Tuesday, August 30, 2005

Negative Confirmation Bias

Bill Poser of Language Log sent me the following story, which he thought would make more sense posted on this blog than his own (presumably because I’ve blogged about identify theft before):
Last week I thought I had lost my wallet … and called Visa. During our conversation, they discovered that they didn't have my complete address and took down my apartment number and so forth. Today I received this letter from Wells Fargo Card Services:

Thank you for your recent change of address. In an effort to prevent fraud on your account, this letter is to confirm the change is valid.

Your new address is now listed as:

[redacted]

If this change was made without your knowledge and is invalid, please call us immediately at [redacted].

If the change is valid but incorrect, please call our Customer Service group at [redacted].
This letter was sent, of course, to the new address. That means (1) if the address change had in fact been the work of an identity thief, Bill would never have been notified; and (2) the thief would not even have needed to call Wells Fargo to confirm the address, since the letter only requires further action to disconfirm the address change.

If this is the kind of fraud protection we’re getting from our financial service providers, it’s no wonder identify theft is so common.

4 comments:

Gil said...

That letter would be funny if it weren't true. Instead it's sad.

I think it confirms that there are seriously stupid people making decisions at Wells Fargo Card Services.

Glen Whitman said...

Z -- I think it's pretty odd to count on the altruistic efforts of residents who receive mail that's not addressed to them, especially since it's *against the law* to open up mail that's not addressed to you. And in any case, I doubt the creditors pay much attention to mail returned to sender. As a victim of identity theft, I can tell you that accounts have been opened in my name using my old address, and I haven't found out until collection agencies tracked me down months later at my new address. Apparently the bills were going to the old address for the entire time without sending up any flags.

Glen said...

I moved a few months ago; one of my credit card companies sent a confirmation card to *both* addresses. The one to the old address took longer to get to me since it was auto-redirected by the post office.

Glen Whitman said...

Z -- I didn't mean to ridicule, only to express doubt. I'm sure the method you describe catches some identify thieves, but relying on the kindness of strangers just doesn't sound reliable to me. If the identity thief chose the new address, it's not unlikely that the identity thief could be monitoring the new address.

Some here have said the companies send letters to both addresses, old and new. That sounds like good practice, but I have severe doubts (based on my personal experience) whether it's common practice. My experience is that the creditors' fraud protection programs generally suck. They regularly grant credit with only minimal information and checking. Even a simple credit check would reveal my current address, and yet multiple accounts have been opened in my name at my defunct address. This has happened with major companies (like Sprint), not just fly-by-night operations. Given this background, I'm not inclined to give them the benefit of a doubt on the wisdom of their identity-fraud protection mechanisms.