The Virtual Vault

Stop unwanted junk mail once and for all!

Are you tired of receiving junk mail from companies even after you asked them to stop?

If so, then USPS Form 1500 is the answer. It's simple and free of charge. Even though the form states that it stops sexually oriented advertisements, a new postal regulation opened it up to any kind of junk mail. (The USPS never updated the form).

James Bell

What is "better than bank" security?

Not all computer systems are created equal. Most financial institutions do a fine job at securing your data, but some do not. Any system, including a virtual safe deposit box, that touts “better than bank security” should, at minimum, address these security design flaws:

Break in the chain of trust. Many financial institutions outsource functions, such as bank statements, to a third party. The problem occurs when an account holder is redirected from the bank web site to the third party web site. In many cases, the bank web site provides no information stating that the account holder is being redirected nor is any information given stating that the third party can be trusted. The chain of trust is broken because the account holder has no way to determine if they can trust the third party site.

Presenting secure login options on insecure pages. When an insecure (non-https) web page contains a login and password box, the user has no way of knowing if they will be sent to a legitimate web site after submitting the information. This type of login page is easily spoofed by phishing attempts. The login page should be secured by https in addition to the rest of the web site.

Contact information for security advice on insecure pages. When a failure occurs and a web page requests that you call tech support, the contact information needs to be on a web page secured by https. If not, this web page can also be spoofed with bogus contact information. In this scenario, a phone number can be set up by a hacker to collect personal information, like your social security number.

Inadequate policies for user IDs and passwords. A web site should never use social security numbers, account numbers, or email addresses as a user ID. A web site should always publish its password policy and should never permit weak passwords.

Emailing sensitive information insecurely. Email, in general, is insecure. Your email may pass through several different servers before ending up in your Inbox. A financial institution should never email account statements or password resets. Statements should be downloaded through https. Password resets should be self-serviced or given out on demand by tech support.

Improper firewall configuration. When opening ports on a firewall, a minimalist approach is best. With fewer ports open, a hacker has fewer ways to enter a system. Trojans typically send out information through an obscure open port.

To find out more, I recommend that you read this excellent survey of bank security flaws by the University of Michigan.

James Bell

Report a stolen passport immediately

If your passport is lost or stolen in a foreign country, contact the nearest U.S. Embassy or Consulate. Please visit the U.S. Department of State web site for details.

James Bell

Complete an FTC identity theft report

Report an identity theft to local authorities as soon as possible and obtain a police report. If the local police report won’t take a police report you will need to complete an identity theft report with the FTC.

James Bell

Remove your name from mailing lists

The Direct Marketing Association’s (DMA) Consumer Information  web site allows you to remove your name from mailing lists, email lists, and telemarketer's call lists. You can also remove the names of your children, deceased relatives, and elderly relatives under your care.

https://www.dmachoice.org

James

Stop receiving pre-approved credit offers

Under the Fair Credit Reporting Act (FCRA), the Consumer Credit Reporting Companies are permitted to include your name on lists used by credit card and insurance companies to make firm offers of credit or insurance that are not initiated by you. The FCRA also provides you the right to "Opt-Out" these offers, which prevents Consumer Credit Reporting Companies from providing your credit file information to credit card and insurance companies.

OptOutPrescreen.com is a centralized service to accept and process requests from consumers to "Opt-In" or "Opt-Out" of firm offers of credit or insurance.

James Bell

Place a FREE Fraud Alert with Equifax, Experian, or TransUnion

If you suspect that your identity has been or could be stolen, you can add a Fraud Alert to your credit report. A Fraud Alert remains on your report for 90 days. Fraud alert messages notify potential credit grantors to verify your identification before extending credit in your name in case someone is using your information without your consent.

You may add a fraud alert to your credit report by calling just one of the three nationwide consumer credit reporting companies. As soon as that agency processes your fraud alert, it will notify the other two, which then also must place fraud alerts in your file.

Equifax: 1-877-576-5734; www.alerts.equifax.com
Experian: 1-888-397-3742; www.experian.com/fraud
TransUnion: 1-800-680-7289; www.transunion.com

James Bell

Order your FREE annual credit report

You can request a free credit file disclosure, commonly called a credit report, once every 12 months from each of the nationwide consumer credit reporting companies: Equifax, Experian, and TransUnion.

AnnualCreditReport.com is a centralized service for consumers to request these free annual credit reports.

James Bell