After my friend’s troubles with verifying his identity for ING Direct, and their subsequent explanation of the incident, I didn’t expect to be writing about identity verification for a while. Sure, there were lessons to be learned and research to be done, but we knew that research would take months and months to complete, due to the nature of identity verification companies.

However, one week after my friend Rick’s incident with ING Direct, I got into my own “identity verification” hot water. And it upset me all the more because of the trouble with the first incident. And so, it became…

The Story of How Stephanie Was Not Able to Prove That She Was Herself Without Knowing Information About a Woman She Barely Knows

Friday, September 11th: Thanks to my recent move and a few once-a-year bills, my credit card bill this month was about $200 higher than it usually is. No problem though, because I’ve squirreled away money in a “Getting Established” fund nearly a year ago, for this very purpose. I’ve kept my GE fund in an E*TRADE “Complete Savings” online savings account. About a week earlier, I’d electronically “linked” my ING Electric Orange Checking account to my E*TRADE savings account. Before that, I’d only had my Bank of America checking account linked to my E*TRADE account. But this wasn’t efficient, because I now use my ING checking account for nearly all transactions.

I went to move nearly $400 from the E*TRADE account to my ING checking account. I didn’t anticipate any problems: the link to the ING checking account had been verified with two small deposits, and there was more than $400 in the E*TRADE account. But my action set off some sort of automatic alarm on E*TRADE’s computers. Which seemed perfectly reasonable to me: I was moving a fairly large sum of money to a newly linked account. It’s understandable that they wanted to verify that I was really me before letting the transfer through.

So E*TRADE sent an email to my listed email address with an “activation code” that I would need to enter into the E*TRADE interface before the transaction would go through. Fine with me! I got the code in my email within minutes, pasted it in, and hit “Continue.”

Then the trouble started. Getting that activation code from my email was not enough to verify me. Apparently, E*TRADE also thought it necessary to ask me multiple choice questions about myself that were developed by a third party agency. These questions are supposedly based on public record. There was one question about places I had previously worked at — none of them were places I’d even heard of. There was one question about my mother’s age (got that one right!). But then, there were four questions about a Gail XXXXX, where XXXXX is a last name of no one I know.

But Gail is the first name of two women in my family — my half sister (who is 17 years older than me, and we’re not very close) and my dad’s wife, who I’ve met only a handful of times. Both women have had last names in their lifetimes that I don’t know about, due to marriages. Yes, I’m really not that close to either of them, so I don’t know their previous last names.

So, I was faced with a dilemma. It was late at night — my dad could help me answer these questions, but he had just signed off of an online conversation with me, telling me that he was going to bed. And I thought I had a reasonably good shot at guessing the answers (I don’t know why I thought that). So I guessed.

And guessed wrong. The website told me that my identity could not be verified, and my account had been locked. Nope, the transfer that would allow me to pay my credit card bill was not going to go through, and no, I could not transfer the money to my other linked account. I would have to call their customer service between the hours of 8am and 6pm to get my account unlocked.

I wrote an email to my dad, who was actually still awake, and called me back instantly. He told me that XXXXX was the last name of his wife during her previous marriage. But there was a further complication: her ex husband, Mr. XXXXX, had remarried, to another Gail. So there was a new Gail XXXXX that the questions could refer to. It was unlikely, based on the questions, but it did make the whole thing all the more dubious. He gave me all the information on his wife that I would need to answer the questions correctly, should I ever have to go through this process again. I went to bed.

Saturday, September 12th: I called E*TRADE’s customer service. After handing over a ton of information over the phone to get a rep to look at my file (account number, my address, my date of birth, the last four digits of my Social Security number…), he told me there was nothing he could do. He gave me the direct number for the department I needed, but told me that they’re not available on weekends. I would have to call back on Monday.

Monday, September 14th: I call the direct number I got from the first E*TRADE rep. I hand over all of my information again (account number, my address, my date of birth, the last four digits of my Social Security number….) and have the new rep take a look at my file. She sees that my account is locked, and says that she’ll need to pull up a new set of identity verification questions for me to answer, over the phone, before she can unlock the account. I wait on hold. She comes back on the line and says that the system “can’t find any more questions” about me, and puts me back on hold. She comes back on the phone to tell me that she’s going to get an administrator to try and find some questions about me in the system. Back on hold.

She comes back on the line to tell me that there just are no more questions about me. She tells me I’ll need to fax in a letter with information about me (account number, my address, my date of birth, the last four digits of my Social Security number…) and a copy of my license. I tell her I don’t have access to a fax machine. She asks me when I can get access to one. I ask her if there’s some other way I can verify my identity. She says I can do it my mail (joy! not secure and slow!) or I can visit an E*TRADE branch.

Jackpot! I live next to a major city now — there’s got to be an E*TRADE branch in Washington, DC! I ask her to tell me about visiting a branch. I ask if there are any near Northern Virginia. She tells me no, there are not. She tells me I can go to their branch in New York. I try to roll my eyes as audibly as possible. I ask if there are any in Washington, DC. She tells me there’s one in Seattle. Finally, I say “District of Columbia” and she gives me the address of the DC branch. Excellent.

So, I’ll just need to take in my license and that letter with all of my personal information (account number, my address, my date of birth, the last four digits of my Social Security number…) to a branch and they’ll unlock my account.

Later that day: My phone rings, and it’s the same customer service rep from earlier in the day. She asks if I’m planning to fax in my information before 6pm that day. “Um, no, I still don’t have access to a fax machine.” After reminding her that I plan to visit their DC branch, she tells me the real reason she called: the fact that my license has a hole in it will be a problem. See, my license has a hole in it because I just moved to Virginia, and I just applied for my Virginia driver’s license. So they punched a hole in my New York driver’s license, gave me a piece of paper that’s a “temporary Virginia license” and I was waiting for my new license in the mail.

She tells me that I’ll need to fax in a copy of my passport as well. Apparently the fact that I wasn’t faxing anything just wasn’t getting communicated after the third time, so I dropped that and noted that I would need to bring my passport with me to E*TRADE as well.

Tuesday, September 15th: I arrive at E*TRADE’s office, fully stocked with identifying information and the signed letter they asked for with all of my information in it (account number, my address, my date of birth, the last four digits of my Social Security number…). The guy at the desk pretty much doesn’t have a clue what I’m talking about, but he takes my letter and ID, and goes to talk to his boss. He comes back, lets me know that he faxed my info off to the main office, and that my account should be unlocked by the afternoon of the next day.

Wednesday, September 16th, late afternoon: Somewhat unsurprisingly, my account isn’t unlocked yet. I call E*TRADE again, give my info over the phone again (account number, my address, my date of birth, the last four digits of my Social Security number…). The rep says she’ll call me back.

I do get a phone call back, letting me know that the account has been unlocked and that I’ll have to set up the transfer again.

Lessons Learned

Sometimes, you only get one shot to prove that you’re you. Yes, eventually I was able to call in and bring in enough information and identification to prove it, but it would have been much easier to just get the questions right in the first place. But as we’ve seen in both my case and Rick’s, sometimes you just don’t have that option. Yes, I’m keenly aware that I should have called my dad before braving the questions on my own. But in Rick’s case, they asked him about someone that no one in his family had ever heard of. There was no way that Rick could have ever passed the quiz “about him.”

Creepy shadow companies collect information about you, and it affects you. I don’t know what “third party agency” it is that collected this information and developed this quiz on me, but I certainly don’t like it. I don’t believe I should be required to call my father in order to prove to a company that I’m me. They shouldn’t be asking about my father’s wife. Information about a woman I barely know should not be used as a quiz for my identity.

There were four questions about Gail XXXXX. And only one question about me directly, and one question about my mother. If the four questions had been about my mother, my father, or my other stepmother (my mother’s wife), I could have answered them. Two thirds of the questions in the quiz contained a name unfamiliar to me.

Check your specialty reports once a year. If you’ve read these two stories of how awful it can be when the information is inaccurate, and you still don’t pull your specialty reports and verify the information on them, I won’t feel sorry for you if something goes wrong one day.

Have an emergency fund. The reason I never freaked out during the whole process was that I had an easily-accessible emergency fund at ING Direct. I knew that even if E*TRADE kept my account locked for months, I would be able to pay that credit card bill, and the one after it. This kept me level-headed (though still annoyed) throughout the whole process. It also saved me a little money, in that I didn’t feel the need to run out and pay to have my information faxed. Because I have an emergency fund, I had the freedom to demand that E*TRADE conform to my schedule, not the other way around.

When we last left our friend Rick*, he’d been told that he could never open an ING Electric Orange account, and he was scrambling to figure out what company is giving out false information about his identity. Since then, ING Direct has responded to both Rick and myself.

Here is a portion of the email Rick received from the Ombudsman:

We received your email and we wanted to follow-up with you.

Since we are a direct Bank, we do not get to meet our Customers face-to-face. For your security, we ask questions to help confirm your identity. A third party creates the Identity Verification Questions using various sources that contain your personal history.

Please know that the information you are referring to comes from a third party database. ING DIRECT is unable to inform you of the third party vendor that we obtain this information from.

If you would still like to open an Electric Orange, our Customer Security Department will attempt to verify your identity through alternative means.

So, still no word on who the “third party vendor” is that Rick has to wrestle with. But, there’s hope in this email — it looked like Rick would be able to open an ING Electric Orange checking account after all!

Rick immediately called ING Direct, answered more security questions (ones that were actually accurate, this time), and was told that he was approved. It actually took a day for the approval to go through… because Rick himself had blocked it from happening. How? Why, that fraud alert he put on his credit reports because of this fiasco! Once that was cleared up, he received word that his new account is open.

ING Direct also responded to me directly, in a comment left on my previous post:

Hi Stephanie & “Rick”- Thanks for your passion about this. As a direct bank, we aren’t able to meet with all our Customers face-to-face so we need some security measures to safeguard our Customers’ personal account information & protect their accounts from any potentially fraudulent activity.

One of those measures is to ask a few questions at account opening to which only the Customer should know the answers. We give our customers two opportunities to answer these questions correctly, as Rick experienced, before an account can be opened. If a Customer can’t answer these questions correctly at that time, we are unable to confirm his/her identity and cannot open the account for him/her.

There are several companies out there (e.g. eBureau) that provide this service. They get their information from various sources including credit bureaus. (Your recommendation that people check their credit reports annually is important; however the verification process we use does not access your credit. In other words, Rick’s credit was not affected in this process.)

We’ll work with Rick to see if there was another issue that may be causing him a problem. Our intent is not to turn down business or cause our Customers grief. It’s to prevent them from having to deal with the pain of someone stealing their identity or worse, their money.

We wish Rick the best of luck in his new job, locating his license and looking for a new car.

More of the same, mostly, but a clue as to which “third party agency” we may be dealing with. I haven’t heard of eBureau, so whether or not that’s truly the company in question, I thank ING Direct for cluing me into another player in this field.

Lastly, Rick’s story was picked up in a Consumerist post, Man Says Byzantine ING Identity Verification Stops Him From Opening Account. The comments on that are worth reading: it’s a mix of hilarious commentary and commiseration from others who’ve been in similar situations.

Final Thoughts

Honestly, I still love ING Direct. I can understand their need to verify identities, and once brought to their attention, they handled this situation fairly well. What ultimately went wrong was having two customer service reps tell Rick that he could never ever open that account. It ended causing a lot of unnecessary grief, and it wasn’t even true.

Rick is, understandably, still sore about the situation. He’s not cancelling his ING Direct accounts, but he’s not their biggest cheerleader now, either. But when it comes right down to it, we’re gearing up to take down the real monster here: Mysterious Third Party Agency That Has Wrong Information About Rick. Oh, and the Post Office. Because losing someone’s license is really not cool, USPS.

*Rick is still not his real name. Although I think he’s warming to it and may legally change it to that. Or not.

This complex tale started on Saturday and has not yet fully played out. I’m breaking the story now, but there will be updates to this post as additional details are known. Please read the post in its entirety before asking any questions… but questions are welcome.

The Players

ING Direct: My favorite bank, which I recommend often to both my friends and readers. Widely known for their helpful customer service, the fact that this is happening with them is mind-boggling. I’m truly disappointed.

Rick*: A friend of mine from college, who recently moved for a new job. Rick’s been having a little trouble getting established in his new apartment: the DMV mailed him his new license, but the US Postal Service seems to have lost it. His beater car isn’t behaving, so he’s planning to replace it with a new or recent-used car, paying about half cash and getting a loan for the other half. He doesn’t have much of a credit history. These facts may seem random, but they’ll all come into play in his story.

Creepy Shadow Company that Collects Information and Sells It: As of right now, we do not know what company this is. All we know is that they collect information about me, you… and of course, Rick. They then use this information to formulate multiple choice questions about a person. If you’ve ever tried to pull your credit report, you’ve come across these types of questions. They’ll ask you something about a loan you have, or a previous address, to make sure that you are you. They then sell these questions to credit reporting agencies and lenders, who use this information to validate your identity.

Rick’s Story: A Perfect Storm

With all of his car trouble and not being able to get his license (the DMV says talk to the post office, the post office says talk to the DMV…), Rick’s been getting quite frustrated lately. As his friend, I encouraged him to take things one step at a time, and focus his efforts on getting a bank account that’s accessible in his new location. He’s heard me gush before about how much I love my ING Electric Orange Savings account, so he asked me how long it would take to open one of those.

Because I knew that Rick already had an ING Orange Savings account, I told him that it would take less than a minute to fill out the forms to open one of their checking accounts. After all, I did it, and it took me only 42 seconds! (Yes, I timed it.) Rick was truly excited about the idea of getting one of their accounts and having a debit card with fee-free ATMs in every 7-11. He logged into his ING account and went to sign up. But he hit a snag — a pop-up came on the screen telling him he needed to call ING’s 1-800 number and validate his identity.

I’ll let Rick tell this part of the story himself, as he presented it in an email to ING Direct’s Ombudsman:

Once I connected with the representative, I provided my current address, phone number, date of birth, and [Social Security Number], as well as my ING Direct pin.

The final step, I was told, was a series of multiple choice questions which would complete the identification process. I answered the first two, both of which were applicable to me. The last three concerned a person with whom I am not familiar, so I answered accordingly. When the representative put my answers into the system, she informed me that, based on answering too many of them incorrectly, I would never be permitted to open an Electric Orange account. [emphasis added]

I thanked the representative and hung up. Assuming (erroneously, as I would find out) that the check was performed through one of the three credit bureaus, I immediately began contacting them, requesting copies of my credit report, and attempting to question the information they required for identification purposes. I cleared two of the three credit reports with no problem – the third will arrive in the mail, but based on my later interaction with ING, I suspect it will be clean as well.

Having used up my available routes, I decided to inquire further with ING regarding the identification process. I called the same security department phone number and talked with another representative. This time, I explained the entire situation again, including my efforts to check my credit. She explained that the identification procedure is not conducted through a direct credit check with any of the three credit bureaus. Instead, a third party company produces a series of questions that they believe will positively identify me. When I asked whether I could contact the company directly, or provide alternative forms of identification, she claimed that there was no other manner by which I could disprove the answers to the questions and prove that I am, in fact, myself. [emphasis added] The representative gave me this email address as a point of contact for continuing with this issue.

So, the apparently unchangeable bottom line is: there exists a company whom I have never explicitly authorized to store my personal information; this company is responsible for determining whether or not I know enough about the unverified information that they maintain to conduct business with their client. The company does not accept corrections to the information, and may at any time in the future damage my ability to establish relationships, financial and otherwise, with other organizations.

I view this matter as a very serious breach of my trust in ING as an organization.

Rick’s frustration is justifiable, and it’s actually worse than he explained in this email. In order to obtain his three credit reports so quickly, Rick put a fraud alert on them. This was my idea, based on the information we had at the time, so I take responsibility for its consequences. Once Rick receives and verifies his final credit report, he can remove the fraud alert. But we’re both concerned that this may affect Rick’s ability to get the car loan that he really needs at this point. His old car has too much damage to justify repairing it, but he needs to either get a new car or repair it within 30 days of having moved to his new state. I don’t know if having a fraud alert (even a removed one) on his credit reports is going to make this difficult… or impossible.

I pointed out in my description of Rick that he doesn’t have much of a credit history. This is important because, as I said, most of the time these verification questions will be about loans you hold or have held. Because Rick doesn’t have history like that, his “known associates” were used to validate his identity instead. The problem is they asked about someone who is not actually known to Rick.

Stephanie’s Thoughts

I am disappointed in ING Direct. This policy seems completely unlike them, and I do not understand it’s purpose. If the idea is to protect me in the case of someone trying to open an account in my name, how does it help me? Think about it: if some identity thief came along and tried to open an ING Electric Orange account in my name, I’d be the one banned from ever opening the account! It prevents the theft by hurting the victim. In the case of Rick and others like him, he’s banned from an account for life because of a five-question quiz that he had zero chance of answering correctly. He was doomed from the start, with no recourse.

I am truly frightened by the unknown company in question. ING told Rick that they cannot tell him the name of the company that they get their information from. There’s incorrect information being used to identify Rick, but he has no way to correct it. This company, whoever they may be, scares me. They collect information on all of us, from public and (likely) private records, and sell it, and we don’t even know who they are. Even if I knew who they were, this idea makes me devastatingly uncomfortable.

At this point, one of the companies we’re exploring with such an information service is LexisNexis. Brought to my attention by the Bargaineering post Request & Check Your Specialty Reports Annually, the LexisNexis Accurant Person Report “contains a wealth of information, including voter registration, possible associates, property (aircraft, watercrafts!) owned, etc.” [emphasis added]. Rick is planning to request his free LexisNexis Accurant Person Report, but there’s a snag there: he has to submit two forms of identification, one of which must be government issued and include his current address. Remember how I told you Rick’s new license is lost somewhere between the DMV and the post office? Awesome.

Once Rick finally gets his license and photocopies it along with a second form of ID and submits it to LexisNexis, they helpfully say it will take 30-60 days to receive his report. And that’s just until he gets his report – we have no idea how long it will take to dispute any incorrect information on it. Honestly, this could take years to sort out. Hopefully it doesn’t… but what do we do if LexisNexis is not the company supplying incorrect information about Rick’s identity? Questions like that are why this may take a long, long time.

What I want to see happen

I want a comment from ING. As both a customer and affiliate of theirs, I demand a statement. I want that statement to include the name of the company they contract for these validation questions. Just like credit reports, consumers have a right to see these reports and dispute incorrect information on them. We cannot exercise that right if we do not even know the name of the company by whom the information is provided.

I want ING’s statement to include a formal declaration of their policy: is it true that if a customer fails this validation test once, they are banned from opening the account for life? Does it extend to other ING accounts? Is he now never allowed to get an ING Direct mortgage? They’ve already said that Rick is free to keep his Orange Savings account and keep using that. I’m not sure that he’ll want to keep that account when the dust settles on all this, but it’s good to know his current account will not be affected.

Lastly, I want you to take this situation seriously, and take full advantage of your right to annual reports. Had Rick followed that advice when Bargaineering first published that article, this situation might never have occurred. If you pull your specialty reports once a year, you may be able to prevent this for yourself.

Your questions and comments on this situation are welcome, as long as they are in accordance with my comment policy.

*Of course, Rick isn’t his real name. If you know who Rick is, please respect his privacy if you choose to comment.

Update: ING Responds!

When I was a little girl, American Girl dolls were so cool. My best friend and I were obsessed with them. We both read the books and talked about how much we wanted dolls of our own, and poured over the catalogs, pointing out all the accessories we’d get when we finally got our dolls.

We both read the books, too. My best friend liked Samantha, whereas I was a Kristen and Molly girl. I liked the Molly books the best, but I wanted a Kirsten doll because she looked like me (duh!). Every time the catalog would come (which was often), I would beg and beg and beg my mom to buy me one.

Pssh! That never happened. My parents learned their lesson about buying me expensive things when I was four years old. They bought me a really nice gold locket – and I proceeded to stick it in my mouth and chew on it whenever I wore it. I don’t think I’ve ever had anything expensive since then, except maybe my car.

But my best friend eventually got her Samantha doll, and we spent some time playing with her, which mostly involves dressing the doll up and talking about the books. It didn’t take long for me to realize, even at a young age, that the dolls weren’t all they were cracked up to be. They just made you want to buy even more accessories for them – and the catalogs certainly provided enough of those for us to yearn for.

It’s not that I didn’t play with dolls. I had Barbies and Cabbage Patch dolls – it-s just that I realized American Girl dolls were so friggin expensive, you couldn’t really do anything with them, for fear you might damage them. On my Cabbage Patch doll (which was reasonably priced since I was years younger than the craze period), I had no qualms using her hair to teach myself to braid. But American Girl doll hair was so delicate and pretty looking, I wouldn’t have dared style it myself.

What fun is that? A doll you’re afraid to play with?

Still, even today, the idea of owning an American Girl doll is pretty ingrained in my psyche. Maybe it’s because I loved the books so much. Or maybe it’s some residual jealousy that my best friend got one, and I never did. Or maybe it’s just ingenious marketing having left a permanent stamp on my impressionable brain. I. Still. Want. One.

Or at least, I did, until five minutes ago. Then I saw this post on Consumerist: American Girl Place Mocks 6 Year-Old For Having A Doll From Target, Refuses To Style The Doll’s Hair (which describes the blog post “Fake Out” by blogger “One of those horrible moms”).

Oh. My. God. There aren’t even words to describe my disgust. At this moment, I’m ashamed this company got my family’s money for the books, and I’m thanking all of my stars that I never put out the $80 or whatever it was for a full-blown doll.

I was actually looking forward to the idea of someday, in the far, far, distant future, maybe having a daughter and getting her one of these dolls. Or maybe even buying one for my niece in a few years (she’s two years old right now).

No way, now! Forget it, American Girl – you’re dirty. This also falls under my category of “Not Understanding Companies That Make It Difficult For You To Give Them Your Money.”