And more than a week after the company first warned its customers about the possibility of identity theft, it at last provided details about the protection it was now offering them: a free one-year subscription to a surveillance service that searches for evidence that they may have become victims of identity theft and alerts them if anything turns up.  

Here’s what Sony is not doing, though: offering to pay for something called a security freeze for any customer who wants one.

A surveillance service is reactive. By the time you get an alert from one, thieves may have already done a lot of damage.

A security freeze, also known as a credit freeze, is proactive. Once you put your credit reports on ice at the three major credit bureaus — Equifax, Experian and TransUnion — no company (other than ones you already do business with) can look at your credit report. Creditors generally won’t open a new account if they don’t have access to the report, so a freeze offers the best protection there is against someone opening an account in your name.

The credit bureaus depict freezes as a last resort, something that will cause consumers great inconvenience because they need to temporarily thaw their accounts whenever they want to apply for new credit. And it gums up the works for the bureaus, that’s for sure.

But as someone who has had his files frozen for several years, I can personally attest to the fact that the inconvenience is fairly mild. Credit freezes are the best defense mechanism available for people whose data may have fallen into the wrong hands, and it’s a shame that Sony executives don’t seem to have realized this.

Sony’s actions are all the more surprising given its various units in California. That is where security freezes first hit the radar more than a decade ago, thanks to a bill sponsored by Debra Bowen, then a state senator.

“Knowing that lenders would not grant credit to people if they were unable to check those peoples’ credit reports, her bill gave consumers the power to freeze access to their reports,” said Shannan Velayas, a spokeswoman for Ms. Bowen, who is now California’s secretary of state.

Eventually, enough states followed suit with their own laws forcing the three credit bureaus to give consumers this option that the bureaus threw up their hands and decided to offer it to everyone.

They didn’t make it easy, though. I have distinct memories of standing in the post office filling out registered mail forms since that was the only way some of the companies would accept a request to freeze a file.

Today, things are less complicated. All three bureaus will let you put an initial freeze in place on their Web sites. I’ve posted links to Equifax’s page, Experian’s site and TransUnion’s starting point in the online version of this column. Still, fewer than 500,000 people have frozen their Experian files; Equifax and TransUnion would not provide numbers but they are probably similar.

Once you’ve put a freeze in place, you can thaw your files temporarily if someone needs to examine your credit report. The bureaus also let you do this on the Web and supply you with personal identification numbers for the purpose. The cost for the initial freeze and the thaw will run anywhere from nothing to $20 or so per bureau, depending on the maximum price, if any, that a law in your state has set and whether you are a recent identity theft victim.

The bureaus’ Web sites offer plenty of reasons for pause, noting that a freeze may interfere with applications for jobs, credit cards, mortgages, insurance, rental apartments and cellphone accounts. And it is true that all sorts of entities want to check your credit before doing business with you or hiring you.

That is what the thawing process is for, though. I’ve refinanced my mortgage twice, changed jobs once and applied for a couple of credit cards since I put security freezes into place, and it’s never taken me more than 10 or 15 minutes total to temporarily thaw all three frozen files. The thaws generally go into effect instantly, so the whole process is really no big deal, as long as you keep those PINs together in one (secure) place where you can find them easily.

One hiccup that’s worth noting here, though. While I was able to get my free Equifax and TransUnion credit reports this week through annualcreditreport.com, Experian would not give it to me. Instead, it served up a form with my Social Security number and other personal information that it wanted me to put in the mail before it would hand over my credit report. Um, no thanks. An Experian spokeswoman was unable to explain why this had happened.

A freeze may also make it harder to take advantage of those instant credit offers at department and other stores or sites. But opening lots of new lines of credit isn’t wise anyway, since that can hurt your credit score.

If you don’t want to deal with any hassle, there is a company, TrustedID, with a product called Credit Lock that will handle the freezing and thawing for you. You’ll pay $14.95 for the initial freeze, plus whatever the bureau charges in your state. Then, you’ll pay $9.95 plus the state charges for each bureau when you want to thaw. You also have to sign a limited power of attorney form for TrustedID to act on your behalf and turn your PINs over to the company as well.

However you set it up, a credit freeze is a no-brainer for people who are no longer applying for much credit. Millions of older adults fall into this category. It’s also a good backstop for any friends or relatives with questionable judgment or impairments that may make them vulnerable to scams.

As for everyone else, it’s hard to see why a small occasional hassle and a bit of expense should get in the way of locking down your credit report. It’s certainly better than having to spend months or years trying to scrub your credit history clean of the work of a rampaging identity thief.

Yes, it is infuriating that this burden should be on you. In an ideal world, a credit freeze would be the default setting and you’d have some kind of supersecure smartphone mobile app that could thaw your credit report. Maybe someday we’ll get to live in that world.

Security freezes are not bulletproof, alas. You’re still vulnerable to a thief taking over an existing credit card account and, say, redirecting e-mails or paper bills to a different address. So you need to keep checking your account statements.

This is a theoretical vulnerability in a situation like Sony’s, where a thief could use a stolen Sony user name and password that a customer also uses on other sites to try to take over, say, a checking account. The company isn’t aware of anything like this happening or use of any credit card numbers from Sony accounts. Even if either one were to happen to you, you might never know whether the thief got your data from Sony or someplace else.

In fact, it is precisely because so much personal data is floating around out there in the ether that security freezes are such a good idea. They are the best tool consumers have to keep crooks out of their credit files, and Sony ought to offer to pay to put the freezes in place for any customer who wants one.

Article source: http://feeds.nytimes.com/click.phdo?i=bfbc505a9fb1563c0c254b4d3acaca88