Information Security Tips from Westfield Insurance

Safe vacationing (encore tip)

It's hard to believe that it's almost Memorial Day and that people will start leaving for summer vacations soon. Please take appropriate precautions both before you leave and while you're on your vacation to reduce your risk of fraud and identity theft.

Before you leave:

1. Clean out your wallet.
   • Use traveler's checks or credit cards for payment. Leave your checkbook at home.
   • Leave your debit card(s) at home. Under federal law, your liability is limited if your credit card is misused. If your debit card is stolen, you could lose all the money in your checking account.
   • Take an ATM card that does not have debit card privileges. Your bank should be able to issue you an "ATM only" card.
   • Never carry your Social Security card in your wallet.
   • Leave any unneeded credit cards and any other unnecessary documents at home.
2. Photocopy your wallet and keep the copy in a safe place. If your wallet is stolen, the copies will tell you who to call to get your cards canceled. Note: If you will be gone for a long time, consider leaving a copy with someone you trust who can help you cancel the cards while you're still on the road.
3. Stop your newspaper delivery and have the Post Office hold your mail (or ask a trusted neighbor to collect them for you). The bills and account statements in your unlocked mailbox are a goldmine for an identity thief. And the packages and newspapers piling up on your front step are a sure sign to a burglar that you are away.

While on your vacation:

• Don't leave your wallet, passport or any identifying documents in your hotel room unattended. Use the hotel safe if it's available.
• Keep your identity document (passport or drivers license) separate from your wallet. Carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.
• Guard your credit card receipts and rental car agreements, especially if they contain your full credit card number or driver's license number.
• Use ATMs at banks or credit unions and which are in well-lit areas.
• If you are taking your laptop with you, be very careful when using it for on-line banking and other password-protected services, especially if you are connecting to a wireless hotspot.
• Be equally cautious of cyber-cafes and other public-access internet facilities. Anyone could have left a keystroke logger on the machine in order to capture your ID and password.

By the way, there will be no InfoSec Tip next week. Have a safe holiday.

Credit freeze - defined

Most states have passed "credit freeze" laws, allowing individual consumers to lock their credit reports and, in theory, reducing their vulnerability to identity theft. While the credit freeze is in place, the credit reporting agency may not give out your credit report unless you explicitly grant permission and confirm your identity using a PIN or password. This makes it harder for the identity thief to open an new account or to get new credit in your name.

Even if your state does not have a credit freeze law, the three major credit reporting agencies now offer freezes voluntarily. To institute a credit freeze, you generally need to send a written request to each of the three major credit reporting agencies. The specific instructions vary from state to state. You can find links to each state's instructions at ConsumersUnion.org. The states allow the credit reporting agency to impose a fee to initiate the freeze (usually $5-10 per credit reporting agency but often free to confirmed victims of identity theft) .

If you do freeze your credit report, you will have to lift the freeze whenever you want credit. Under almost all the state laws, you'll have to pay again each time you want the freeze lifted. This can make opening a new account or even changing your existing service more difficult and expensive. When you apply for the freeze, you will be given the instructions and PIN needed to lift the freeze. In some cases, you'll have to lift the freeze yourself – in others, you might be able to authorize the merchant to do it for you. Either way, it will take some extra time. It will also make you ineligible for "instant credit" unless you lift the freeze before going to the store.

The credit freeze laws have implications for businesses that use credit reports for purposes other than lending (such as evaluating underwriting risk). Unless the state law has explicitly carved out that usage as allowed (and many but not all states did for underwriting), the business should expect extra paperwork and several extra steps in the process to get permission to view the consumer's credit report. The law varies from state to state. Check with your corporate counsel for details.

As a consumer, you should also know that a credit freeze will not necessarily keep you safe from identity theft. While most reputable creditors will check your report before issuing credit, some don't. Identity thieves can still exploit those situations, knowing that you will have to pay the consequences. A credit freeze also will not protect you from exploitation of existing accounts.

If you are at increased risk of identity theft and already have a house, car, phone service and the credit cards you need and you see no near-term need to refinance any of them, a credit freeze might be appropriate for you. If you have few risk factors or will need to legitimately seek credit for yourself soon, a credit freeze could be more trouble than it's worth. Personally, I do not have a credit freeze on my account. I take normal precautions to make my identity hard to steal in the first place (I have a shredder and use it, I don't leave financial documents like credit card bills on the kitchen counter, I don't keep my SSN in my wallet, I use strong passwords, etc) and I check my credit report regularly. To me, the incremental protection of a credit freeze is not now worth the extra hassle and expense.

Phishers spoofing the HR Department

Phishers and hackers continue to get more creative and more sophisticated in their attacks. A recent trend is to write very specialized attack messages targeting rank-and-file employees. One example is a personal email that appears to come from the company's HR manager. The message included the HR manager's name (it was posted on the company's website) and asked the employee to review a .pdf attachment to confirm vacation accruals. The attachment was a malicious trojan.

Luckily, many of these attacks are blocked by our anti-virus software but some will always get through. Be on the lookout for these kinds of scams. If you see a message that looks suspicious, do not open it, even if it appears to come from someone you know. If you're unsure about the message, call the alleged sender and just ask if he/she really sent it.

If you run a business, make sure that your staff know about these scams, too. Make sure you set a culture of security where it's safe for the employee to call you and confirm a message's legitimacy. (If you're the one writing the messages and you're getting a lot of calls, check out "How not to look like a phish".)

based in part on a CSO Online column