If you hadn't heard, identity theft company LifeLock agreed to pay $12 million dollars [9] to settle charges from the Federal Trade Commission and 35 states. The FTC felt that LifeLock ads were deceptive and overstated the protection provided by the service.

Personally, I think the charges are valid and I had to chuckle a bit when I read this email from CEO Todd Davis sent out to his partners. Mr. Davis certainly has his public relations firm working overtime to write something like this.

Here's the Message:

Take a read for yourself. I've got a few more comments below.

Our Comments...

They Have Updated Their Service. This is Good.

The current LifeLock service certainly appears to be better than their previous service - which was based mostly on placing fraud alerts (which you could do yourself for free [10]), putting you on the credit opt-out list (which you could do yourself for free [11]), and providing a million dollar guarantee. We applaud LifeLock for updating their service, though it appears getting sued (and losing [12]) by Experian to stop placing fraud alerts probably factored into their planning.

"Innovative" Is Not a Word I Would Use for Publicizing Your CEO's SSN

This sentence from the email absolutely drives me crazy:

LifeLock first gained national attention through an innovative advertising campaign in which I published my real Social Security number.

Their advertising was not innovative. It was stupid, irresponsible, and sent the wrong message to consumers about protecting their personal data. Calling it "innovative" doesn't sound like Mr. Davis is too sorry about this completely wrong-headed advertising campaign.

Blame the Government

When you don't want to take responsibility for your actions, most people like blaming someone else. Mr. David tries to blame the government for his company's shortcomings:

Our advertising campaign was created at a time when there were absolutely no guidelines in place that governed the identity theft protection industry.

Common sense says plastering your CEO's SSN all over magazines, newspapers, internet, television and radio is probably a bad idea if you're serious about educating people on the dangers of identity theft. You don't need "guidelines" from the FTC or anyone else to point that out. They wanted to create an attention-getting and "innovative" advertising campaign, and they did it. Please don't blame the government when you're told it was a bad idea.

Language Only a Politician Could Love

In the end,  I understand why LifeLock would send out something like this. They need to reassure partners that everything is fine and that none of this was their fault. It just upsets me when I read double-talk like this:

Unfortunately, some regulators felt these early advertisements gave consumers a false sense of absolute confidence that they could never become victims of identity theft.

 Hmmm... where did those consumers get that false sense of absolute confidence? Maybe it was our "innovative" advertising? Nah, couldn't be. It was those bad regulators who just don't see the truth.

Bottom Line - Apologize and Be Forgiven

I don't see an apology here. I'd feel better about LifeLock if they would apologize. What I see is more breast-beating and blaming. It's too bad. LifeLock is the biggest identity theft service and they got there because of the millions of venture capital dollars they've spent on advertising and their "innovative" marketing. They could apologize without jeopardizing their #1 status, but I don't think it will happen in my lifetime.

If you're a Facebook [21] addict - and chances that if you have a parietal lobe and a mouse, you are - then you'll be interested to see this eye-opening article about how easy it is to hack through the privacy settings in your profile.

According to ZDNet.com [22], an Israeli security research firm recently demonstrated just how easy it is to hack Facebook and bypass the privacy settings that so many of us hold dear.

Claims the man [23]:

I could write malicious application that steals users personal info or even simple application that build for me a bot net users for malicious purposes like hacking systems for SQL Injections and DDOS attacks. Using ClickJacking i also could fool users to click whatever I want: adding me as their friend, delete their account, and even open their camera and microphone using flash (Older versions then 10.x), or install Facebook applications that posting their web camera and microphone every time they connected to Facebook - Just use your imagination on what you want others to click on...Transfer to you poker chips???

In other words, be afraid. Be very afraid.

In all seriousness, this does give cause for concern. Many users simply believe that using the proper security settings on their Facebook profile is enough to keep unwanted users out, but a skilled hacker should have no trouble doing damage.

It's important to note that if you want to protect your privacy, it's still a good idea to keep your privacy settings strict so that unwanted users can't view your information or photographs. But the ease with which Facebook can be hacked, at least in the example above, does give rise to this question: is this proof that the most secure Facebook profile is no Facebook profile at all?

Demo Video

The researcher has released a video showing the clickjacking hack, though it doesn't have any audio - bummer. 

What Should You Do?

There's no reason to cut and run simply because you're afraid of hackers. But if you closely guard your security online and keep a Facebook profile active, then this question is one you'll really want to ponder.

Remember also that just because a hacker could get to your profile doesn't mean that any necessarily will or would want to. Just be sure that you respect your own privacy and respect the power of hackers to go after your identity through something as simple as social media.

As if there weren't enough worries about identity theft in this era high-tech, password/encrypted technology, we have to remind ourselves that identity theft still happens because of the hard technology and documents you expose to the world.

Consider the case of William Pollock [33], a young man from Texas who was looking to find a solid moving company to help move his family to Pennsylvania.

Pollock shopped around for a few different movers, as most of us would do, and when he wasn't happy with their price quotes, he turned to Craigslist.  There he found Moo-Ving.com, a company with a professional enough web site and, what's more attractive, a far lower price quote.

Caveat emptor.  As it turned out, the company took Pollock's $5,000 in upfront cash and started making demands, telling him that they wouldn't move his belongings unless he paid their fees.  Eventually the company stored his belongings in a secret location, essentially holding his private property hostage.

This kind of theft isn't as cut and dry as "routine" identity theft.  You know not to give out your credit card number unless the person taking it has a good reputation and the interaction is secure.  But what about private dealings with companies that appear to have good web sites?

List of Red Flags

Let's consider some of the red flags Pollock could have considered:

• He found the moving companies on Craigslist rather than through more traditional methods.
• He didn't do a lot of research into the reputation of the company.
• He paid upfront in cash.

All of these elements, put together with a company like Moo-Ving.com, spelled disaster.

How to Protect Yourself

How can you avoid this type of mistake?  Simple:  work with reputatable businesses when you entrust your belongings to someone else, and make sure that you pay after a job is well done, not before.

If you've become a victim of a company like this, you can turn to MoveRescue [34] - an organization funded by some of the larger moving companies that provides legal help and assistance to consumers stuck in this situation.

We know everyone is looking for that best deal online, especially during the Black Friday shopping blitz. Here are some quality online shopping tips from Intersections, Inc. (provider of the Identity Guard [39] identity theft protection service).

We also recommend a post from the always excellent Privacy Rights Clearinghouse - "Holiday Shopping? Ten Timely Tips [40]"

Don’t Let Would-Be “Grinches” Steal Your Financial Health and Identity During the Busiest Shopping Season of the Year!

As the biggest holiday shopping days of the year quickly approach, consumers everywhere will be lining up at stores on "Black Friday" for pre-dawn sales that will hopefully net great bargains and savings on holiday gifts. For those that don't want to fight the massive crowds at the malls and local shopping centers, they'll surf the Web on "Cyber Monday" - the Monday right after Thanksgiving - to catch even better sales, conveniently ordering their gifts online to have them shipped all over the world.

Finding the right deal on the perfect gift is going to be a priority this holiday shopping season as consumers everywhere are penny pinching during tougher economic times. The National Retail Federation expects average holiday spending this year will be around $682.74, down 3 percent from $705.01 last year, so getting the best value for your money is key, whether the gift is found on the Internet or at a retail store. With major online price breaks offered on Cyber Monday, online shopping sales are expected to increase 18 percent over last year, according to Information Resources, Inc.

To kick off the 2009 holiday shopping season, Intersections Inc. (Nasdaq: INTX [41]), a leading global provider of consumer and corporate identity risk management services, and provider of IDENTITY GUARD® Total Protection, the award winning identity theft protection service, advises holiday shoppers to take extra caution to avoid damaging their credit or becoming a victim of identity theft. Identity theft peaks this time of year -- wallets are stolen, credit cards are accidentally left behind and scammers everywhere are looking to prey on their next victims -- but there are simple steps consumers can take to avoid making careless decisions that can have a long-term effect on their financial well-being.

Intersections recommends the following safety tips for holiday shoppers:

1. Protect your computer from online threats including money-stealing Trojans. Fraudsters are eagerly waiting to take advantage of the millions of credit card transactions that will be made online this holiday season. They are lurking to find any weak links in your network to gain access to your personal and credit information. More recently, they are using sophisticated Trojans to grab your bank account and credit card login information, disable your security software, and sneak into your bank account by pretending to be you. Trojans are even smart enough to quietly drain your bank account over the holiday period based on the assumption that you'll be too busy to check exactly how much you're spending until the New Year. The best way to avoid Trojans is to (a) not open attachments or click on email links; (b) be careful where you surf and stick to online "neighborhoods" where you really feel safe; and (c) regularly patch your computer and update your anti-virus, anti-spyware and firewall software.
2. Take a tip from online merchants and "trust but verify." Whether it's online shopping searches, incredible gift offers, or holiday wishes from your Twitter "Tweeps" or Facebook friends, the best way to avoid gift-wrapping yourself for scammers this year is to turn your cynicism on to the highest level. If you think before you click, you might just play Grinch to an identity thief.
3. Be careful buying gift cards. Make sure that you purchase gift cards that are legitimate and secure, and avoid buying gift cards secondhand from an unverified source. UK-based security firm Corsaire recently found that the vulnerable magnetic-stripe technology used for gift cards and customer loyalty cards make these attractive targets for hackers. Additionally, the research revealed that gift cards can easily be "sniffed" off the shelf in the checkout line with a scanner and cloned, card numbers can be stolen, and retailers' gift card Web sites can be hacked.
4. Avoid Tweet Traps! Scammers fully understand the power and reach of social networks, and gathering places like Facebook and Twitter are a feeding ground for all kinds of thieves this holiday season. According to the eHoliday Study by Shop.org (a division of the National Retail Federation), 47.1 percent of retailers said they will be increasing their use of social media during the holidays. The biggest threat to be wary of this year is the "Tweet Trap" - a message that appears to be from a trusted friend or follower passing on some great news, a real bargain, or a worthy cause, but instead hides spam, phishing fraud, or a malicious download. Consumers should be cautious about Tweets or Facebook messages about great holiday deals, must-have gifts, or hard luck stories, even if they are coming from "friends." If they sound interesting, do your own research to see if they're genuine. But don't click or download.
5. If a deal sounds too good to be true, it probably is. This scam has focused on promising shoppers the hard-to-find gift at an irresistible price and in most cases, the gift doesn't exist, doesn't arrive, the seller demands far more for it, or simply steals the shopper's credit card information. But this year, hackers are upping the stakes by hacking into the search ranking systems of the major search engines like Yahoo! and Google so that their fraudulent or malware-infected web sites appear at the top of shopper searches. And most shoppers still believe that if a Web site is at the top of a search engine's list, it has to be legitimate.
6. Do NOT give out your financial information over the phone or email. If your bank or credit card company sends you an email or even calls you warning you of insufficient funds or other problems with your account, contact them directly using the customer service numbers posted on their web sites. Don't respond to their emails or to any number they provide in an email or phone message.
7. Keep travel plans private. Don't give a gift to digital burglars by Tweeting or posting updates to Facebook about your holiday plans like when you're going to be away from home or all the cool stuff you bought. Otherwise your new purchases may end up under someone else's tree.
8. Do a post-holiday credit health check-up. After the holidays are over, be sure to check your credit reports, credit card statements and bank statements to verify all transactions. Each transaction you made, either in retail stores or online, could have been compromised, adversely affecting your credit and your credit score. Notify your bank or credit card company immediately if you see anything suspicious.

"With a soft economy and higher unemployment rates, consumers are under increased pressure to cut holiday spending, and this may lead to an increased willingness to take on greater risks," said Steven Schwartz, Intersections' Executive Vice President of Consumer Solutions. "While retailers will respond with timely offers and special discounts, it's important for customers to protect themselves from scammers and cyber scrooges who may try to prey on their emotions with targeted offline and online schemes."

One way to protect yourself is to be vigilant about where you shop (online or at the mall), what information you provide and to whom, and to protect your computer from spyware, malicious code and Trojans. Intersections' IDENTITY GUARD® Total Protection [39] is the most comprehensive offering on the market today covering personal information, credit reports, public records, computer, Internet and mobile transactions. The service also provides sophisticated software that protects consumers against keylogging attacks, secures their passwords and user IDs as they navigate online, identifies legitimate websites, and protects their computers from advanced malware software. IDENTITY GUARD® Total Protection [39] also provides identity theft recovery services and financial reimbursement insurance in the event identity theft occurs. Find out more at www.identityguard.com [39].