Using rental car Bluetooth opens door to identity theft: Money Matters

August 5, 2018

Using rental car Bluetooth opens door to identity theft: Money Matters

Q: It looks like I have been the victim of identity theft, and I have not seen either of these methods described in your column. I wanted to share my experience with you so that you can warn others.

In mid-July, I was contacted by the fraud department of my bank regarding suspicious activity. There had been a debit card transaction at a Target in Florida for $885. That same day, a $500 transaction at another Target was declined as well as an attempted ATM withdrawal. The bank acted quickly and the $885 was refunded into our account.

I learned, just today, that I also am the victim of a fraudulent U.S. Postal Service change of address.  It appears that effective June 20, any mail addressed only to me (not to my husband or adult children) was being forwarded. I put two and two together when I was looking for a missing Amazon package that was shown as being delivered to an address in Florida.

I have learned today that anyone can change any address remotely through the USPS website.  I SHOULD have received a oversized, well-marked, red/white/blue envelope informing me of this change and telling me to contact the post office immediately if I did not request this change.

I never received said envelope and I was told by a USPS supervisor that these letters are “computer generated.” These letters are supposed to be sent to the individual at old and new addresses (addressed to said name and “current resident” to avoid forwarding).  I contacted the Postal Inspector’s office and filed a claim and canceled this change of address. I also went to my local Post Office to speak with a supervisor and my carrier.

I contacted the credit bureaus to put alerts on my accounts.  I reviewed my credit reports today and verified that no new accounts have been opened.  Within the credit reports, I see that a Florida address had been added in July. I also called that local Post Office in Florida and spoke to a supervisor and asked her to alert that carrier.  An internet search shows that it looks like the address belonging to an empty house that is currently for sale.

As I thought about my recent activity, I became suspicious of the fact that I had been in Florida in early June and had rented a car through Hertz.  My research since then showed that using Bluetooth technology in a rental car puts one at great risk. I had no idea.

The articles I read stated that the Bluetooth technology doesn’t just allow the driver to use GPS and hands-free dialing but in essence, can transfer information from the phone to the vehicle’s computer. Just unplugging the phone does NOT delete the information. The driver needs to delete all the information from the vehicle. Obviously, when the rental companies wipe the car interior clean, they don’t wipe the computer clean.

I wanted to share this with you so that you can warn other consumers about the USPS vulnerability as well as the rental car issues. I can’t confirm that my information was breached through the rental car, but that sure is suspicious timing and location. I will continue to monitor my accounts and would welcome any other suggestions that you have.

L.M., Middleburg Heights

A: Thanks for telling your tale to help others. I have often written over the years about how easy it is for a bad guy to change someone’s address through the Postal Service. It’s a horrible problem.

I have not written about personal information being stolen through rental cars computers. Like you, I’ve never heard of this issue before.

I did some research too and found that this is one of the latest and greatest strategies that identity thieves are using to get personal information belonging to previous rental customers. Who thinks of these things?

It’s not clear how much information from a person’s phone could be transferred to the phone’s computer. Certainly, a person’s call history, streaming log-ins, address book or contact list and internet search history would be susceptible. So it’s possible the next rental customer could find out your name, where you live, where you bank, and important addresses and phone numbers.

I did put a call in to Hertz’ media relations. That call wasn’t returned by press time.

On the change of address problem, the USPS continues to say they believe in the security policy they have for the roughly 50 million people who change their address every year: sending notices to both the old and new address. Clearly, it’s an imperfect system. I’d love to see the USPS require that any online request to change one’s address require a payment of $1, and that $1 must be charged to a debit or credit card account in that person’s name. The alternative would be to make the address change in person.

For you, in addition to what you’ve already done, I’d recommend you:

** Freeze your credit reports so that no new credit accounts can be opened without your permission. Fraud alerts have limited benefit. Calling for a freeze is easier than doing it online:Equifax, 1-800-685-1111TransUnion, 1-888-909-8872Experian, 1-888-397-3742

** Contact all of your existing banks, credit cards, investment firms, etc., and tell them you’ve had some personal information compromised and you’re concerned about identity theft and you want to add extra security to your accounts, such as extra passwords, etc. You want it to be flagged if anyone tries to change your mailing address, request a new card, etc.

** Enroll in two-step verification on any online accounts that offer it, such as your email -- that’s most important -- and your financial accounts, eBay, etc. This will require you or anyone who tries to log in from a new device or location to enter a one-time code sent to your phone or email.

** Sign up for alerts with your banks, credit cards, etc., so that you’re notified in real time of any attempt to change your contact information, and notified of any transactions that exceed parameters you set.

** Watch out for anything odd in the mail -- a letter about an account you didn’t apply for, a letter from a company thanking you for your recent phone call if you didn’t call them.

** Keep an extra close eye on all of your bank and credit card accounts.

** In a month or two, request copies of your credit reports. The process is free if you haven’t received a report in the past year. When you get them, scour them for any discrepancies, especially accounts or inquiries you don’t recognize. Dispute any inaccurate or questionable information per the instructions provided. Contact 1-877-322- 8228 or annualcreditreport.com.

Update hourly