Consumer Law & Policy Blog

More on Pretexting: Ian Ayres's Solution

by Jeff Sovern

In a Marketplace commentary, Ian Ayres (of whom I'm a big fan) has proposed an interesting solution to the problem of pretexting:  companies should notify consumers when someone requests information about them.  Presumably that would tip off consumers that they had been the subject of pretexting if they had not themselves sought the information.  Ayres also suggests that people should find out automatically when someone has obtained access to their credit reports.  At present, under the Fair Credit Reporting Act you can find out who has examined your credit report, but you are not notified automatically unless you subscribe to a service which provides that information.  The only circumstance I know of in which statutes confer upon consumers a right to be notified is, in fact, the FCRA: the 2003 FACTA amendments oblige furnshers of information to tell consumers when they send negative information about the consumer to a credit bureau under § 1681s-2(a)(7)(A).  I would be curious to know how well that notice requirement works, but in the meantime, Ayres's suggestions make sense.

Pressure on Pretexting

A quick follow-up to Jeff's post the other day about pretexting: Tech reporter Declan McCullagh had a piece yesterday reporting that the publicity from the HP phone records scandal is putting pressure on members of Congress to revive stalled legislation on pretexting:

The details go like this: The Senate Judiciary Committee has thrown its support behind one bill (S2178) that says pretexting would be a crime unless done by police or government contractors. The Senate Commerce Committee, on the other hand, is backing a rival measure (S2389) that focuses on civil fines and individuals' ability to sue for damages. Because neither Judiciary Chairman Arlen Specter, a Pennsylvania Republican, nor Commerce Chairman Ted Stevens, an Alaska Republican, has managed to secure an obvious political advantage, the result has been a deadlock that's lasted for about half a year.

IRS Begins Outsourcing to Private Debt Collectors

by Deepak Gupta

Beginning this week, the Internal Revenue Service will begin assigning some delinquent federal tax accounts to private debt collectors.  Even if you set aside for a moment the questionable merits of privatizing a function like tax collection (the dangers include privacy and security breaches, collection abuses, and a new category of scam artists), the amazing thing about this program is that it's a demonstrable failure even on privatization's own terms.  As the Washington Post's top-notch consumer columnist Michelle Singletary reports, it's going to be much more expensive:

Isn't outsourcing supposed to save money? . . . I guess not, because our government is willing to pay private debt collectors 21 to 24 cents per dollar collected. That's compared with about the 3 cents on the dollar it would cost to have IRS employees do the job . . . Even IRS officials, including Commissioner Mark W. Everson, have acknowledged that agency employees are better collectors.

Pretexting and Phone Records

by Jeff Sovern

The brouhaha over the use of pretexting to obtain the phone records of Hewlett-Packard's directors has drawn new attention to the practice of pretexting.  For example, The New York Times has articles here and here.  Pretexting refers to the practice of impersonating someone, usually a customer, to obtain information (typically, information involving the customer--such as their phone records).  Pretexters can be found liable for the practice; for example, in Remsburg v. Docusearch, 149 N.H. 148, 816 A.2d 1001 (2003), the court concluded that an action for the intrusion into seclusion invasion of privacy tort would lie against the pretexter for obtaining a person's Social Security number if the intrusion would have been offensive to a person of ordinary sensibilities.  The court also found that the investigator had a duty to exercise reasonable care before disclosing a third person's infromation to a client and that the pretexting call violated the state UDAP statute.  On the other hand, the court rebuffed the plaintiff's argument that there had been a violation of the appropriation privacy tort or that obtaining the consumer's work address violated the consumer's privacy.  Telephone companies and the FTC have also filed suits against pretexters while phone companies have responded to the practice by beefing up their security practices.  All of this may seem rather dry until you learn that in Remsburg, the pretexting service provided the information to a stalker, who then drove to the victim's workplace and killed her.