Capital One has reported a data breach impacting over 100 million customers. As they continue their investigation, new details are being revealed.

How Did it Happen

There are numerous articles online that discuss how the breach occurred. One source that I recommend is KrebsOnSecurity.com.  Here is the link to the article written by Mr. Krebs on the Capital One data breach. He will continue to write on the subject until all the details have been revealed.

Who Was Impacted

Customers impacted are those that submitted applications for credit products between 2005 to early 2019. Customers include consumers and small businesses.

What Information Was Exposed

Reports are stating that approximately 140,000 Social Security Numbers (this represents 1% of SSNs in their database) and 80,000 bank account numbers were exposed during the breach. Later reports have stated that this information may be encrypted. If the information was encrypted, it could potentially limit risk to consumers involved.

Additional information exposed may include credit application information such as

  • Name
  • Address
  • Zipcode
  • Date of birth
  • Phone numbers
  • Email address
  • Self-reported income

What Should You Do

A name, address, date of birth, and SSN are the keys to the kingdom. With this information, a criminal can apply for new accounts, take-over your current accounts, or become you.

 New account fraud occurs when someone uses your identity to apply for and obtain a new credit account. The information needed to apply for a new credit account is the same information believed to have been exposed in the Capital One breach. To protect yourself from new account fraud you should establish a credit freeze with each of the five, yes, I said FIVE credit bureaus.

  • Experian
  • Equifax
  • TransUnion
  • Innovis
  • NCTUE

A credit freeze, also known as a security freeze, prevents the credit bureaus from revealing your credit history report to new creditors. A credit freeze will not impact your current credit accounts. You can use them as usual. To establish a credit freeze, you must contact each credit bureau directly, either by phone or online. I do not recommend establishing a credit freeze by mail unless the other two options are not possible. Each credit bureau will provide you with a PIN. The PIN is what you use temporarily lift or permanently remove the freeze when needed. The process to temporarily lift a freeze is simple and quick. You can either use the credit bureau’s automated phone system or website. A credit freeze is your best defense against new account fraud.

It should be noted that a fraud alert and a credit lock are not the same things as a credit freeze. They do not offer the same protection. Griffon Force Academy members receive step-by-step instructions on how to establish and lift a credit freeze.

To verify an identity, many organizations request a name, address, date-of-birth, and SSN. Identity verification is required before making changes to an account such as resetting the password, adding services, or transferring the service to another provider.  If all of these were exposed in the breach, it would make it easier for a criminal to take-over a victim’s accounts. One example is porting a mobile phone number to another mobile carrier. If a criminal transfers your phone number to another carrier, you are no longer in control of your account. Transferring is also known as porting. Depending on the situation, you could end up losing your mobile phone number. Today your phone number is equivalent to an SSN. Companies depend on your phone number to validate your identity. If you lose your number, permanently or temporarily, it could have a negative impact.

Identity theft is a risk to more than your financial accounts. Medical identity theft can negatively impact your health, insurance benefits, and eligibility for insurance. Criminal identity theft could negatively impact your auto insurance or your employment opportunities. Imagine being involved in a traffic accident only to learn that your license was suspended. Not because of your bad driving habits, but those of your imposter. Now imagine you are denied access to your child’s school because a criminal records check revealed you were a sexual predator. This situation happened to my neighbor. A child predator was using the identity of my neighbor. When the predator was arrested, he presented identification with my neighbor’s information.

Should You Sign-Up for the Free Credit Monitoring

The decision is up to you. Here are a few things to keep in mind while making your decision.

  • Monitoring does not prevent identity theft.
  • Monitoring only monitors for changes in a credit report.
  • If you freeze your credit, you may not need credit monitoring.
  • You are required to provide your sensitive information to another company that could potentially be breached.
  • Dark web monitoring is misleading as it is impossible to monitor the entire dark web.
  • You can do the same monitoring for yourself for little to no money and do it better.

 You are Your Best Defense

When it comes to monitoring, no one knows you better than you. So, why would you pay for a stranger to do it for you? Instead, use free tools to help you monitor. Many banks and credit card companies offer free account alert tools online. Create your online account and set up the alerts. A few examples of free alerts include:

  • Account balance drops below a specific amount
  • Transactions larger than a specific amount
  • Card-not-present transactions, meaning credit card was not physically swiped

 Every month you should reconcile your financial statements. Reconciling is the best way to detect fraud. By setting up online access, you can monitor your transactions in real-time daily. The earlier you detect fraud and report it, the faster it will be repaired. It will significantly reduce or eliminate your financial liability for the fraudulent transaction.

As with any data breach, the information discovered will change based on the investigation of the breach. Instead of waiting to determine if you were exposed, it would be beneficial to implement the precautionary measures mentioned in this article. Preventing all types of identity theft is impossible. However, you can take steps that will reduce or eliminate your risk of specific types of identity theft.

Learn all of the steps to protect your identity in our How To Prevent Identity Theft course. Click here for additional information on how to take advantage of our pre-launch price.