Ask Liz Weston

Get smart with your money

Credit Cards

Q&A: How to practice good credit card hygiene to avoid getting hacked

By

Dear Liz: We have one primary credit card, which we use all the time, that collects airline miles we use for travel. Every few months it is “compromised” and we have to get a new one. Is there something we’re not doing right? Are there “good hygiene” rules for credit cards?

Answer: Yes, and most involve reducing the number of places that have access to your card’s information.

Many online retailers and web browsers offer to save your card information to make future purchases easier.

While these autofills save time, they mean your credit number information is being stored in databases that are outside your control. Refusing this option — and deleting your stored cards from browsers and retail accounts — means less convenience but more security.

Another option is to add two-factor authentication to your retail accounts, which makes them harder to break into. This would require you to enter a code that’s texted or emailed to you or generated by an authentication app.

Some credit cards offer the option to use virtual numbers online. If yours does, this is another option worth using. The retailer never has access to your real credit card number, so it can’t wind up in a potentially vulnerable database.

You can avoid exposing your credit card numbers while shopping in person by using mobile payment apps such as Apple Pay and Google Pay.

These apps create a “token” from your credit card information that’s transmitted to the merchant when you want to buy something. Again, the merchant never sees and can’t store your actual card details.

Other good practices involve steering clear of unsafe merchants and sites. When shopping online, always make sure the little lock symbol shows in the left side of your browser’s address bar and that the site’s address starts with “https” rather than just “http.” If a site doesn’t offer these basic security features, you shouldn’t shop there.

Be wary of in-person merchants that use old-fashioned magnetic card readers, the ones that require you to swipe, without the option of tapping or inserting your chipped card. It’s much easier to clone the information on a card’s magnetic stripe than from its chip, so avoid swiping if you possibly can.

Also be wary of skimmers and shimmers, which are devices that thieves install on unattended ATMs and fuel pumps to steal card information. These devices can be hard to detect, so consider paying for your gas inside the station and using ATMs attached to banks.

You also should avoid using public Wi-Fi for any financial transactions because these networks usually aren’t encrypted and are easily compromised. Finally, be on the lookout for phishing attempts, which is when criminals try to get you to divulge credit card and other sensitive personal information by pretending to be from a trusted source.

Understand that you can do everything right and criminals may still steal your card’s information. Fortunately you’re protected against fraudulent charges, so a compromised card is more of a hassle than a financial disaster.

Q&A: How to build a credit history so you don’t turn ‘credit invisible’

By

Dear Liz: After reading about people being “credit invisible,” I’m wondering if I should have a credit card to build a payment history. I’m 67 and on Social Security. I thought having a guaranteed income and no outstanding debt would be appealing to a potential landlord while applying for an apartment, but maybe that’s not the case. What do you recommend?

Answer: Roughly 1 in 10 U.S. adults doesn’t have a credit report and is considered “credit invisible,” according to the Consumer Financial Protection Bureau. Without a credit history, many common financial transactions can become more difficult or expensive, and that includes renting an apartment. Landlords often check credit reports or credit scores or both when evaluating potential tenants.

You can use the free AnnualCreditReport.com site to see if you have credit reports at the three major credit bureaus. (Make sure you type “annualcreditreport.com” into your browser, because using a search engine may turn up a lot of lookalike sites that will try to charge you for credit monitoring and other services. If you’re asked for a credit card, you’re on the wrong site.)

If you don’t have a credit history, there are a number of ways to start building one.

Perhaps the quickest is to ask someone with good credit to add you as an authorized user on one of their credit cards.

Another good option is a credit builder loan, which is offered by some credit unions and online lenders. The money you borrow is typically placed in a savings account or certificate of deposit that you can claim once you’ve made all the monthly payments.

Finally, there are secured credit cards which give you a line of credit that’s usually equal to the amount you deposit with the issuing bank. Ideally, you would be able to upgrade to a regular unsecured card in a year or so.

Q&A: Here’s what you should do about suspicious credit report activity

By

Dear Liz: I recently obtained copies of my credit reports from the three major credit bureaus and discovered my brother’s home address listed in the personal information section. I am extremely concerned about how and why this happened since I have never lived with my brother. This brother is the executor of our father’s estate, and the address listing was dated just before the distribution of that estate. What possible reason could my brother have for searching my credit background? I have zero communication with him because of an ongoing feud. He ignores any requests or inquiries. After I discovered this, I asked the bureaus to remove the address and put security freezes on all three credit reports, which I probably should have done sooner.

Answer: Your brother’s address wouldn’t show up in your credit reports in the unlikely event he had checked your credit. It might show up there if he had committed identity theft using your information, but if nothing else was amiss — you didn’t spot a credit account or loan you didn’t recognize, for example — then most likely the error was made by a creditor or other company that reports information to the credit bureaus.

The federal Fair Credit Reporting Act limits who can access your credit reports. Only businesses with a legitimate need to know the information can do so, and often your permission is required. You can check who has accessed your credit during the last two years in the “inquiries” section of your credit reports.

You may never discover exactly how your brother’s address wound up in your file, but you took the right steps in disputing the error and in freezing your credit reports.

For readers not as credit-report savvy: You can access your reports for free at AnnualCreditReport.com. But be careful; lots of sites want to sell you your reports from Equifax, Experian and TransUnion. If you’re asked for a credit card number, you’re on the wrong site.

When you get your reports, look for accounts that aren’t yours and other suspicious activity. Consider freezing your credit reports at each of the bureaus to prevent someone from opening new accounts in your name. You can thaw the freeze whenever you need credit, also for free.

Q&A: Identity theft fears? Get a credit report, credit freeze

By

Dear Liz: I divorced 32 years ago. Recently, I received calls from a collection agency about a debt that has not been paid. I discovered that my ex used my phone number as one of his contact numbers. My number is supposed to be unlisted and unpublished, but he found it online. I have stopped receiving calls from the agency, but how do I stop this from happening again?

Answer: Please check your credit reports to make sure your ex didn’t swipe even more sensitive digits: namely, your Social Security number. If his credit is bad, he may be tempted to pretend to be you in order to get credit cards, loans or other accounts. That’s identity theft, and there are steps you should take now to protect yourself.

You can access your credit reports for free at AnnualCreditReport.com. (If you’re asked for a credit card number, you’re on the wrong site.) Look for any accounts that aren’t yours and consider freezing your credit reports at each of the bureaus. Credit freezes prevent someone from opening new accounts in your name. You can thaw the freeze whenever you need credit, also for free.

You can’t prevent someone from adding your phone number to their credit applications, but under federal law you can tell a collection agency to stop contacting you, and it must comply. Make the request in writing.

Q&A: How to kick your ex off the credit cards

By

Dear Liz: My divorce was final in 2016. My ex and I divided our credit cards as part of the settlement. I have several joint credit cards with high credit limits and zero balances. I have used them once a year to keep them in active status. Do I consider canceling them or do I risk lowering my credit score if I do?

Answer: If these truly are joint credit cards, then your ex potentially could run up a balance and default, damaging your credit. Obviously, that’s not ideal. With joint cards, neither party can be removed by the other, so the best option may be shutting down the account.

But joint credit cards are increasingly rare. Most cards used by couples have a primary cardholder and an authorized user. The authorized user is not responsible for paying the bill and can be removed at any time.

Contact the issuers to find out your status on each card: Are you a joint account holder? Primary or authorized user?

If you’re the primary holder on a card and your ex is still an authorized user, ask that your ex be removed. If the account truly is joint or if you’re the authorized user, consider opening one or two cards in your own name before taking any further action.

Your credit scores may still take a hit when you close accounts or get removed as an authorized user, but the additional lines of credit may limit the damage and ensure you still have access to credit.

Q&A: How to protect your identity beyond a credit freeze

By

Dear Liz: I volunteer for an organization that does background checks every two years. A recent check found my name and Social Security number was used in Texas from 2019 to 2021. I have never been to Texas. What can I do to find out how this happened, and how to protect my Social Security number? I have already frozen my account with the three main credit bureaus.

Answer: You may never know exactly how this happened, but you can make an educated guess.

Most Americans’ Social Security numbers have been exposed in one database breach or another, including the massive Equifax breach in 2017 that exposed the personal information of nearly 150 million people. As a result, Social Security numbers are sold by criminals on the dark web for just a few dollars.

Because Social Security numbers have become all-purpose identifiers — something they were never intended to be, by the way — criminals can use a purloined number to get jobs, steal your tax refunds, receive medical care and apply for credit, among other misuses. They also could pretend to be you if they’re ever arrested, something known as criminal identity theft.

Freezing your credit reports will help prevent someone from opening new credit accounts. Credit freezes typically won’t help with the many other types of identity theft, however.

If you haven’t already done so, create a personal account on Social Security’s site to check your earnings record. If what you see doesn’t match your own records, contact the Social Security Administration by calling (800) 772-1213. If someone used your Social Security number to work or get your text refund, contact the IRS at irs.gov/identity-theft-central or by calling (800) 908-4490.

You also can report the fraud to the Federal Trade Commission at IdentityTheft.gov, a site that will create a recovery plan to help you navigate the next steps.