• PC World
• »Security

Money Talks

Among the biggest information databases are those maintained by the three major credit bureaus--Experian (formerly TRW), Equifax, and Trans Union. They contain a wealth of information about people's income, jobs, bank accounts, purchasing behavior, and credit limits. An aggressive company such as Experian can combine this data with public information that it draws from motor vehicle and property records. It can then put together sophisticated lists with the names of individuals who, for instance, live in the Dallas area, make more than $100,000 per year, drive foreign cars, and have no more than two children.

But the greatest danger is what can happen when credit data falls into the wrong hands.

Credit reports are one of only three types of files protected by federal law (the other two are video store records and cable television accounts). Only you and any third parties you've authorized (such as your landlord) can access your report. But with so many resellers marketing credit files online, a data criminal can easily obtain unauthorized files, open new credit-card accounts, get loans in your name, or attempt to blackmail you.

"If you walked into a bank and wanted a $2000 loan, [the bank] would want every bit of information about you, including your shoe size," says David Szwak, an attorney based in Shreveport, Louisiana, who specializes in credit-card fraud and computer security. "But if you know enough about someone, such as his social security number, electronically you can get a $5000- or $10,000-limit credit card in his name with no personal contact."

That's what happened to Ken Robinson, a client of Szwak's near Dallas. Someone stole Robinson's identity and bought a satellite dish, a diamond ring, and a houseful of furniture in his name. Two years later, Robinson is still trying to clear his record. "It's just a never-ending nightmare," he says.

How easy is it to get a credit report? Fill in the requisite information at QSpace, and within minutes you can get a person's Experian credit file on-screen. QSpace, a company based in Oakland, California, claims that by using VeriSign's encryption technology it can ensure that only authorized persons may view an individual's credit report.

But accidents do happen. Last year, Experian began offering credit reports via e-mail from its Web site. The company discontinued the program after just one day when a glitch in the system sent credit reports to the wrong e-mail addresses. At the time, Experian said it would restart its online credit report program as soon as it had worked out the security bugs; that day hasn't come yet.

Back then, the Experian incident scared away Equifax and Trans Union from providing online reports. But recently, Equifax launched an initiative with IBM to use an electronic certificate system to make sure that online credit reports go only to authorized recipients.

QSpace won't discuss its security procedures. "Due to the competitive nature of the Internet, spelling out details of our security policy would not be in our best interest," says Arash Saffarnia, QSpace's chief technology officer.