
if they do not have the proper security,
if a company is not taking the proper steps
to protect your information.
I mentioned before that law that proposed a couple years ago
that AARP was such a big help on.
The protections required from local companies
in Washington State were minimal.
We were one of the weakest states in the country
for requiring businesses to have up-to-date technology
to protect your information, so that's been changed.
So if they don't have that in place,
we can litigate against them,
and also if they do not notify you when a data breach occurs.
We have cases right now around
that where your data has been compromised,
and they did not notify you within the time
that they must do that, so they have a requirement
to notify you quickly when that happens.
If they don't, my office can frankly sue them,
so if that ever happens to you,
your information has been compromised,
and you feel you did not get notice until months later,
let my office know.
I'll be very quick on this slide here.
So we've had cases against all sorts of entities.
Equifax, huge case, that is still ongoing.
Target, you know, they're paying millions of dollars
to multiple states.
Most of these cases are what we would call multistate litigation
where it's not just my office.
It's AGs from across the country
who combine resources to bring these lawsuits.
That's Republicans and Democrats working together.
These are bipartisan efforts, and these are important cases.
These are big, high-profile ones.
We have others that are less high-profile.
They impact a smaller number of Washingtonians,
but they are just as important for the Washingtonians
who are deeply impacted.
But again, many of these come from individuals
who notify my office.
Lastly, just in terms of our consumer protection division,
we have a team of about maybe 80 employees
who enforce our Consumer Protection Act.
So in Washington State, this law has been around
since the early 1960s.
The law is pretty simple.
It says, "You cannot engage
in an unfair or deceptive business practice."
That's literally what the law says,
"an unfair or deceptive business practice,"
and that law has been interpreted
quite broadly by the courts.
It's a very powerful tool for us to work on your behalf.
We receive thousands and thousands of consumer
complaints every year.
The overwhelming majority of those are from folks
who are over the age of 50,
and the key message here is we want to know,
whether it's in this arena or any other arena
where you feel you see a scam, something going on,
you were not treated fairly in the marketplace or, hey,
a friend of yours wasn't treated fairly in the marketplace.
Let my office know.
So for every consumer complaint we receive,
what my team does is, they send a letter to the entity
that you are complaining about, and we say,
"Hey, we received this complaint.
Please respond to it."
That tends to get attention from companies, right,
when they get a letter from our office,
and so literally, without us doing anything more than that,
consumers receive millions of dollars back
just from that single letter without us
doing anything more than just sending a letter,
and then consumers write back and say, "Hey, you know what?
We got it taken care of," right?
They don't want to have the AG's office
doing some investigation, right?
But sometimes we have to litigate.
Sometimes, the business did nothing wrong, right,
but that's the first step is we always,
for every complaint that gets sent to our office,
we contact the entity of which
the consumer is complaining about
and then take it from there as appropriate,
so we have a big operation, a big office.
My team works very, very hard on these cases,
and just encourage you to reach out.
I think this is my last slide.
So we have a strong presence on the Internet.
Just go to my website, Consumer Protection Division.
It's pretty straightforward to file a complaint online,
how to file a complaint,
or you can mail one in if you prefer,
but you can go to our website to get that.
You'd just be searching for consumer protection complaint,
or you can simply call,
so we have folks in my office who take calls
and can walk you through the information you need to provide,
and again, I would encourage you,
even if you did not fall victim to it, right,
if you're willing to take the 15 or 20 minutes
to write in that complaint,
that helps my team go after the bad guys for folks
who have been scammed by folks
who are not playing by the rules.
So it's a real honor to be here with all of you today.
Thank you so much for being here,
and I hope you have a great afternoon.
Thank you so much.
-Please welcome Chuck Harwood.
-Thanks, Doug, I appreciate it,
and a couple confessions here to start.
First of all, I am a Doug Shadel groupie.
I have gone to many things that Doug has done.
If there's a fan club of Doug Shadel groupies,
let me know because I want to join.
I'm also actually a scam jam groupie,
and I go to lots of scam jams.
Indeed, this is my third scam jam of this week, so --
We've only had 3 days so far, business days.
I love scam jams, and here is why.
They are -- Obviously, there are important skills
that you pick up when you come to them,
but underneath it all,
it's really about maintaining independence
and learning how to continue to live a good,
sound life as we age, and that's, you know --
What more can you ask for, right, than that, as you age,
being able to be independent, being able to enjoy life,
being able to continue to be a useful
and important part of the community.
That fact that AARP and others put this on
is a huge public service
and is something that I'm happy to contribute to
and participate in, so I love being at these events,
and I'm thrilled especially to be at the Washington State one.
I've done scam jams in -- Well, I did Idaho yesterday
and the day before yesterday, and Oregon is coming up,
and I've also done Montana, Alaska,
and I have to tell you, the best ones I've been to
are the ones that are here in the Washington State
and the ones that Doug and the folks from AARP
put on, so it's really been great.
So I'm going to talk about -- Again, as Doug has told you,
I'm from the Federal Trade Commission,
and I'm going to talk about -- Doug gave me two assignments.
One was talk a bit about credit
and the other was talk a bit about social media.
Now, I need to warn you that you're seeing the first --
This is the first this year's version of scam jam,
so my slides are going to be a little bit rough.
I hope -- As usual, I probably wrote more information
than I can possibly cover
because I really get into this stuff and just start writing,
so I may skip a few slides as we go.
For the most part, I'm going to try to just skip
the redundant ones because I notice,
"Gee, I said the same thing three times,"
and that's not unusual for me, but you don't need to hear it
three times, so I'll probably skip a few,
but hopefully we'll get through the materials
in the next 35 or so minutes.
So let me begin to give you a sense of, again,
I'm going to talk about three --
Doug gave me a few assignments, and here is sort of my table
of contents for my presentation today.
I'm going to first talk about information generally,
second credit,
third social media, fourth, if we have a few minutes,
I'll talk about identity theft,
although we've already talked about that
some in some of the previous presentations, and then finally,
I'll try to close with a couple of brief remarks
about what I called here data trickery
but really, it's the kind of imposter schemes
that we've already heard a lot about
during today's presentation.
So we are living in a digital age,
the age of big data,
and, you know, with smartphones in our pockets,
the amount of outstanding data
that's flowing in the economy is huge.
It is massive,
and data is collected through a variety of different
means through things like cookies, through Web browsers,
online media tracking, a whole range of different things,
different ways it's being collected,
and it's also being sold.
There's actually an entire industry of data brokers
who collect and sell the information,
and they store the information,
and it's a vast amount of information.
There are companies who claim to have
hundreds of pieces of individual information
on over 90 percent of the American population.
You know, I'm confident it's almost everybody in this room,
so vast amount of information.
Data is incredibly valuable.
We need to think of it as money.
Here are three passages that I found
just in the last day or so as I was thinking about this.
I'm going to set my notes down here.
First, PayPal founder, cofounder,
"The world is now awash in data,
and we can see consumers in a lot clearer ways," right?
Data allows companies to see us in a particular way.
Second, Carly Fiorina, Hewlett Packard former executive
and [Indistinct] of other things as well:
"The goal is to turn data into information
and information into insight," so they get the data.
They want to use the data to identify,
learn more about us, learn how to market to us,
learn how to talk to us, learn how to advertise to us,
learn how to campaign to us, whatever they want to do.
And then third, and here is the key piece,
essentially the bargain that we enter into
when we spend time online and spend time sharing data,
and this is the founder of Wired Magazine,
a tech magazine that has a lot of influence in the world.
You happily give Facebook
terabytes of structured data about yourself,
content with the implicit trade-off
that Facebook is going to give you a social service
that makes your life better,
so what we're talking about then is,
there's a transaction going on, isn't there?
You provide data. You get a service.
Data is essentially another currency.
It's another form of money,
and we need to think about it that way.
We need to think about it as if we are giving money
in the form of our information
in exchange for a service we're getting,
and once you think about it that way,
you'll also think more about what --
You know, is the service
that I'm getting for my data really worth it,
or should I actually think about ways to reduce
the amount of data I provide for that service?
Should I think about withholding some of that data
because frankly, the service is not as valuable to me?
So we're going to talk today about how to control
some of the data that is out there about you,
how to restrict some of the data and what you can do about it.
Now, a lot of people would like to say,
"I just want all of my data to be stopped.
I don't want anybody to have any information about me."
Sadly, it's too late to do that.
That's simply not going to happen,
and so what they do instead is people say,
"Well, there's got to be a magic bullet out there,
so I can just stop people knowing about me."
This is from LifeLock.
LifeLock is a well-known company that promises to make it
so that you can't be the victim of identity theft,
at least that's what they claimed,
and this is actually a 2010 LifeLock ad,
so it's a pretty old ad,
but LifeLock was claiming then that they could essentially
prevent you from ever being the source of data breach,
and obviously, entities like
LifeLock know that we care about our data.
They know that we care about what people know about us,
and so they're trying to use that information
to try to market to us.
The problem was LifeLock overpromised,
and we see this a lot in the marketing world,
obviously, in the advertising world.
LifeLock was one of many who's guilty of that.
It falsely claimed that it could provide complete protection
against all forms of identify theft
by making personal information useless to identity thieves.
In fact, it only blocked certain kinds of identity theft.
It did not block others.
It worked best against new account creations,
so where people were using data
to create new financial accounts.
It did nothing, for example,
with regard to medical identity theft.
Indeed, there are probably 30 different kinds of identity
theft that I could cite to you
if I spent time talking about it.
LifeLock only addressed a few, so we sued them in 2010,
and by the way, they also did a sloppy job
of maintaining the data they got at the time.
They were a little bit casual
with what they were given by consumers.
We sued them along with 30-some states,
I think including Washington, got a $12 million judgment.
This happened while I was in Washington, D.C.,
and they didn't learn their lesson,
so we sued them again in 2015
and this time got a $100 million judgment against them,
and again, they were overpromising.
Doesn't mean they weren't providing a useful service.
It means they were overpromising the service,
and what they were overpromising was that they could protect you
fully from identity theft,
and in fact, that's simply not the case.
There is no single magic bullet that can protect you.
The best you can do is use tools like LifeLock
along with your own vigilance and understanding of the data
that's out there about you and the data that --
And how you can use that data.
So I've talked about financial data, LifeLock.
We see the same kind of overpromising being made
about protecting consumers when it comes to online data,
so this is Bonzi software, or "bon-zai" software.
I've heard it pronounced both ways.
They were basically a company
that the FTC sued a number of years ago.
They claimed that they could protect you
against Internet attackers, $49 a year, and they would --
They had this weird alert system that popped up to scare you.
It had a tech support feel to it
like what Microsoft presentation talked about,
but they were actually charging money
for this tech support scheme.
What they were really doing was simply providing
a very limited scope of protection.
They essentially blocked some access through some ports,
through some ways that people got in,
but they really didn't accomplish nearly
what they promised they did, and yet they were charging
a lot, again, overpromised, underdelivered.
If you place all your trust in this entity
just like you placed Due0all your trust in LifeLock,
you are leaving the barn door open
to a lot of other kinds of scams and schemes,
and you're essentially only increasing
the possibility of being a victim.
So my theory on dealing with data protection,
you're going to hear me talk about this several times a day,
is there are a couple different pieces here.
One is, you want to have multiple layers of protection.
You may want to use something like LifeLock.
You may want to use something like one
of these software companies,
although I wouldn't recommend this particular one,
but in addition to that, you want to know.
You want other forms of protection as well.
You also want to know what --
You want to know how to find out what people have about you,
and you want to have knowledge about how they're collecting it
because with that knowledge and what they have about you,
you can decide where you're going to use your data,
where you're going to allow it to be used,
and you can better understand how to protect it.
We're way past the time where you can just say,
"I don't want any data out there about me."
Instead, we're now at the point where in the big data world,
you just need to know how it's being collected,
how it's being used and how you can restrict
how it's going to be used, and that's what we're really --
what I really want to focus on today is,
what's being collected?
How is it being used, and how can I restrict when it's used
and make sure it's being used in ways I want it to be used?
So Doug asked me to start
by talking about credit-related data,
and I will start with that first,
and the good news here is,
there's actually a fairly robust data-protection scheme
that already exists,
and amazing that this scheme goes back 40 years,
so this is not a new concept, and that's --
It's what's called the Fair Credit Reporting Act,
and I already see I've got a typo on this slide
because I just wrote laws and thought,
"Oh, I'll write the actual statute in."
Anyway, so it's the Fair Credit Reporting Act.
You'll see it listed in the last bullet there,
and it's a law that has existed since 1977 that restricts
who can get access to your credit and data,
and it says basically, you can only get access
to that credit data
under these specific situations, for example,
it's primarily when people are applying for credit,
so for example, mostly the Credit Reporting Act,
your credit report,
is going to be viewed by banks, lenders, utility companies
because they grant credit, collection agencies.
They have a credit and a debt-collection function,
but also allows some others to see your data as well,
potential employers and landlords,
other uses of credit information,
but those are specific people
who can get access to that data in your credit report,
and it's collected from a variety of entities.
You know, anytime you engage in a commercial transaction,
the data may be collected.
The entities that collect it include
the big three credit-reporting agencies:
Equifax, Experian and TransUnion.
Equifax, of course, has been in the news recently
because of a big data breach,
but those are the primary three that collect it,
so that's essentially the first thing to know about data.
There's that when --
You've got these three large entities
along with a lot of others collecting your data,
and there are many more data-collection agencies
besides these three,
but these are the three you need to know about,
but they are restricted in how it can be used
and what it can be used for.
So now you know who's got your data.
You'd like to know what they have.
You'd like to know how they're collecting it
or what they've got on you,
and the good news is that it's becoming easier
to find that out.
One way to do that is through a federal law
that was passed a number of years ago
that my agency enforces, the Federal Trade Commission,
and it basically says that each of
the three major credit-reporting agencies,
indeed other reporting agencies as well,
are required to provide you
with a copy of your credit report every year,
one copy every year,
and the best way to get that report,
easiest way from the big three,
is through a website called annualcreditreport.com.
You can, you know, check it out as soon as you leave here,
annualcreditreport.com.
You can also call the phone number on there
if you prefer to do this by phone.
Also, you can actually still request
the credit report through paper.
You can go online and download a paper report request form,
fill it out and mail it in,
to get a copy of your credit report.
Now, this will give you the big three.
It won't give you all the other ones,
of which there are many others out there,
but it's at least a great starting point,
and as I said, it's only one a year.
People have all kinds of strategies
for how they do this, when they do it.
Some people ask for one every 3 or 4 months.
Some people ask for all of them at once so they can compare.
You do need to look at all three
because they oftentimes have different information.
They don't all get input information from each,
from all the entities you deal with.
Also, you can get free credit reports
in a number of other ways.
If a company denies you credit,
they have to tell you why they denied you credit
and cite the crediting-reporting agency's report they dealt with,
and that credit-reporting agency, if you contact them,
will send you a copy of that report.
You can also get a free report if you notify somebody
that the report you currently have is inaccurate.
You can ask them to correct it and fix it,
or if you're a victim of identity theft,
you can get free reports.
Now, the challenge with credit reports,
and this is something that, there's this tension
because people always say, "Well, I want the credit report,
but I don't to share the information."
Here is where you need to know about sharing information
where you do have to share it.
They want to make sure that when they give you
that credit report,
they're giving it to the right person because remember,
they are restricted who they can give that report to.
There are very clear laws.
You can only give it to certain people
under certain circumstances for certain purposes.
They want to make sure that they're giving it to the person
who is entitled to receive it,
specifically the person it's about,
so they're going to ask you,
when you ask for a credit report,
some details like your name, your address, yes,
even your Social Security number to get it.
They're also going to ask you for your date of birth.
They maybe ask, if you've
only lived a place for a couple years,
they may ask for prior addresses.
They may even ask for more information
because they want to make sure they're not actually
letting the report out to somebody they shouldn't.
They may ask, for example,
something they think only you will know,
what we call an out-of-wallet question such as,
"What's your monthly mortgage payment?"
Now, they'll oftentimes give you multiple-choice options,
but something like that.
I know that people don't like --
You know, it's not a happy situation to have to give out
your Social Security number in these circumstances.
Nobody likes it, but the alternative is not --
You know, there's a risk that it could be given
to somebody you don't want it being given to,
so it really is important to understand
that that is a transaction where you're giving your data
in exchange for getting important information,
namely what people have about you.
What do you find when you open one of these credit reports?
Hopefully, all of you -- How many of you have gotten
your credit report in the last year or so?
Okay, it's a huge number,
so I won't need to spend much time on this.
You know what's on there, right?
It's got employers, addresses, positive
and negative information about your accounts,
payment history, whether you're slow-pay,
whether you've paid on time all the time.
It's got inquiries from other people
that are asking for your credit information
because some credit information
can be provided for marketing purposes.
Not all of it, but some of it,
so you'll see all that on the report.
You want to look at the information on there
and see if it's accurate.
If it's not accurate, you can contact
the credit reporting agency and ask that they change it,
ask that they correct it and ask that they send you
another copy of the report with the correction.
More generally, you're looking for red flags.
Are there accounts on there you don't recognize?
Are there inquiries that just seem really weird?
Like, it's from a landlord entity or something
and you're not out looking to rent a place.
Are there other kinds of --
are there odd addresses that appear on there?
We are looking on that report to see
is this me or does this sound like somebody else
who is maybe trying to use my credit
in a way that I don't approve of?
If you see those things, you want to take steps
to try to protect yourself,
and you want to fix the mistakes.
So I'm going to spend a couple of different slides
on how to fix mistakes.
This is the first one, then we'll come back to it
a couple of times later as well.
So if you see mistakes on your credit report,
if you see things you don't agree with,
the first step is always to contact them.
You can do it online, you can do it --
the law says send a dispute letter,
but these days, you can also contact them online.
You essentially say, "This is wrong."
What's wrong about it and why.
Now, they don't have to agree with you,
but lots of time, they will.
I've gotten this multiple times and usually,
I get them to take off whatever is on there
or they'll give me some reason why they can't take it off.
Basically say this is not me.
This is not my information.
Somebody stole my information.
I never had this account.
I have no idea where this account came from.
I didn't buy this product. I paid on time.
Whatever it is. You can dispute it.
They should also give you another copy of your credit
report if they change it.
Now, there are two other things you can do
if you think your credit report looks weird or funny.
Actually, there are three things,
but two we'll talk about here.
One is you can place something called a fraud
alert on your report.
Now, fraud alert is a concept that dates back about 15 years
to the first day of identity theft,
when we first heard of identity theft.
I'll talk about it more in a minute.
It's sort of the first line of defense
to reduce the likelihood that somebody else
will be trying to open credit in your name,
which you're going to be worried about
if you're seeing odd things on your credit report, right?
Essentially -- and I'll explain what it means in a minute.
The other thing you can think about doing
if you haven't done it is you can look at placing
a credit freeze on your credit report.
You've already heard that talked about.
We'll come back to that in a minute.
You can also, under the law, actually block
certain information on your credit report --
that's the third thing, that you believe is inaccurate.
And if you want to do that, I'll tell you how to go about
doing that later in my presentation.
So those are three strategies you have.
One, fraud alert, if you're worried
that somebody is using your information.
Two, block information that you think is inaccurate.
I'll tell you how to find out more about how to do that later.
Or three, just make ti really hard for anybody
to even get access to the report or using credit freeze.
We'll talk about that in a minute.
Oh, by the way, also contact the companies
whose names appear on the report that you think are wrong.
Let him know because lots of times,
you'll find they didn't put it on there or for some reason,
they appreciate knowing as well.
So let's talk about the two key things
I just mentioned: fraud alert versus a credit freeze.
We've already heard credit freeze.
You heard security freeze is the other word
[Indistinct] used. So what's a fraud alert?
A fraud alert is something that says
if you think your credit --
if you think you're a victim of identity
theft or misuse of your credit,
you can actually put a note on your credit report
that warns anyone who might be using it
that there's somebody out there who may be trying
to use your credit information.
It requires creditors to take "reasonable steps"
to verify the identity of the individual if somebody comes,
walks in and tries to apply for credit in your name.
So if Chuck Harwood,
who has a fraud alert on his credit report,
later goes and applies for credit at Zales Jewelers.
Zales is required to take reasonable steps to confirm
that the person who is applying for credit
is actually the real Chuck Harwood, not an identity theft.
Now, reasonable steps mean they're probably going to ask
for additional identification from me, that sort of thing.
That's all it does.
It doesn't work 100 percent.
I can attest to that because I've had alerts on
and had credit opened at times.
But it is a first line of defense,
and it will put a lot of [Indistinct]
merchants on notice to be careful about granting credit.
As you'll see in [Indistinct], it's less effective than others.
I'll explain why in a minute.
It only lasts for 90 days, although you can extend it
easily enough, up to seven years at a time.
But it's a useful first tool, and when somebody says to me,
"I think I've been a victim of identity theft, what do I do?",
I say step one, put a fraud alert on your credit report.
That's what I did when I was the victim of somebody
who was opening new credit cards in my name in Hyattsville,
Maryland two years ago, and it worked somewhat.
But it's at least a first step, and it reduced the chances.
Plus, it gave me credibility
when I contacted the financial institution
and said it's not me that's doing this.
Second, credit freeze.
A credit freeze is a critically important tool
that is becoming increasingly common throughout the country,
including here in Washington state.
With a credit freeze, you essentially make it
so that no one can apply for new credit in your name.
It doesn't matter.
There's no alert.
The report can no longer be used
as a basis for applying for a credit union.
They can't get a copy of the reoprt to be used
when they're considered credit.
It's more effective, right?
There's not a judgment call in part of the merchant.
They just can't use that report to consider you for credit,
and it's not available.
It's not possible.
Now, the challenge with credit freezes
has historically been [Indistinct].
First of all, they're offered separately
by each of the three credit reporting agencies.
With an alert, you can call [Indistinct]
credit reporting agency, and they'll notify the other two.
With a freeze, you've traditionally have had to call
all three separately.
It's a state law, so the laws are varied to state to state.
Also, they cost money.
Most states have written a law that says you have
to offer a credit freeze.
In fact, I think 47 or 48 states now
have some kind of a credit freeze law,
but in most cases, they have written into the laws
and allows the reporting agency to charge a small fee each time
a freeze is imposed or taken off.
So some cost.
And then also, it can oftentimes
make it challenging for you to apply for credit
if you're trying to do it quickly on short notice
because the merchant won't give you credit
if they can't look at your credit report.
So those are some challenges with it.
But for many people, the cost has been the biggest issue.
So just to [Indistinct] and this is what I said.
I've gotten redundant in here in a few places.
[Indistinct] slides to review again,
credit freeze or security freeze
as we call it prohibits credit report agencies
from releasing your credit report or your credit score
without your authorization.
There are state laws that actually set it up,
and there's some special procedures
for how to freeze and thaw.
Here's the good news, and both Doug and [Indistinct]
reference this: there's a new state security freeze law,
and it's called the Security Freeze Law in Washington state,
which I think has been talked about some.
But I'll just give you -- here's my quick -- I read it.
I looked it over last --
truthfully, last weekend and summarized it in this slide.
I think I've got it pretty well nailed down here.
Essentially, the new state law prohibits the [Indistinct]
of credit report for use to determine
eligibility for credit.
Now, it won't necessarily apply to all kinds of identity theft.
As I said, there are probably 30 different kinds,
but it applies to the one that most of us
are most worried about,
applying for credit or financial benefits in somebody's name.
Once you ask for the new state security freeze to be replaced,
it has to be input and placed within 5 days.
It remains in place until you request that it be removed.
It has to be removed within three business of days
of receiving requests for removal from the consumer.
In addition -- now, the [Indistinct]
so that's the first piece. The second piece, you want
[Indistinct] traditionally been if you want to go out
and buy something for yourself on credit,
and you've got a freeze on, that can slow you down.
Which might be a good thing, but sometimes, it's frustrating.
The new state law says that there has to be a process
in place that basically allows you
to temporarily lift the credit freeze,
either if you want to do it in writing within three days
or the law also says
that there has to be a way to electronically lift it
within about 15 minutes of receiving a request.
Now obviously, there's some issues with that,
but that's the second piece of the state law.
So quickly lift it if you need to.
It also says that each of their reporting agencies
have to set up a secure way to lift
and reimpose a freeze using a PIN
or password process of some kind.
And then, here's the other key piece: it is free.
Unlike in the past, where you can pay $6,
$10, whatever.
I don't remember what the Washington state one was.
I was in Idaho yesterday and for Idaho, it cost $6.
It still costs $6 per instance.
It's going to be free, and it goes into effect on June 7th.
So as we've already heard.
So if you are thinking --
if you have a credit freeze already, congratulations.
You're ahead of the game.
If you haven't done one yet come June 7th,
you can get one for freeze.
This is time to think about that.
The only qualifications I would say
are if you are somebody who is going to be engaging
in large credit transactions
soon, you may be getting a mortgage soon,
something like that, maybe you want to wait until
after apply for your mortgage before you get the freeze
because it will restrict the ability of people to get it.
I'm going to run out of time here,
unless I speed it up a bit.
So this is my protection tips thing,
which you've already heard from others about what to do
with regards to your credit information.
Review your credit report, consider a security freeze,
fraud alert if you've been a victim,
a couple of other things.
These are important for everybody.
Check your bank.
Check your credit card statements,
your bank account statements carefully every month.
Don't ignore bills just because
you're not sure where they came from.
Shred information. Change your passwords.
File your taxes as soon as you
can because we continue to see some people
who are filing fake returns in other people's names.
So that's my credit presentation.
Now, the second assignment I got from Doug,
which is also important -- again, this is about information
and it's about that huge mass of information out there
that is about us.
This is social media, and you know what social media
is because you've probably dealt with it.
It is things like the entities
that are on the screen in front of you.
Snapchat, Twitter, Instagram, YouTube, Facebook, LinkedIn.
Those are all social media platforms for accounts.
They are online services or communities
that allow individuals from organizations to connect
with one another and share information, ideas,
photos, video, comments, et cetera.
Did we do a Facebook hand raise?
I already see who's on Facebook. Let do it again.
Who is on Facebook? I know I am.
Yeah, okay. So a lot of us are.
I can tell you that Facebook is an amazingly useful tool,
if you haven't been on it.
My mother follows it constantly because that's how she keeps up
with her grandkids, photos, that's kind of thing.
She loves it, and I love it
because she's able to do that easily.
It's a useful tool, and we know about
Twitter because it's been in the news a lot lately.
I'll stop there.
YouTube is a great tool for watching videos
of various kinds.
Instagram is a way --
particularly that younger people use for sharing photos
and can be distributed quickly.
I'm sorry, Snapchat is.
Instagram is another way of sharing photos.
LinkedIn is a great networking tool,
particularly in the professional world.
I know a lot of people at AARP use LinkedIn,
and I'm on LinkedIn partly because it allows me to keep up
with a lot of my work colleagues around the US.
There are actually different kinds of social media platforms,
and it's useful to know what the differences are
because that tells you something about the kind of information
that they collect and use about you.
So here are different kinds.
The first kind, we'll call them social networking platforms.
These are ones that they're basically about --
they're essentially comparing notes, looking at pictures,
keeping up with friends and neighbors.
They include Facebook, LinkedIn and some other ones.
I don't remember what the F1 [Indistinct].
Does anyone remember what that F1 out there is?
There's got to be somebody that used that one.
No? What is it?
Well, Snapchat is up there,
but what's that one with the weird F, the red one?
Anyway, I can't remember. Foursquare, thank you.
Yeah, Foursquare. Foursquare, thank you.
I knew there would be somebody that knows.
Foursquare is the one that allows you to sort of check-in
and let people know where you are.
You can let your friends and neighbors know
where you're at in a particular location.
You can tell I don't use all these.
I do use two or three of the four
that you're going to hear about.
Second thing is microblogging.
They include Twitter obviously, and again,
I'm blanking on what the T one is.
What? Tumblr.
Thank you. All right.
There's a social media expert in the room here.
Thank you. Tumblr is another one.
Again, it's a microblogging one.
It allows people to do short entries.
You've seen Twitter probably.
It essentially allows you to make short entries
about whatever you want to talk about.
It's an equally useful tool.
Now, we're going to test my knowledge of some other symbols
I again don't remember.
Okay, we've got Pinterest, which is the P,
and we've got -- what's the two dots one there?
Test again. Anybody?
Okay. Nobody knows that one.
It's out there someplace.
Anyway, these are all photo-sharing ones.
And these are ones that allow you to share photos,
pictures, whatever.
That's another kind of social media platform,
so we've now seen social media.
We've now seen short blogging type ones.
We can share views.
We've now seen share photo ones, and there's also video sharing.
The last two are Vimeo and YouTube, obviously,
and they can share short videos.
So there's different kinds of social media platforms,
and they collect different kinds of information
because of the way they work.
So almost all social media platforms though raise
a variety of questions about the things they collect.
I listed up here four different, common issues
that we see at the FTC,
and I'm going to pull out my notes for this
because I've already demonstrated
that I'm not a social media expert in all respects.
I've listed up there some of the things that we hear at the FTC
a lot when it comes to social media platforms.
First of all is people say what kind of information
is a social media platform collecting?
I've already talked about the amount of data
that week now that website collect.
Social media platforms collect that much and more.
They are huge consumers of data.
If you think about it, whatever you put on Facebook,
arguably Facebook is collecting all that information.
Whatever you're putting on Twitter,
Twitter is collecting all that information.
So vast amounts of information.
Secondly, social media platforms make it possible
to share the information that they collect about you.
They can share it either because you choose to let them
to share it -- actually,
they should only share it when you choose to let them share it,
but they may actually ask you
how you want to share it in a variety of ways.
Recently, for example, we know Facebook has been in the news
because it's set up a system
where it was sharing information with advertisers.
And while consumers may have been agreeing
to some of that sharing, it wasn't all that clear
how they were sharing the information.
We'll talk about that in a minute.
Secondly, social media platforms,
particularly as they moved to the mobile space, cell phones,
it had become much more effective
in what we call geotagging.
Geotagging is a process
that essentially allows a social media platform
to identify where you are at any particular point.
Oftentimes, you'll find geotagging particularly,
but Foursquare would have it.
You'll find on most of the photo apps.
So if you take a picture,
it will actually identify where that picture was taken.
That's called geotagging, right?
It's identifying where you are and where you've been.
There are a variety of ways geotagging works,
but that's essentially the way it functions.
Third, facial recognition.
Again, something we see in particular in the photo area,
but you'll see it on Facebook as well.
There are various flavors of facial recognition.
The simplest is one that simply identifies a face in a picture.
A little more complicated,
it can identify the emotions of a face in the picture.
A happy person, sad person.
It may be able to identify who that specific person is,
based on past similar pictures of that person.
You'll see Facebook do this as well.
It's actually saying, "This is Chuck Harwood
because here's another picture of Chuck Harwood,
and it matches that picture."
So it can do facial recognition to that level
and may even be able to do more than that.
And then finally at the FTC,
we worry a lot about children's privacy
because kids spend a ton of time on social media.
I won't spend a lot of time on that now
because I'm hopefully not going to speak
a large audience of kids here,
but essentially, here's what -- if you have grandkids,
here's what to know about that briefly -- or kids.
It essentially requires that if a child is 13 or under,
there are specific rules in place
about the required parents to be involved
and deciding when they can share it
and when kids can share information.
That's something called the Childrens
Online Privacy Protection Act.
So if you are a parent of a --
or a grandparent of an under 13-year-old,
13-year-old or under,
just know that there are going to be specific rules
that should be applied in regards
to childrens websites or website
that they know children are spending a lot of time on,
to ensure the children are not oversharing
without -- they're not sharing at all
without parents being aware of it.
That's basically the four things we worry about
with regards to social media and some areas.
So let's talk about how to find out more
about what's going on in the social media sphere.
This is Facebook again, and it's pretty easy to figure out --
it's easier than it used to be to figure out what information
some of these social media sites have about you.
They're getting better at it, but the trick
is you have to spend some time on the site looking around.
For example, I pulled this off Facebook last weekend.
Facebook has been changing the way they interact a lot,
in large part because of recent questions about what they do.
But they have a whole section on your profile and your settings.
Now, how do you find this?
You start by looking for --
look for information about profile and settings,
look for information about privacy.
You can close on those,
and it will actually take you to information --
if you're signed on, taking information
where it tells you what they're collecting about you
and how they're doing it.
It's interesting because we actually try to write a go-by
for this program today about how you can actually
look up specific information on Facebook.
While we were writing it, they changed the way they do it.
I can't give you an exact go-by.
All I can tell you is go on the site,
look for words like profile and privacy and start from there.
With Facebook, you can start with their help center,
which is a little -- by the way,
this is a PC version of Facebook,
but the mobile version, which I think more people
these days may use than the PC version,
has some similar functions in a similar way.
You go to the help center, and you'll see I popped this up,
and this is a screenshot from my own Facebook account.
You'll see you can do a privacy checkup.
That's probably where you want to go
because that will tell you more
about what information it is collecting.
Privacy shortcuts essentially takes you
to various places in Facebook and tells you more
about the kind of information they collect.
You can go through them and make settings changes
based on what you want them to collect,
including things like
who you want the information shared with.
You can look at how your website appears to other people.
You can look at a range of other things related
to sharing of the information.
Not just Facebook has privacy checkup options,
you can do this in other things. Do it with Twitter, same thing.
Again, this is hard to read, I know.
This screenshot, I pulled up yesterday or two days ago.
Again, you can -- I'll just tell you what it says.
On this, you can select, again, privacy and safety.
Went to the site and looked around, found this.
You can control who sees your tweets.
You can see whether the tweet actually include
geotagging information or not.
You can decide whether you want to be tagged in photos
that people take on Twitter or not.
You can decide whether you want people to be able
to see your e-mail address when they look at it.
Oh, and by the way, let me go back to Facebook
for a minute first.
I'm going to not to back [Indistinct].
As I mentioned, Facebook oftentimes
in particular shares information with advertisers through apps.
When you sign up for Facebook, you may --
when you sign up for another app,
you may actually be offered the opportunity to sign
on using your Facebook account.
Facebook uses the apps.
You can actually in Facebook, though,
if you dig through the privacy things,
you will see there's actually a way
we constrict the information provided to those apps.
You can see which apps are currently receiving information
about you from Facebook.
So if you're concerned about that piece,
take a look at that as well. It's an app --
instead of app settings within Facebook
that says share information.
Currently share information or here's the information
that you shared in the past, or here's information
that you're not longer sharing at all.
But you can actually go back and work through that as well.
So LinkedIn, same thing with LinkedIn.
Again, set up privacy settings. Spend some time on it.
You'll learn more about what's being collected
and maybe about what you're sharing.
But it's useful to know because you want to know
what information is being shared about you with advertisers,
friends, neighbors, the world at large.
Pinterest has the same thing.
Account information and sharing
that information, stuff like that.
So the FTC has field a variety of cases
against some of these social media sites.
We've sued Twitter. We've sued Facebook once.
Who knows what's going to happen in the future.
We've sued Myspace.
We've sued an online dating site called Ashley Madison.
We've sued Snapchat.
Most of them were making a variety of promises
they didn't comply with.
Facebook, for example, promised it wouldn't share data
with advertisers when it was,
in fact, doing that and had some other promises, too.
Twitter actually just was following
really sloppy data security practices.
Ashley Madison, they were not deleting stuff
when they promised they would.
Snapchat, not deleting photos they promised they would.
So a variety of different lawsuits,
and we continue to bring lawsuits in that area.
I'm going to wrap up really quickly here.
So I now have given you sort of a quick summary
of two different areas,
and I want to talk about why some of this
is important to you, even if you're thinking,
"I don't spend that much time on social media.
I don't care much about it."
Or I'm not going to spend time doing this.
Here's why.
A lot of the fraud reports that the FTC saw
in the last year or so --
and this is actually the number of reports we saw last year,
about 1.1 million fraud reports.
A lot of them involved a variety of kinds of crime
that utilize or misuse the data
that's been collected from consumers.
Now, this is actually a breakdown
of the number of reports total we received last year.
Debt collectors, number one in the [Indistinct]
and that's a separate topic,
but identity theft is the second most common fraud report we saw.
A lot of data misuse going on there,
and third, impostor scams.
That's the tech support and other things you've heard about.
Again, a lot of data misuses associated with that.
So a lot of the complaints we're seeing these days
involve access to and use of that valuable data
in ways that harm consumers.
In fact, in the impostor scam thing,
we heard about the tech support thing.
One in five people last year
who reported they've been a victim of an impostor scam
actually reported to us they lost money in that scheme.
[Indistinct] Ferguson talked about the iYogi case.
That was a tech support scam case
that the Attorney General of Washington filed.
A great case, really a leading edge case
at the time it was filed.
So a lot of money lost.
Nationally, in that kind of case --
and in similar cases, we saw $328 million
reported lost in the last year, misusing consumer information.
By the way, Washington state, if anything,
is worse in some respects.
So this is actually Washington state.
It is a little hard to read, a little blurry,
but I can tell you.
Remember, nationally, debt collection
was the number one source of complaints.
Here in Washington state, impostor scams
are the number one source of complaints.
That's misusing data and using data to fool people
into thinking that you're somebody you're not.
Identity theft was number two and debt collection
was number three.
A lot of losses in Washington state last year,
and identity theft remains a high --
Washington is 16th in the country
in terms of identity theft.
So it continues to be a huge problem.
So I'm going to wrap up real quickly.
There's the old version of identity theft,
the retail version -- steal a wallet,
steal mail, that kind of stuff.
That's old stuff.
Still done, but the more effective way to engage identity
theft now is through data breaches
and through theft of information that way.
So I've already talked about this.
Data breach, I'm going to wrap up with a brief comment
on about data breaches. I know I'm over my time.
But I actually have a video I want to run if I may,
and you've all heard about the Equifax data breach.
There are lots of other data breaches.
Bob, Attorney General Ferguson talked about all of the data
breaches that Washington state has seen.
The state has gotten really aggressive
in dealing with data breaches.
Here's a little consumer ed video
that will give you a sense of what to do
if you learn you're a victim of a data breach.
-Yet another data breach is making headlines,
and this time, your information is exposed.
What should you do?
First, take a deep breathe,
then visit identitytheft.gov/databreach.
You'll learn what specific steps to take.
For example, if your Social Security number was exposed,
you'll want to order your free credit reports
and check for accounts you don't recognize.
If a company affected by a data breach offers you free services,
like credit monitoring or identity theft insurance,
take advantage of it.
You also might want to play a credit freeze or fraud alert.
That'll make it harder for an identity thief
to open new accounts in your name.
If you find that someone is using your information
to commit fraud,
identitytheft.gov can help you report that, too.
Find out how to recover from a data breach
at identitytheft.gov/databreach.
-Okay. So you just heard it summarize
pretty much everything we talked about, right?
If you believe that through identity theft or a data breach,
you're a victim of some sort of breach,
the place to go is identitytheft.gov.
This is a federal government site
created jointly by a group of federal agencies
at the direction of the previous administration,
and it's a highly useful site
that's got lots of great info in it.
It includes a series of go-bys including how to file
[Indistinct] reports.
It includes ways to work on recovery
if you been a victim of identity theft.
It includes what to do in specific situations,
including for example,
if you're affected by a specific data breach,
like it has information on what to do
if you believe you are affected by the Equifax data breach.
You can actually go on there,
and it will actually walk you through.
Same thing for a Yahoo data breach.
You'll see that on there as well.
So a great resource if you're worried about data breaches.
We've talked about impostor scams plenty --
I don't want to spend much more time on that other
than that is an example of misusing data,
little amounts of data, social media, whatever stuff,
that entices you into paying money
or to give additional data.
I am probably out of time.
These are basically yet again more reviews about what to do
if you believe you've been a victim,
or want to protect your credit
or want to deal with other issues.
Check out annualcreditreport.com.
Review statements.
Consider a credit freeze.
Remember, Washington state has a new law.
Keep that in mind, and then finally,
with regards to digital information,
Doug has already talked about this stuff.
Strong passwords, secure sites.
Be careful about links.
We talked about links, and adjust your privacy settings
and things like the social media platforms
we were just discussing.
And I am done.
I think I'm out of time, but thank you.
-So, Kyle, talk a little bit if you wouldn't mind about
just monitoring accounts.
What is your take on --
how can we better monitor our accounts?
We've been talking about that all morning.
You want to just give us your take on that?
-Yeah, absolutely.
So it's been a lot of good information.
I was actually worried I wasn't going to be able to bring
anything new to the table up here this last session,
but I know there's a lot of online banking users.
Even if you're not a BEC member, that's fine as well.
But a lot of financial institutions now have
what's known as account aggregation services.
So you can look through online banking or mobile banking
for your financial institution.
You can actually link your other accounts
from your other institutions, other credit cards.
So it's kind of a one place to go instead of having to log
onto multiple sites each day or each week.
And you can actually look at the transactions there,
kind of all reconciled across all the accounts.
Set up alerts on the various accounts and transactions.
My wife has those alerts
set up for anything above basically zero.
She said it's for monitoring fraud.
I'm not sure that's entirely what it's for,
but it's very effective,
and it's actually just a great example of using technology
to actually assist you as well. -Excellent.
We're just going to keep going down the line.
Jeff, as soon as we've got you there, I had a question.
This could have been my question.
"How secure is the cloud?" -What do you mean by the cloud?
-The cloud. What is the cloud?
We didn't talk about that [Indistinct].
-Yeah, that's a great question.
Secure.
-Okay, that's it. Thank you.
We're moving on now.
-So that's a fantastic question
because there's a little distrust obviously.
The cloud is a relatively new phenomena,
and we've seen both commercial
and consumer services really explode,
I guess, in the last couple of years,
making it [Indistinct].
Certainly from a Microsoft perspective, we [Indistinct]
the cloud as the most secure option.
Why? Because all of the services
that you would be trying to manage locally,
whether it's protecting your computer from viruses
and attacks and scams and things,
to the core infrastructure and service updates
that will fix critical vulnerabilities,
the cloud does that all for you.
You don't have to control or worry about anything locally
when you put your data or services in the cloud.
-What is the cloud? Some of you are thinking that.
-So... -What is the cloud?
Is it just a big cloud, or is it a --
Are there variations, like some
is a rain cloud and another is a, like --
-So around here it's nice because,
technically, we have lots of clouds.
-Yeah!
Like, is there more of it in Seattle, or --
-In a lot of ways.
So, yeah, the cloud is a very complex environment, right?
There's lots of services and lots of different things
occurring in the cloud,
but, in general, you can think of it as,
where processing and logic and data storage
is happening on data centers and services around the world.
-Yeah. Is it --
Well, I just think of it as, like, back it up the cloud.
-Sure. From a simple backup,
data storage perspective, it's very handy.
-That's one thing that it does.
-And I didn't touch on it too much,
but now, if you're talking about, like,
a file storage backup where, like, Microsoft has OneDrive,
and there's a lot of other services that,
those technologies can, for example, provide versioning,
which is a way to kind of battle ransomware a bit.
So, if you're storing your files
on a cloud service that has versioning,
you can typically go back 30 days and recover it.
So it provides some tactical benefit, too.
-Great, excellent.
Well, Monique, here, next.
Thank you for coming, and I just wanted to ask you,
you are a fraud investigator?
This is cool.
What kinds of identity theft are occurring
in a local area right now?
Right where we live here.
Can you give us just a sense of --
without divulging any secret investigations
you might be doing, there. -Oh, god.
We have no secret investigations.
Trust me, and if you do bank at BECU --
-Speak closer to the mic, or -- maybe --
-Is it on? -Just speak closer.
-So we don't have really any secrets.
-Okay.
-Although, we do maintain our victims' secrets,
and just a plug for BECU, if you do bank with them,
they're fabulous if you are ever impacted
as an identity theft victim.
So, basically, what we see are account takeovers.
We see someone using your personal information
to go out and do title --
anything from title fraud to credit card fraud,
or if you pay with -- if you pay bills with a check.
Do you pay bills with a check?
-Yes. -You do?
So we're mailing those at the Post Office, right,
because we don't ever put anything in our unsecured,
and we all have secured mailboxes.
That means it's a locking mechanism, some type of barrier
between someone just opening your box
and accessing the content --
-How many people have -- Excuse me.
How many people have locking mailboxes?
-God, please, everybody,
raise your hand. -Okay.
-And for those of you who didn't raise your hand,
and maybe it's just because you didn't feel like it,
but if you -- it's --
but if it's because you don't,
they sell them relatively inexpensively at Home Depot.
They're very accessible.
I would encourage everyone to go get one
because mailboxing is a true crime,
and a lot of the ways that people obtain your information
is by stealing your mail.
So if you're expecting checks or, you know, whatever it is
that you're expecting that might have
any of your personal information on it,
that's how you --
That's a potential portal to being victimized.
So we see everything.
We see people who take your checks
that you send out in your unsecured mailboxes,
if this doesn't help you get one.
They wash those checks, and at the bottom of your check
is your account number,
so then they just create additional checks
with your account number on it,
and so, I mean, just something as simple as that, right,
that could be avoided.
Up to, you know, something a lot more sophisticated
as buying your information on the dark web and taking it
and using it for their own personal financial gain.
-Great, thank you.
So, Kirk, Social Security.
The simplest question I could ask, I think,
is, how do people protect their --
I mean, people really worry about this,
especially here, our people,
about their Social Security account.
Could you talk a little bit about how you can secure
your Social Security account?
-Certainly.
One of the main ways that I would encourage people
is just to protect that Social Security number.
You know, don't carry your Social Security card with you.
Don't willfully just give it out for any reason.
If somebody is asking for that number,
you want to determine why they need that.
If you don't give them that number,
what are the consequences?
Just, really, protect that information.
Don't let it get out to the public.
It doesn't need to be used for many different things,
but you'll have all kinds of groups
that want to get that information.
Also, just beware of scams.
You know, you might get calls from people
wanting that information, saying, you know,
"We're with the Social Security with --
We're doing an investigation with the Police Department.
Someone might be using your number.
We want to confirm that this is your number."
Just beware of different fraud attempts.
It's even funny -- You know, we were talking about
the impostor scams with people calling up and saying --
You know, people are using their computers.
They even call government phones,
and I've had someone call my government phone
with the Social Security Administration
and say they're with the Social Security,
and they want to verify my Social Security number.
-Oh, boy.
-So get to have lots of fun with them
and ask them, "Oh, really? What office are you in?"
-Have you called the wrong person?
-Really?
So you just really need to protect that information.
Another good way to work with Social Security
is to open up an individual my Social Security account,
and I recommend this for two reasons.
Number one, if you can go online
and you open up your individualized
my Social Security account,
you can directly interface with Social Security,
meaning that you don't need to go into an office,
you don't need to call us,
but, by having that individual account,
you can directly work with Social Security
if you need to change your address,
change your phone number, change your direct deposit,
if you need to get benefit verification letters.
This just prevents fewer items that need to go through the mail
and end up in your mailbox,
you can actually do directly online,
and, of course, when you do open up
the my Social Security account,
there are a number of levels of security
to protect that account, as well.
So that's one of the better ways to protect yourself.
-Great. Thank you.
Kyle, we have a bunch of questions here.
We're not going to be able to get to all of them,
but what do you think the biggest mistake is
that people make when it comes to putting themselves at risk
just in terms of your general knowledge of security?
-In general?
I think oversharing on, like, social media
and even non-electronic formats
because, at the end of the day, that's --
You know, the bad guys are just looking for those --
that information about you, whether it come from your mail
or come from your Facebook account,
or, you know, I think --
The downside is, or the challenge is that humans,
by nature, are actually very social
and they want to share, except for me.
But I think that, you know, there was, like,
a lot of good tips in the previous presentation
about looking at your Facebook settings.
I think Facebook is probably the --
primarily the largest social network being used,
but, you know,
they have actually made some changes recently,
so you can actually look at your profile on Facebook
as someone who's not a friend of yours
and see if you're actually maybe sharing a little bit too much,
like your cell phone number, your e-mail address,
kids, grandkids' names,
all things that actually could be used
to socially engineer you.
-Good answer.
I don't know who this is for, but I want the answer to this
because I travel on airplanes a lot.
Can your information be sucked out of your phone
when you recharge it on an airplane?
That's actually a good question.
Does anybody know the answer to that question?
You guys are all, like, security experts.
You know how -- You know how they --
You can plug it in now, which is good, but --
-I'll take a stab at that. -Yeah.
-So, me being an information security professional,
I do charge my phone on a plane,
but I don't use the USB plug-in, I use my own plug-in.
Plug that in, and then plug the cable into that,
and that -- Whether that's an airplane,
whether it's a free charging station anywhere --
-Does that block the information on your phone
from somehow going into this cloud?
-Cloud. -Yeah, I was thinking that, too!
-It does. Even though most --
-The cloud. I mean, you're on an airplane.
-Even though most phones --
I mean, I don't want to get too technical here,
I mean, there's a lot of settings that, you know, let --
The phone will pop up and let you know if you're
granting access, but, you know, all the bad guys out there,
they've figured out how to go around those.
So I -- Personally, what I tell everyone,
I don't use the USB charger.
I use my cable, plug it into an actual power outlet
and charge it that way.
-Okay, great.
-And that's the same for rental cars.
-Go ahead. Oh, rental cars, yeah.
Talk about rental cars. -Right.
-And so that would be the same, like,
if you're going somewhere and you rent a car?
Don't ever put your phone -- Like, use the USB
in the USB port in the car because that just puts
all of your personal information into that car.
That's just one big computer.
-Wow, see, that's a good tip, too.
-Well, actually --
There's actually, probably, one more step on a rental car
because a lot of them now have Bluetooth,
so you can connect your phone via Bluetooth,
get your contacts in there.
Don't allow your contacts to sync with that car.
Unless, when you get done using the car
you're going to actually delete those,
which is a few extra steps, but, yeah, do not let --
I encourage you not to do that.
-Let me have that real quick.
I don't want to pile on too much,
but, fundamentally, the reason is,
that USB cable and cord is a data exchange service, right?
You're connecting it, logically, to something whereas,
if you take and use a normal wall charger,
you're turning into a current exchange versus a data exchange,
so that's the difference. -Oh, okay, there you go.
Yup, yup, yup.
We'll stick with you for a minute, Jeff.
-Oh, okay. -Talk about the effectiveness,
or lack thereof, of having separate credit card
not linked to main accounts to use for online purchases.
I've -- Is that a good idea?
To have a dedicated credit card that, you know,
the only thing you use it for is Internet purchases.
-Yeah, I don't think
that's a bad idea. -Yeah.
-It certainly gives you some opportunity to control
that a bit better and know what's out there
because you've limited the exposure to,
you know, one account or one device.
I don't think that exclusively protects you from everything.
-Yeah.
-Did you want to -- -Yeah, I'll take it.
-Yeah. You might have something.
-Yeah, I think there's another convenience factor, though, too,
because I think having a separate card
for online purchases is a good idea
because it's a little bit easier to track, per se,
but the other piece, too, is if you have --
If you've got a credit card
and you're putting all your household things,
kind of recurring charges on there
and that card does get breached, it has to get replaced,
it's a big pain to actually go to all those different billers
and actually swap that out.
So it's something I hope that the financial industry
actually figures out how to do better in the future,
but we're not there yet.
-This is, is the credit freeze --
if one reason is, quote, "AARP told us to do it,"
or is it only free if we suspect
that our ID has been compromised?
So, I mean, you can freeze your credit
without having it compromised.
I think the distinction Chuck was making is,
before this new law goes into effect June 7th,
if you had your identity stolen, you could file a police --
And, maybe, Monique, you can comment on this,
you file a police report,
and then you can have it frozen for free.
Now, it'll be free regardless.
You want to talk a little bit --
I wanted to ask you, Monique, too,
about just the importance of reporting in general,
from your standpoint.
Maybe not just so that you can get
a free credit report, but just in general.
-Well, you can get your free credit report,
and I encourage everybody to do so and examine it anyway,
but it is extremely important that you report
even if there's just one breach.
Like, if you have one credit card that had one charge,
regardless of the amount of the charge,
because you don't know what else happened with your information
or how that person obtained your information.
So any time you feel like you are --
or you can confirm that you are a victim of identity theft,
definitely call the police.
-Great. -And file a report.
-I have one for Kirk. Kirk, we --
I know we've been doing some education on this,
but I understand the new Medicare cards
are being issued and sent out,
and they don't have the Social Security number on it.
You want to talk a little bit about that
and what the potential is for scammers to,
you know, call and say, "Hey, pay me
some money and I'll give you your Medicare card,"
that kind of thing. -Certainly.
And this really is more of an initiative for Medicare itself.
A lot of people don't realize this,
but Social Security and Medicare
are two separate federal agencies.
Medicare has its own website and its own 800 number.
So if you have any questions about Medicare,
how Medicare works, what's covered,
what's not covered,
you want to go ahead and go to Medicare directly,
and they actually have the lead on doing this,
changing out the Social Security
number off of the Medicare card itself,
and that's something that's been in the works
for a number of years to go ahead and accomplish.
Now, in -- What they've basically told us about is that,
you may be getting callers to your 800 number
asking questions about this because they're expecting
and they've already had some individuals that have said,
"Hey, we're going to be sending out a card to you.
It got returned to us.
We want to verify that we sent it to the right address.
What's your address, and what is your Social Security number,
just to verify that this is really you?"
Well, Social Security and Medicare
are not going to call you directly
for those types of situations,
and they're certainly not going to ask you questions
about your personal information.
We already have all that information,
so we don't need to get that from you.
So you do need to be very careful with that.
This Medicare switch-out
is going to be going on for a little while.
We didn't send all 45 million cards out at one time,
or, I should say, Medicare did not send out
all the 45 million cards at one time,
so this is going to be something that's going on for a time,
but you should check your mail
and make sure that if you get a letter in the mail
that has a new Medicare code, if you do have questions,
you can certainly call Social Security
or you can call Medicare just to confirm the information.
Look those numbers up.
Don't -- If you're getting something in the mail,
don't always trust that the number
that's on the letter is the correct number.
I would go online and make sure
that you're going to socialsecurity.gov
or to medicare.gov and getting the accurate,
most up-to-date information.
-Great, great.
Be thinking about any other questions.
We got a couple more minutes.
I just want to ask one last question to the panel,
and, Kyle, maybe you want to take this, or Jeff or somebody.
How safe are public library computers?
-They're not.
Yeah, that's a great -- and I was going to mention that.
Do not use a free computer to do any of your banking,
you know, anything like that because they're --
Literally, they are not safe.
-But, I mean, you can --
You can do certain things on them, right?
They're not -- I mean, bad guys aren't going to come
and take you away if you're on a public --
-No. -It's the issue of public
Wi-Fi, and --
-But any -- I guess the metaphor would be,
any information that you're entering in,
in that free computer,
whether it's at a library or an airport,
if you're comfortable leaving that same information
lying there on the table, go ahead.
-Yeah.
-But if you're not, then don't. That's --
-So for a long time we've talked about --
The other question right next to that is,
"I go into Starbucks, or some other place
where there's public Wi-Fi. Is it safe to use?"
The security experts are all no,
but I'm sort of a security expert,
and I use it, but I never do -- But I never do -- you know.
I mean, to your point, I'm not doing my banking on it.
You want to talk about that a little more?
-Yeah.
Obviously, we all have our own personal thresholds of risk.
-Very diplomatically put, Jeff. -I would not be, for example,
doing my banking through a local coffee shop's free Wi-Fi.
-Right. -Just at a [Indistinct]
my risk level, and I know a lot of people will get online
and browse and do things,
so if you do choose to do that for --
A lot of people work out of Starbucks, right?
That's their home office.
You know, just be sensitive to what you're doing
because, as was stated,
there could be a guy sitting in the parking lot
sniffing the network and exposing your data,
and you don't know what's really going on.
You don't own that. You don't control it.
You know, you kind of trust these providers,
but what you trust them with,
that's really a personal decision.
I know, personally, I don't do a lot of that.
-Yeah. Okay.
Any other questions from the audience?
We have a couple -- Time for two more.
One here, and wait for the mic, if you wouldn't mind.
-Here you go. -And feel --
Direct them to their knowledge group.
-When you're in a hotel and you want to print out
your airline ticket,
is their computer okay to do it on?
-Huh?
Nothing is okay with this panel.
-I don't carry a cell phone to have a thing on
and put it through the airport.
-Why are you even in the hotel?
No, I'm just kidding.
-No, that -- That's a great question.
Personally, I use the app, you know, from the airline.
I think printing -- I mean, it's your username
and password for your airline account at the --
like, typically the business center at the hotel.
-Yeah. -Again, back to kind
of that personal threshold of risk.
Probably okay.
I think the other thing about hotels
that people don't necessarily think about it is,
if you go on a trip and take a bunch of mail with you,
don't throw your mail in that garbage can in the hotel
because they don't shred anything.
-Oh, yeah, yeah, yeah.
-And there's lots of dumpster divers at hotels.
-Yeah.
-Okay, we have another question here.
-We have time for one -- Yeah.
-How effective are virtual private networks,
and do you recommend them for this purpose?
-Good, good question.
VPNs, who's going to take that?
I'm not going to.
-Yeah, you. -Come on, Kyle.
-You might have [Indistinct].
-Describe what it is, though, for -- because --
-Well, it's kind of like that Tor network
that you described early on.
Like -- So it's a --
Basically, it's kind of an encrypted connection,
you know, to the Internet.
So you could go to a --
You could go to the library, you could come here,
use the free Wi-Fi, go to Starbucks,
and that encryption is actually kind of --
It's encrypted one more layer.
So it's -- Using a VPN service is definitely preferred.
Personally, I actually use one.
I have a personal one, and I actually have one
that BECU uses, as well.
So I would actually not have a big problem
connecting to the network at Starbucks with a VPN,
and then doing, you know, whatever I need to do.
So it's -- From a --
It's definitely a very effective additional layer of protection.
-Yup.
-I think we had one more over here.
-Okay, well, you're -- -This gentleman right here.
-People are getting hungry, Amanda
-I know. -This is the last question.
-Well, it's not really a question.
I used to teach this stuff at SU,
but the whole thing about
plugging your cell phone into a charger.
You know, somebody made the comment
earlier that criminals are lazy.
So, I mean, the whole -- While technically it's possible
to suck off that data, it's really difficult,
and so don't worry too much about charging your phone.
The secret is not having a lot of good data
on our phone that's harvestable.
That's the secret. -Yeah.
I think that's an astute point.
The ID thieves I've interviewed,
when you get to these more elaborate schemes,
like man-in-the-middle schemes and intercepting
Wi-Fi networks and driving around
and wardriving and all, we --
You know, those are all theoretically possible,
but are they going to do it when they could just steal
the mail out of your -- Lock your mailbox, right?
-But if I might. -Yes.
-While we all have jobs,
you have to be very cognizant of the fact
that stealing your information is very much these thieves' job.
That is their job.
That is what they wake up to do every day.
That is what they stay awake to do every day,
and they are very proficient.
The ones who are good at it are very good at it,
and they don't keep that knowledge to themselves.
So, while it might be one additional layer of --
or one more step for them to steal it,
there are those very determined people who,
that is their high is stealing your personal information.
-Please join me in thanking our panel: Kyle Wilks,
Monique Avery, Kirk Larson and Jeff Lilleskare.