States Offer Consumers New Tool To Thwart Identity Theft

"They did have a great deal of prominent information about products that consumers could buy, such as credit monitoring services and links that consumers could use to purchase copies of their credit reports," Goldberg said.

Consumer groups say the credit bureaus' policies on credit freezes are indicative of an industry that is not structured to deal with consumers.

Ed Mierzwinski, program director for the PIRG's federal office, said the credit bureaus are "doing their darndest" to weaken state credit-freeze statutes.

"We believe that fighting for things like certified mail and long implementation time frames are indicative of an industry that simply doesn't want to have to hire the customer service people they need to be able to interact with the public," he said.

Goldberg, who has worked with advocates in more than a dozen states to enact freeze legislation, said that in 2005 the CDIA and the credit-reporting agencies shifted their strategy. They no longer were outright opposed to credit-freeze laws; instead, they worked to convince states to allow the bureaus to charge as much as possible when consumers place, lift or remove credit freezes.

"The credit reporting agencies clearly want consumers to pay more for the security freeze than we certainly think they should," Goldberg said. "But given that those same agencies collect all of this sensitive financial data about consumers and then turn around and sell it, we think they should also have the obligation to protect the consumer, and that's where the security freeze comes in."

The Delaware Bill's 15 Minutes of Fame

When Fitzgerald heard about the New Jersey law in July 2005, he contacted state Sen. Venables and urged him to include the 15-minute unfreeze language in the bill he introduced in the Delaware legislature.

"The American Bankers Association and the banks up to this point were claiming that a credit freeze was going to be end of those good deals, that local farmers weren't going to be able to do their spring plowing or get a new tractor quickly if the old one breaks down," Fitzgerald said. "But the 15-minute provision ended all that talk, and it's what ultimately caused the banks to drop their opposition and go neutral on this bill."

Convinced he could bring more business groups on board with the 15-minute proposal, Fitzgerald opened up the phone book and began cold-calling industry groups and trade unions. Within a few months, Sen. Venables's coalition of supporters grew to nearly 100 members, ranging from heavy hitters like the AARP and the American Civil Liberties Union to smaller outfits like the Paralyzed Veterans of America and a local anti-abortion group.

In August 2005, Fitzgerald had a chance meeting with Larry Blanchard, senior vice president of CUNA Mutual Group, a $14 billion company that serves as a leading insurer for most of Delaware's credit unions and a large portion of federal credit unions nationwide. When the discussion turned to Fitzgerald's credit freeze efforts, he said Blanchard became interested. The executive explained that CUNA was suffering a 300 percent loss ratio due to rising identity fraud costs associated with several major data breaches at nationwide retail chains.

At a 300 percent loss ratio, for every dollar the company was earning from member premiums, CUNA was paying $3 in claims for fraud costs related to identity theft cases.

CUNA indicated it would support the bill if Sen. Venables included a provision that would force credit-card processors and merchants to pay $3,000 per violation for storing consumer credit card data for any length of time longer than necessary for processing a customer's payment transaction. CUNA Mutual recently had filed a suit against BJ's Wholesale Club for holding some 40,000 customer credit cards that were compromised in a 2004 data breach.