My identity laid bare

My membership letter to a new, growing club arrived in a nondescript envelope that languished for a couple days in my to-do pile. When I opened it last week, my heart sank.

"We regret to inform you thatCoreLogic was the victim of a recent burglary and that one of the items taken was a computer containing personal data about you, specifically your name, Social Security number and property address related to an existing or anticipated mortgage loan."

A 4 a.m. burglary in Sacramento in July plunged me and 49,999 other people, through no fault of our own, into the ranks of millions uneasy about their vulnerability to identity theft. Since February 2005, the Privacy Rights Clearinghouse Web site has documented at minimum 89 million incidents of individuals' personal information put at risk (www.privacyrights.org).

The list is shocking for its breadth — a diverse combination of state and federal agencies, health-care facilities, big businesses and small — and confounding for how many seem utterly preventable.

Note to datakeepers: Don't put personal data on a laptop someone can take home (Boeing, 161,000 people); don't ship information unless it's encrypted (CitiFinancial, 3.9 million); don't sell computers on eBay without erasing hard drives (Idaho Power Co., unknown number). Duh!

Whether acts of stupidity or criminality, consumers are laid bare by these incidents.

Washington ranks eighth among all states for the number of identity-theft cases, according to the Federal Trade Commission. Here, consumers can put a 90-day fraud alert on their credit reports. But to actually freeze credit — barring any new credit from being issued without permission — consumers must prove their risk by producing a police report about the incident. That might take weeks if the investigation is ongoing.

State Attorney General Rob McKenna offers a dead-on analogy:

"Even though homes in your neighborhood are being burglarized, you are not allowed to put a deadbolt on your front door unless your home is burglarized," he says.

Today, McKenna is expected to propose new legislation that would give consumers the authority to protect themselves. If enacted, consumers could freeze their credit data without the police report. Washington would join 18 other states that allow consumers to initiate the freezes on their own authority.

Some in the financial-services industry object to such discretionary credit freezes because it takes the impulse out of impulse shopping. Consumers might cool to the idea of carting home the big-screen TV if they have to wait days to make the purchase. But the AG's bill borrows a Utah approach that permits consumers to "thaw" their credit freeze briefly to permit a credit check for a specific creditor, like a car dealer or furniture store. The consumer would need only a personal identification number and 15 minutes lead time.

Lawmakers should embrace McKenna's bill.

Washington and a few other states have been better advocates for consumers than the federal government, creating a patchwork of varying protections. Federal foot-dragging can be explained by the power of the industry, which should not be underestimated. The U.S. House is considering HR 3997, backed by the Consumer Data Industry Association, which purports to establish one federal standard. Catch is, it's a lower standard. The bill would gut these stricter, state-passed credit-freeze laws.

Between hacking, phishing and old-fashioned stealing, the combination of technology and human craftiness has made the credit landscape treacherous. The latest scam is "Vishing": the scammer calls your phone, reports unusual activity on your account, gives you a number to call and when you do asks you to "verify" account information. Your caller ID might even read the name of the company they are spoofing.

Don't fall for this. If you get such a call, instead dial the number listed on the back of your credit card or statement. (For more tips, visit the AG's Web site: www.atg.wa.gov/consumer/idprivacy/)

The American credit system is only as good as it is reliable. It pays everyone to be a little paranoid. If the datakeepers and credit reporters don't look out for individuals, consumers must be able to do it themselves.

Kate Riley's column appears regularly on editorial pages of The Times. Her e-mail address is kriley@seattletimes.com