Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Torn-up Credit Card Apps Not So Safe

Posted by CmdrTaco on Wed Mar 15, 2006 03:27 PM
from the big-shocker-here dept.
Maximum Prophet writes "This dude tears up a credit card application, tapes it back together, sends it in with his cell phone number and father's address, and voila, gets a credit card. Who would have thought security at a credit card company was so lax? The company recommends that consumers "tear up" financial solicitations before throwing them away, "so thieves can't use them to assume your identity.", but according to them, "Applications that arrive in damaged form are customarily transferred to an electronic format, he said -- often by machine. So it's possible a human being never handled the taped-up application and never had the chance to spot the obvious sign of trouble." In this era where we worry so much about identity theft, this sort of thing really makes you wonder what the point really is.
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • shred shred shred (Score:4, Informative)

    by Luyseyal (3154) <swaters&luy,info> on Wednesday March 15 2006, @03:30PM (#14927056) Homepage
    I always shred this kind of thing.
    -l
    • That may be, but theres nothing stopping a would-be identity thief from raiding your mailbox in the morning before you can get to it. I really loathe these pre-approved credit card ads that come with large bright "0% for six months!!!" print on the outer envelope.

      The reason these are considered "safe" is that most all credit card applications require a social security number. So, that means the identity thief has to steal a piece of mail from your health insurance company, which is a pretty reliable way of
      • Re:shred shred shred (Score:5, Informative)

        by Skater (41976) on Wednesday March 15 2006, @03:40PM (#14927161) Homepage Journal
        In the US, you can now use a phone number (it's something like 1-888-3OptOut) to opt out of the prescreened credit card offers. I did so several weeks back and the offers have slowed to a trickle.

        I do kind of miss shredding the fake AmEx cards that came with their offers, though.
        • Re:shred shred shred (Score:5, Informative)

          by johnkoer (163434) <johnkoer.yahoo@com> on Wednesday March 15 2006, @04:02PM (#14927404) Homepage Journal
          The FTC has an alert [ftc.gov] that gives you a few options, including the phone # to call for opting out.

              • by MillionthMonkey (240664) on Wednesday March 15 2006, @07:41PM (#14929289)
                I keep a copy of the 217 page Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 [gpo.gov] handy for this kind of thing. When I get a credit card offer, I print out a polite letter explaining that I must decline the card because of a lack of bankruptcy protection, and that I am including a copy of the legislation in case they have any questions. I cram it all into the business reply envelope. Unfortunately I have to print double sided or 4 sheets to a page but that envelope gets crammed pretty good- nice and heavy.

                I met a guy with an even better idea. He has a home equity line of credit (HELOC). When a stupid credit card offer comes offering 0% interest, he pulls a couple grand out of the HELOC. Then he applies for the card and does a balance transfer from the new CC account to the HELOC. (Credit cards are too smart to just send you wads of cash when you apply, but they will give you the money if it's to pay another creditor- that's why he uses the HELOC, as an account to shift balances around.) If he gets the card and the transfer goes through, he puts the money in a CD earning 4.5% that matures when the card's introductory period expires.
      • by Beryllium Sphere(tm) (193358) on Wednesday March 15 2006, @03:41PM (#14927172) Homepage Journal
        >I really loathe these pre-approved credit card ads that come with large bright "0% for six months!!!" print on the outer envelope.

        Amen. The reason I opted out of receiving those was exactly the one you mentioned, that they're a security problem.

        The number to stop them at least used to be 888-5OPTOUT.
      • by nizo (81281) * on Wednesday March 15 2006, @03:47PM (#14927256) Homepage Journal
        I solved this problem by having credit that is so bad, people literally laugh at me when I apply for a card. The weird part is I still get these offers in the mail; I still think it is a ploy by the credit card companies to give their employees a good laugh now and then.
        • by bnenning (58349) on Wednesday March 15 2006, @06:22PM (#14928685)
          Several years ago when I had no credit record I applied for a Discover card. On the same day a few weeks later, I received two pieces of mail: a rejection of my application due to insufficient history, and a offer to sign up for a Discover card.
      • Re:shred shred shred (Score:4, Informative)

        by cr0sh (43134) on Wednesday March 15 2006, @05:16PM (#14928171) Homepage
        The reason these are considered "safe" is that most all credit card applications require a social security number. So, that means the identity thief has to steal a piece of mail from your health insurance company, which is a pretty reliable way of obtaining a social security number, since most insurance companies use it as a unique subscriber identifier. Theres no way to win.

        Actually, if you sign up for insurance, for most applications you can write the words "please assign" in the space for the SSN, and the company will assign a number for your policy. I should note that some brokers will get smart with you, and try to "guilt you" into providing your real social "in the event you are incapacitated" and "so your loved ones can help". Don't let them guilt you (if I am incapacitated or dead - I don't care anymore, now do I?). Also, don't put in a "fake SSN", as these get caught fairly easily (and you'll get a phone call or letter) - or if they aren't, then it might be YOU who are guilty of "identity theft", if it is found out it matches someone else's real number in the system...

    • Re:shred shred shred (Score:4, Informative)

      by sacherjj (7595) on Wednesday March 15 2006, @03:42PM (#14927184) Homepage
      Yep, cross cut shread everything that I throw away that even might have encriminating data. If you are more paranoid, you can keep a burn bag of the shreaded stuff.
      • After burning up a couple of COTS shredders (don't believe the outside of the boxes when they describe how much they can cut at once), my wife and I have resorted to burning junk mail in the fireplace. We toss in a couple of logs, sit back with cups of tea, and enjoy the warmth provided by a couple months' collection of junk mail.
    • wimp (Score:4, Funny)

      by JeanBaptiste (537955) on Wednesday March 15 2006, @03:49PM (#14927265)
      I shred it, then I set it on fire. I then take the ashes and compress them into a diamond-like form. Then I smash it apart, and put the crystal shards inside the event horizon of a black hole, beyond which no information about the black hole's interior can escape to the outer universe. [uiuc.edu]

      its the only way to be completely sure.
      • Re:shred shred shred (Score:5, Interesting)

        by smooth wombat (796938) on Wednesday March 15 2006, @03:52PM (#14927302) Homepage Journal
        If for some reason you're fire averse a pair of scissors properly applied for about 10 seconds will prove sufficient to defeat the roll of tape.

        You'd think so, wouldn't you. However, you might want to read this story [edwardjayepstein.com] about the Iranian students in 1979.

        First three sentences of the fourth paragraph:

        This was the situation up until November 1979 when Iranian students seized an entire archive of CIA and State Department documents, which represented one of the most extensive losses of secret data in the history of any modern intelligence service. Even though many of these documents were shredded into thin strips before the Embassy, and CIA base, was surrendered, the Iranians managed to piece them back together. They were then published in 1982 in 54 volumes under the title "Documents From the U.S. Espionage Den", and are sold in the United States for $246.50.

        This particular story didn't say so but I read elsewhere that the students laid out the shredded documents on the floor of gymnasiums and pieced the documents back together.

        • by Comboman (895500) on Wednesday March 15 2006, @04:23PM (#14927578)
          This particular story didn't say so but I read elsewhere that the students laid out the shredded documents on the floor of gymnasiums and pieced the documents back together.

          The technology now exists to scan fragments of documents en-mass and piece them together semi-automatically in electronic format. Some human interaction is still required, but it is much faster and easier than the Iranian effort. This is being done to restore ancient manuscripts but I'm sure it's being done in the covert and criminal fields as well with shreded documents.

  • whose fault (Score:3, Insightful)

    by opencity (582224) on Wednesday March 15 2006, @03:30PM (#14927057) Homepage
    'Shouldn't' this be the companies problem? MCI decided years ago I owe them money, I don't, and every two years some collection agency comes calling.
    • Re:whose fault (Score:4, Informative)

      by Skim123 (3322) <mitchell@nosPAm.4guysfromrolla.com> on Wednesday March 15 2006, @04:05PM (#14927423) Homepage
      Can MCI provide you with a copy of a document you signed regarding the charges? If not (and if I'm not mistaken), what they're doing is illegal. Next time you get a call, request this information and if they can't or won't provide it, tell them that if they call you again it's off to the FCC and your state's attorney general.
      • 'Shouldn't' this be the companies problem?
        Can MCI provide you with a copy of a document you signed regarding the charges? If not (and if I'm not mistaken), what they're doing is illegal.
        Please forgive me for sounding condescending, but parent and grandparent posts are COMPLETELY missing the point. It doesn't matter if it's illegal, all that matters is the they (giant, godless corporations) have infinitely deep pockets and an army of lawyers, while you have enough trouble making the rent. They are COUNTING on this.

        As long as they're vastly more powerful than us, it is usually to their advantage to create problems for you that you may (or may not) pay to make go away. I finally paid a lawyer over $5,000 to correct MBNA's refusal to stop reporting credit fraud as mine. Once the 100 page brief was filed with the court and MBNA saw that there would be financial consequences, they finally backed off.

        There's a huge difference between what's illegal and what's prosecuted.
  • by metternich (888601) on Wednesday March 15 2006, @03:30PM (#14927067)
    I always try to put different pieces of my financial documents in different trash bins. I suspose burning them would be even more effective.
  • by defile (1059) on Wednesday March 15 2006, @03:31PM (#14927074) Homepage Journal

    "Applications that arrive in damaged form are customarily transferred to an electronic format, he said -- often by machine. So it's possible a human being never handled the taped-up application and never had the chance to spot the obvious sign of trouble."

    What, a machine opened the letter, recognized it was an application (and not, say, other junkmail that got stuffed into the nearest bulk reply envelope), fed it into a scanner, then trashed the hard copy? At no point in the process does a human see it? Sounds like bullshit.

    • by paeanblack (191171) on Wednesday March 15 2006, @03:51PM (#14927291)
      If humans aren't involved in the letter opening process, it's time to have some real fun...see how well their machines handle foreign substances

      1) Save the return envelope.
      2) Fold up a blank piece of paper with a nice wad of chewing gum/peanut butter/diaper contents/etc
      3) Mail your "application"
      4) ???
      5) Profit
      • by Deagol (323173) on Wednesday March 15 2006, @04:27PM (#14927627) Homepage
        I send most junk mail solicitations back to the sender in their own return envelope. If they send those neat colorful stickers, I stick a few of those on the envelope's outside border for good measure. So you have an over-stuffed envelope with stickers to gum up the machines.

        My wife did a few months on graveyard shift at a First Security payment processing center (before Wells Fargo assimilated them). She said those machines are *really* cool, really fast, and jam up so easily that they have dedicated staff on-hand to fix particularly nasty jams.

        So if you want to put a (albeit small) dent in the productivity of the Evil Credit Card Sharks, send back those handy self addressed envelopes stuffed with their own junk mail. Be sure to fold, spindle, and mutilate the envelope, too. :)

      • by StikyPad (445176) on Wednesday March 15 2006, @05:22PM (#14928237) Homepage
        Forgot to mention the solution I did end up using for a particularly determined bank which kept sending me high interest "pre-approved" credit card applications:

        I made my own checkbox next to the "YES! Sign me up." that said "No thanks," and checked it. Naturally, I put it in the business reply envelope, along with a dollar or two in pennies (to be used toward the processing fee of course), and sent it on its way.

        They never sent me another application.
    • by thparker (717240) on Wednesday March 15 2006, @03:51PM (#14927295) Homepage
      What, a machine opened the letter, recognized it was an application (and not, say, other junkmail that got stuffed into the nearest bulk reply envelope), fed it into a scanner, then trashed the hard copy? At no point in the process does a human see it? Sounds like bullshit.

      I'd guess yes, at no point in the process does a human see it.

      Here's one vendor -- OPEX [opex.com]. This one does opening and extraction [opex.com] but isn't particularly fast at 17,000/hr. They have a scanning solution as well -- significantly slower but the mail goes straight from envelope to scan.

      This is just what I've found in a quick search because I knew something like it existed; I'm not that familiar with the high-speed mail processing industry. I'd imagine that the technology would surprise most people.

      • You want high volume processing? Try First Data [firstdatacorp.com]. My Dad worked there for like 5 years overseeing hundreds of people who ran the machines that did this stuff 24 hours a day. For a while, I worked in one of the Quality Assurance departments for Credit Card bill printing and our team could (mostly) ensure the quality of over a million pieces every day. It's mainly an automated process, but there was always human verification at some point or another. But that doesn't mean that someone can't get sloppy! T
  • Solution! (Score:5, Insightful)

    by wiggles (30088) on Wednesday March 15 2006, @03:34PM (#14927100)
    Buy a shredder. I shred every credit card offer and transfer check my current credit card company sends me. It's ridiculous the crap they send me. One of these days, a thief is going to raid my mailbox before I get home and get a credit card in my name. Oh well. At least I get to play Enron Executive with my niece.
    • Re:Solution! (Score:5, Interesting)

      by garcia (6573) on Wednesday March 15 2006, @04:01PM (#14927389) Homepage
      One of these days, a thief is going to raid my mailbox before I get home and get a credit card in my name.

      Last summer I had a notice in my mailbox from the Postmaster that stated there were reports of mail theft in our neighborhood and that we should be watching closely for ID theft.

      My wife is concerned with throwing mail away and the thieves getting it there. Why would they bother to go through my trash and get dirty when they can get it fresh from my mailbox w/no one the wiser.
    • I go even further... We have a shredder, and I empty it once a week into the bag with the used cat litter. If someone wants to spend the effort to reassemble my finacial statements after digging through that mess, well, they've just about earned it.
  • by dada21 (163177) * <adam.dada@gmail.com> on Wednesday March 15 2006, @03:34PM (#14927102) Homepage Journal
    Why do banks accept any application, even ones with errors?

    Banks want you to have credit -- of course they'll accept any application as long as the name and social security number match their lookups, and your FICO score is reasonably high (although banks are now lowering standards to give out even more credit).

    When a bank offers credit, it does so based on money it has (of course). Yet it is very important for the average person to understand where this "money" comes from -- especially digital money such as you'd have when you have an available credit line.

    All banks that are part of the central banking system (the Federal Reserve) are required by the Federal Reserve to stick something called a money multiplier. I believe the current money multiplier is 12% or so, but it varies. This basically means that a bank must keep a reserve of that amount versus the actual money is sends out. If a bank loans out $1000, it has to keep $120 in the bank. Even if it loans out the $880 ($120 in reserves) the bank can stil say it has $1000 in demand deposits available -- even though it doesn't.

    The collusion comes into place when the first bank is given $1000 by the Federal Reserve. The Federal Reserve is allowed to print new money out of thin air by creating loans against government property and future government income. This initial $1000 is placed in Bank A as available cash. Bank A holds $120 but loans the remaining $880 to Bank B which is also part of the Federal Reserve banking system. Bank A still holds a demand deposit value of $1000 which is available to be withdrawn! Bank B also has $880, but has to reserve 12% of it ($105). It then loans the rest ($775) to Bank C, but still lists $880 as its available balance of demand deposits. Bank C reserves its 12% ($93) and loans the rest ($682) to Bank D, while still listing the original $775) as its available balance. This collusion continues to go around until there is no more reserve balance available. In the end, the original $1000 the Federal Reserve created is held as a base reserve for the $9000 or so "new money" that is created.

    Banks need people to accept this money in loans or in credit -- this is the way the bank actually makes money. Eventually all the loans are hopefully paid back into the system, so the bank makes a nice interest rate. On the new $1000 created, each bank wants to loan out as much as possible -- and these loans are used to buy goods, which recycles money back into the banks which can be kept as reserves to create even more money! If the bank takes $1000 and loans out $880 but receives $400 of that bank in, it can now loan out a portion of that $400 that it has in reserves.

    In the long run, the system wants debt out there because it is created out of fake inter-bank loans anyway. Most of you don't even see your physical money because it doesn't exist -- there are about $600 billion dollars in circulation worldwide, but there are over $10.2 trillion dollars on the books!

    And people have faith in the system.
    • by daknapp (156051) * on Wednesday March 15 2006, @03:40PM (#14927160)
      they'll accept any application as long as the name and social security number match their lookups, and your FICO score is reasonably high

      There's a foolproof way to keep this kind of identity theft from happening to you: just make sure your FICO score is really, really low!

      That way, nobody will be able to get credit in your name. And, as a bonus, it's really easy to do!

  • by A Commentor (459578) on Wednesday March 15 2006, @03:35PM (#14927110) Homepage
    Where the problem??? Obviously, the credit company has some really advanced process that allowed them to determine that he actually sent it in (maybe they check the fingerprints on the tape, who knows)..

    If a real criminal would have attempted to tape it togather and send it in, the company would definitely not accept it...

    And for the humor impaired ;-)

  • Pimply faced kids (Score:4, Insightful)

    by rueger (210566) on Wednesday March 15 2006, @03:37PM (#14927132) Homepage
    Said it before, I'll say it again, I worry more about handing my card to the PFK at the corner gas station that about people going though my trash or grabbing my info off of the 'net.

    Most of the fruad that I've suffered has been at the hands of large corporations that reckon that my lawyer won't be willing to take on their lawyer.
  • by prozac79 (651102) on Wednesday March 15 2006, @03:37PM (#14927135)
    Isn't there a human in the processing chain somewhere? Doesn't someone have to physically open the envelop and scan the application? It seems like that is the logical place to check for potentially fraudulent applications. I don't believe that step is automated, but then again I've never worked at a place that needs to process thousands of letter a day. Or is it that the person getting paid minimum wage to open and scan letters could care less if someone is committing fraud?
  • by John Whitley (6067) on Wednesday March 15 2006, @03:41PM (#14927167) Homepage
    Once again, I like Bruce Schneier's proposed solution:
    The bank must be made responsible, regardless of what the user does.
    That quote is from Mitigating identity theft [com.com], which provides a refreshing perspective on the problems collectively labelled as identity theft. Bruce points out that many of the "solutions" to identity theft focus on authentication, which misses a critical part of the equation: the fradulent transaction itself. By providing a strong financial incentive to banks to mitigate fraud, the only party which has a real chance to do anything about the problem will fix it and fast.
  • by klossner (733867) on Wednesday March 15 2006, @03:42PM (#14927179)
    Better than a shredder, ask the banks to stop sending you the applications in the first place: http://www.optoutprescreen.com/ [optoutprescreen.com]. I used to receive several per month, now I get two per year.
  • by mrpeebles (853978) on Wednesday March 15 2006, @03:44PM (#14927219)
    I don't know if these credit card companies are legally liable for this sort of identity theft, but they should be. If they are going to make money putting us all at risk for identity theft, they should pay for any damages we incure, including any inconvenience it causes us. Ditto for all these companies that collect data on us.
  • What? Me, worry? (Score:3, Interesting)

    by panda (10044) on Wednesday March 15 2006, @03:50PM (#14927281) Homepage Journal
    In this era where we worry so much about identity theft, this sort of thing really makes you wonder what the point really is.

    The point is, that there isn't any point. :)

    It's exactly that kind of thing, and the real lack of concern that I've witnessed from gov't agencies and financial institutions all along, concerning everything from someone's actual name and SSN being used as an alias by a known felon (and the SSA refusing to issue a new SSN for the "victim") to loan officers that say that there's so much junk data on credit reports that they often ignore a lot of it, that caused me not to worry if my "identity" is "stolen."

  • by Dr. Manhattan (29720) <sorceror171.gmail@com> on Wednesday March 15 2006, @04:06PM (#14927429) Homepage
    So, DirecTV accepted my VISA number with (a) a misspelled name and (b) an invalid expiration date and (c) a mailing address halfway across the country from mine. Now I've had to bounce a bunch of mail back and forth (including a "fraud affidavit" that requested so much information on me it might as well have been an identity theft kit in its own right).

    Clearly they didn't make even the slightest attempt to validate the charge. I've closed that account and put fraud watches on our credit and so forth, of course, and no other suspicious charges have shown up. Still, it makes me nervous.

    Meanwhile, my father-in-law discovered his bank account was several hundred dollars short. Turns out he was auto-paying someone else's gas bill. My wife had a heck of a time straightening that out. The bank insisted it was the utility's responsibility and vice versa. "He signed up for automatic payment!"

    "My father doesn't own a computer. Why would you authorize withdrawls for someone else's utility bill in the first place? Especially when their account number is identical except for two transposed digits..."

    A mistake in that case, but it would be so easy to do that deliberately...

  • by Hamster Lover (558288) * on Wednesday March 15 2006, @04:35PM (#14927726) Journal
    is send you endless reams of "balance transfer" cheques or convenience cheques. Not only are they a complete rip off to use as interest and endless fees apply the second you use one, but they get mixed in with all the other crap they love to send you in the envelope and you don't realize they're there. You end up throwning them away in the trash without voiding or otherwise defacing them to make them worthless. Any enterprising thief scrounging through your garbage can come across them and use them. This happened to a good friend of mine when she threw them away thinking they were some sort of advertising without realizing they were real cheques. Cheque fraud isn't the easiest thing in the world to do anymore, especially in Canada where no merchants will accept cheques anymore, but it does happen.

    Ask them to stop sending them to you and they swear up and down it will happen, but it never does. It's just too lucritive for them to stop sending them to you.
    • by Beryllium Sphere(tm) (193358) on Wednesday March 15 2006, @03:52PM (#14927300) Homepage Journal
      >Why not just shred it using a cross cut shredder. thats what i do . I would like to see somebody put something that has been through one of those back together.

      Churchstreet Technologies [eweek.com] will scan the debris in a shredder's output bin and their software will reconstruct it in RAM. They claim to be able to piece together even crosscut documents as long as you haven't mixed several bags together. Seems to be that columns of number would be an intractable problem, I don't know whether they can manage those.
    • by R2.0 (532027) on Wednesday March 15 2006, @04:17PM (#14927537)
      The point he was tyrying to make is that the standard advise of ripping up credit card offers is worthless if any random person can tape the pieces together and apply for credit in your name fraudulently. That's why he applied in his father's name - he put in a fradulent application and it was accepted.

      I know I'm going to be more careful to shred them all, but if you still think it's useless, that's fine by me. Send all of your ripped up CC applications to me, and I'll dispose of them.