• 5 Traps: How do I use public Wi-Fi safely?

    By Bob Sullivan, Columnist, NBC News

    You've heard it for years: Using free coffee shop Wi-Fi isn't safe.  But then, you've done it anyway,  viewing critical work documents or doing online banking. So let's talk turkey.  To borrow from a modern parental dilemma, I really don't want you doing that, but if you do, you should be taking the proper precautions. This edition of Five Red Tape Traps will help you do that. 

    Finding a free Wi-Fi hotspot is like finding an oasis in the data desert. You might be wandering around helplessly detached with your laptop, iPod Touch or iPad when you come upon a coffee shop or airport lounge that promises to quench your thirst for e-mail.  At moments like that, most consumers have one thing on their minds: connecting as quickly as possible. 

    Somewhere along the line, you've probably heard that recklessly using Wi-Fi can be dangerous. Perhaps you've even heard that the danger level recently increased with the release of a new tool named Firesheep, which makes snooping on unsecure coffee shop networks easy for anyone with a Web browser.  There are a lot of fish in that sea: The Wi-Fi Alliance says there are now 92,000 hot spots in the U.S., and every one of them needs to be used with care.

    The problem is simple: When you're using Wi-Fi, you're sending data through the air that gets picked up by a radio antenna on a router. Of course, anyone else with an antenna can receive the signal, too. If the data are scrambled, no big deal. But scrambling involves settings that could make life harder for customers, and there isn't a coffee shop in the world that wants to provide IT support to latte drinkers. Hence most free hotspots provide little or no security. It falls to the latte drinker to surf safely.  

    Sadly, staying truly safe means heeding some rather brutal advice.

    "I just tell people not to do anything at a coffee shop that they wouldn't write on the back of a postcard," said Kelly Davis-Felner, marketing director for The Wi-Fi Alliance, a global trade group that certifies Wi-Fi devices. She says the alliance is working on new technologies that will automatically make free Wi-Fi safer, but for now, you should pay heed to these five traps and their antidotes.

    1.) It's never happened to me. This is probably the biggest problem facing improved Wi-Fi security.  Sure, you start out only reading the NYTimes.com website at coffee shops, but that's just the gateway site. One day, reading the business section, you see a stock you hold in your retirement account took a hit. You can't resist visiting your broker's account.  Then you are tempted to go to your online bank to increase your monthly contributions.  And nothing bad happens, so what's the problem?

    "There's this great disconnect that even if someone took advantage of you and stole your data, you might not be aware of it," Marian Merritt, Internet safety advocate at Symantec Corp. "Someone could be using Firesheep against you, and you wouldn't know it."  This same phenomenon happens in credit card theft: When a criminal buys something with your credit card, you almost never know where the account number was originally stolen.

    As a result, it's easy to get complacent with Wi-Fi, and get lured into doing riskier things. Here's the easiest, most basic rule of thumb everyone should follow: Do only casual Web browsing when in that coffee shop, ideally at websites where your password is already stored so it needn't be typed.  Remember, half of you use that DailyNews.com password at your online banking website, too, so even a seemingly harmless visit to your town's obituaries could expose your money to a hacker. 

    2.) Shoulder surfing.  Tech writers love using non-words like VPN in a sentence, but often the biggest risk comes from the simplest attack.  You probably glance over your shoulder before you enter your PIN code at an ATM. You should bring some of that healthy paranoia to coffee shops, too.  Someone could easily look over your shoulder and spot critical personal information while you sip your warm beverage and stare out the window.  One low-tech investment that might be worth your while is a privacy filter for your screen that cuts down severely on the viewing angle.

    3.) HTTP vs. HTTPS. Even if you are using a wide-open hotspot, you can still scramble those radio transmissions for safety.  Make sure you login to websites like Facebook and Amazon only when there's that familiar "https" prefix in the address where your browser is headed. That means the information you transmit won't be readable by someone who plucks it out of the air.  In fact, it will be encrypted at every step between your computer and the website's servers.

    Note, however, that you might find yourself switching between http and https as you surf, particularly if you click on outside links. That means before you type something critical, like a login or a credit card, you should check again that your browser is pointed at an https site.

    Generally, Web mail programs allow safe https logins, but some switch back and forth depending on how you are using the site. One tip: In Gmail, visit settings and click "always use https."

    4.) Avoid "Free Public Wi-Fi." Often, when you are looking for a hotspot, your helpful computer will indicate there are five or six networks nearby. Don't pick the first one, or even the one with the strongest signal. Pick the one that belongs to the establishment you are visiting.  Anything else could be a trap.  You should double-check the name of the network with the store, and stores should place the name prominently behind the register. Connecting to random accounts -- and having your computer connect automatically to networks with names like "linksys" -- sets you up for what's called an "evil twin" attack. (No, this is not a reference to a book of the same name). Criminals can set up rogue access points with attractive-sounding names, connect to your computer and then honor most Web browsing requests -- all the while logging your activity. The only way to avoid this is to manually connect to networks you know are provided by reputable firms.

    5) VPN.  Finally, the advice given by professionals to professionals is to use virtual private network tools -- VPNs -- when connecting to the Internet through public wireless networks.  VPNs offer an encryption-lined tunnel between your machine and a server somewhere else on the Internet which keeps your data free from prying eyes along that pathway.  Firesheep is powerless against VPNs. 

    The problem is VPNs require two pieces, and most consumers can't be bothered with setting up both.  A VPN client must be installed on the coffee drinkers' computer, and a VPN server must be set up elsewhere to accept the connection. People who work at security-conscious companies often have these installed for them.  It's possible to use your home computer as a VPN server, which would mean you'd essentially be surfing the Web from that machine when you were in your local coffee shop. But that's a bridge too far for most consumers.

    (Here's a great article with more on setting up VPNs)

    Several commercial companies have stepped up to fill this gap.  HotSpotVPN.com, for example, offers tunneling service for under $10 per month.  HotSpotShield uses a different model, providing free tunnel service in exchange for serving advertisements to users.

    But most average surfers won't want the ads or the subscription because they don't realize what's at stake, said Merritt, the Symantec  safety advocate. She thinks hotspot providers should shoulder a little more responsibility.

    "They should recommend that consumers look into using VPNs, perhaps right on their login pages," said Merritt. "They should provide information that consumers don't even know to ask about .... If consumers had greater awareness, they would be more concerned."

     

     -------------------------------------------

    "Five Red Tape Traps" is an occasional series which will focus on answering the most important questions consumer face in the 21st Century economy. Previously:

    Getting a credit score

    Avoiding checking account fees

  • New $5 ATM fee just the latest checking trap

    "Total Checking." "Value Checking." "MyAccess Checking." What do they all have in common? The word "free" is missing from the name.

    You are likely painfully aware that big banks like Chase, Wells Fargo, and Bank of America have ended no-strings-attached free checking accounts.  But if you had any questions about how restrictive -- or expensive -- those strings can be, consider Chase bank. Scarcely two years ago, we marveled at banks' efforts to inch fees up to $3 per withdrawal. Chase bank is now test-piloting $5-per-withdrawal fees for non-customers in Illinois. That's in addition to fees the consumers' bank charges. Soon it may cost $10 to grab $20 in a pinch.

    Once upon a time, consumers could expect to earn money by leaving their cash sitting in a bank.  Today, consumers must worry about their bank slowly bleeding money out of the account. The change is happening swiftly. Chase says it's converted around 8 million free accounts -- many former customers of Washington Mutual -- into "follow-our-rules-or-pay-up-to-$144-annually" accounts.

    It costs banks about $300 apiece annually to offer checking accounts, according to a recent study by Bretton-Woods. They used to recoup these costs by helping themselves to some $30 billion worth of overdraft fees from consumers. But now that the cash cow has been largely eliminated by new consumer regulations, banks are trying out new techniques to recoup this lost revenue.

    Just how far will banks be able to push fee-weary consumers?  That's unclear.  Earlier this month, Bankrate.com released a survey showing 75 percent of consumers earning $75,000 or more would rather switch banks than pay higher fees.  Overall, 64 percent of customers said they'd bolt.

    That ire may not translate into action, however, and banks know it.  A J.D. Power study released on March 1 found that, while consumers are switching banks at a slightly higher rate than in the past (8.7 percent last year, compared to 7.7 percent a year earlier), fees and interest rates have almost nothing to do with their choices.  "Pricing" impacted only 4 percent of consumers, the study found.

    This would not be a surprise to behavioral economists.  Consumers almost never consider fees -- particularly punitive fees like overdrafts or "your balance fell below $1,000" charges -- when making purchase decisions.  Nearly everyone suffers from what's sometimes called "magical thinking" -- as in, "I'll never misbehave and get hit by that fee."

    It's the shallow things that matter
    So what do people consider when switching banks? Big, impressive buildings and billboards seemed to matter most, the survey found.  Here's the depressing quote from the JD Power press release:

    "For customers evaluating and ultimately selecting a new bank, the most important factors driving their decision are advertising; branch convenience; products and services; promotional offers; and direct and indirect customer experience," it said.  

    That means you can expect higher fees, more buildings and more kooky ads from banks. 

    There was one positive note in the J.D. Power research.  There is evidence consumers do have their limits.  About 17 percent of consumers who switched banks said high fees or low interest motivated the breakup.

    Banks argue that it's not fair to say free checking has disappeared.  OK.  Let's just say NSA relationships with big banks are dead, replaced It's by accounts wrapped in red tape.  And remember, many of these rules can change at any time.  So here's five Red Tape Traps you'll find along the way to a free checking account.

    1) Soaring ATM fees
    We've already mentioned Chase's $5 experiment. Plenty of folks now pay $6 or $7 per withdrawal, when the ATM machine fee is added to their own bank's fee.  These fees are perhaps the best example of magical thinking at work.  Most folks think they'll be good about walking the extra block to access cash at their bank's ATM. But when there's a screaming kid in a stroller or an impatient date on the arm, you're likely to just pay the fee.  Even one so-called "foreign" ATM transaction with a $5 hit every month costs $60 annually. Be realistic: If your bank charges for such transactions, you should just budget $100 annually for ATM service.   But a much better choice is to find a bank that doesn't charge you.  For those ATM emergencies, you'll at least cut your ATM fees in half, and some banks -- USAA Federal Savings Bank, for example -- refund the ATM bank's fees.  There's no law preventing you from getting a secondary checking account with a new institution that you use primarily for accessing cash on the fly.  I recommend this kind of "allowance" account structure in Stop Getting Ripped Off.

    A few other creative efforts can cut your ATM fees. Get cash back when you shop at grocery stores with your debit card, although that's not my favorite way to use debit.  Better yet: Find fee-free ATMs. They're out there.  The WaWa convenience store chain offers them, and it recently performed its one billionth fee-free cash withdrawal.

    What it costs: Two "foreign" withdrawals per month -- $120

     

    2) Keeping your minimum balance
    Most account holders are familiar with the idea that they might have to do something -- maintain a minimum balance or direct deposit their paychecks -- in order to keep some level of service.

    But now, a single slip-up, such as a flurry of cashed checks that sink your balance to $998.43 for one afternoon, can be costly. With fees of $12 or more, the experience is not unlike getting hit with an overdraft.  The same advice you followed to prevent overdrafts applies here. Some banks let you link your savings and checking accounts to make sure you don't dip below that minimum.  Sign up for text message alerts so you can get early notification of a dangerously low balance, and log on to online banking to check your balance often. Stagger your regular payments so they hit after your paychecks. 

    The biggest Red Tape Trap of all, however, is the dreaded movable minimum balance. Consumers who once enjoyed fee waivers for keeping $500 in an account can see that minimum raised to $750 or $1,000. It's easy to miss a warning letter from the bank, and end up with one or two months of $12 fees.  The clearest hint a balance change is coming is an account name change (see below).

    What it costs: Two slip-ups -- $24

     

    3) Overdraft fee marketing
    The voracious overdraft fee animal isn't gone, it's just been put back in its cage. Until recently, consumers could incur $35 overdraft fees by making small purchases with their debit cards.  Today, those transactions are simply declined by the bank, or approved without the fee -- unless the bank has received explicit opt-in permission from the account holder. Banks have driven hard to trick consumers into giving up this permission, which is inappropriate for the vast amount of consumers. They've given it pleasing sounding names like "courtesy pay," "Buffer Zone," or "debit card advance,"  and plastered bank windows with pictures of smiling, attractive men and women who say they are relieved to have this peace of mind.  If you've been tricked into signing up for overdraft protection, un-sign up immediately.

     What it costs: Two overdrafts -- $70

     

    4) The name has changed
    The surest sign a new fee or restriction is coming is a name change -- either the name of your bank has changed because of an acquisition (like Washington Mutual becoming Chase) or the name of your account has been changed. Former Washington Mutual customers have seen their account names changed from "WaMu Free Checking" to "Chase Free Extra Checking" to "Chase Total Checking," which is totally more expensive than free. Ironically, a Google search for Washington Mutual still sends consumers to a Web page at Chase.com with the title "WaMu.com, home of WaMu Free Checking, is now Chase."

    Chase customers can avoid checking fees through a variety of methods -- maintaining a minimum daily balance, a high average balance, making at least one large direct deposit, or by paying a bunch of other fees.

    The amounts required -- at least one $500 deposit -- aren't Draconian, but the rules mean consumers have a lot of new things to keep track of. They will slip up, and pay. And of course, the rules can and will change.  Beware the notice that you've just been upgraded to "Complete Awesome Checking" or "Value Asset Acquisition Checking." You almost certainly are about to be hit with a new fee or rule.

    What it costs: Two mistakes -- $24

    5) The hidden cost of no interest
    Of course, requiring a minimum balance of $1,500 or so is itself a fee. That's money you could park in a high-yielding money market account earning interest.  Even a 1 percent interest rate would get you a smidge more than $15 on your $1,500, so that kind of minimum requirement amounts to a $15 annual fee.

    What it costs: Missed interest -- $15

    TOTAL TRAP COST: $253 annually.

     

    This entire column has been a not-so-subtle suggestion that you consider banking alternatives.  Online banks like ING Direct offer higher interest and fewer fees.   Credit unions and small banks still offer really free checking. In fact, BankRate.com just released a survey showing 38 of the 50 largest credit unions have free checking with no strings attached, and about half of them don't even require a minimum balance. Their ATM fees are, on average, half of traditional bank fees and one-quarter of the large credit unions charge no ATM fees at all.  

    That means there's no reason not to open a credit union account, even if it merely serves as a secondary checking account.

    Click here to follow Bob Sullivan on Facebook.

  • 5 Red Tape Traps: Getting a credit score

    You know you need to know your credit score, but how do you get it without getting shafted?

    Credit scores serve as the report card for consumer adulthood in America. But bad grades can cost you a lot more than embarrassment -- they lead to higher interest rates and fewer opportunities.  In one typical scenario offered up by MyFico.com, a 120-point difference in credit score could cost a home buyer with a $300,000 loan about $300 extra every month in mortgage interest, or more than $100,000 in additional interest during the life of the loan. So knowing your credit score is of paramount importance.

    You might have heard that Americans will enjoy increased access to their credit scores this year thanks to the massive financial reform bill passed by Congress last year. That's true, but scores are still a long way from being truly free. The Fair Access to Credit Scores Act forces lenders to divulge credit score information to consumers, but only after something bad has happened, such as a rejected application. That's a little like getting your cholesterol numbers from the doctor after you suffer a heart attack. 

    It's important to know your score before you apply for a car loan or a home loan, but for the foreseeable future, you'll have to pay for it. Here are five common Red Tape Traps you face getting your credit score, along with information on the right way to get it.

    1)      Many Web sites and TV ads say they offer your score for free. None of them are telling the truth. There's no way to get it for free.  With only slight variation, most free score Web sites require users to sign up for credit monitoring services that can cost $150 or more annually. Sure, there are free trial periods, but many consumers report trouble canceling the trial before their credit cards are charged and getting refunds.

    2)      Even when you do sign up with a "free" score service, the scores you receive are usually not the "real" credit score used by lenders, but an approximation based on a separate formula.  These imitation scores can vary by 100 points from the FICO score used by about roughly 8 out of 10 lenders.  That means their real value is suspect.

    3)      You can buy your "real" FICO score from MyFico.com. But it costs $19.95 for a one-time peek. And you'll have to hunt around for the chance to buy it. The MyFico folks are playing the same game everyone else does, teasing you on their home page with a big link that says "Free Instant Online Access" and entices you to fill out a bunch of forms. Once you do, you are hit with a $14.95 credit monitoring subscription. How any company can justify a home page link that reads "Free Instant Online Access" link, but connects to a final page button that reads "Make Purchase Now," is beyond me. Here's the correct link for a one-time purchase. If you have any doubts at all about your credit health, you should buy your score a couple of months before making a major lending decision.

    4) The term FICO score is a bit misleading. Consumers usually have three FICO scores, one for each credit bureau. Each bureau generates a score based on the FICO formula created by the Fair Issac company in the 1960s.Because the information in your three credit reports can vary, the three FICO scores can vary. You must pay $19.95 for each score, but in many cases -- if your three reports contain similar information -- purchasing one of the scores is good enough, says scoring expert John Ulzheimer, president of Consumer Education for SmartCredit.com.  Consumers in the South should opt for an Equifax score; all other consumers should purchase from Trans Union, based on the companies' geographic market dominance, Ulzheimer said.  

    For good measure, here's an even more confusing (and relatively recent) development -- MyFico.com users can only obtain two of their three scores, the FICO scores generated using Trans Union and Equifax data. Experian no longer allows the MyFico folks to sell their score, meaning there is no way for consumers to obtain this information prior to a purchase.  Two out of three will have to do. Remember, other services that sell credit scores can only approximate the FICO formula and score. And one final bit of confusion: while most lenders rely on these FICO-based scores, many lenders have their own, proprietary scores. There's no way to obtain them pre-purchase, either.

    There are tools which allow you to estimate your score for free, however.  Ulzheimer says consumers can create a "poor man's versions" of their credit score by obtaining their credit reports, then plugging the data into one of the tools offered by MyFico.com or Bankrate.com. The score ranges churned out by the tools are "pretty accurate," he said.

    The Fair Isaac folks even offer an iPhone app which offers a score estimating tool. You can read more about it at this link.

    5)      Don't confuse your credit score with your credit report. Both are important but are used very differently.  The best truly free way to deal with a potentially bad score before a purchase is to deal with the underlying issues that cause it.  Obtain a copy of your credit report at the only authorized source: http://AnnualCreditReport.com . Then, work to clean up the report one black mark at a time by disputing inaccuracies and paying off past-due balances. Here's an FTC tip sheet on the dispute process.

    ADDITIONAL RESOURCES:

    What's a good credit score? That's hard to answer: http://www.credit.com/blog/2010/04/whats-a-good-credit-score-these-days/

    Will you ever get a free score? http://www.credit.com/news/experts/2010-09-10/the-man-behind-the-fair-access-to-credit-scores-act.html

    Herb Weisbaum -- Free Credit Scores (for some): http://www.msnbc.msn.com/id/41159095/ns/business-retail/

    Liz Weston -- Free scores for all? Not so fast
    http://ht.ly/3TDsp

    U.S. government consumer info: http://www.pueblo.gsa.gov/cic_text/money/creditscores/your.htm

    Credit score basics from Fair Isaac: http://scoreinfo.org/

    --

    "Five Red Tape Traps" is an occasional series which will focus on answering the most important questions consumer face in the 21st Century economy. What traps have you found obtaining your credit score? What other basic personal finance questions do you have?  Respond below.