whac a mole retro.jpg

Blog

What to do when a data breach comes for you.

Retro version of the arcade game Whac-a-Mole

Whac-A-Mole, the Data Breach, and Me

My personal information was snared in the recent AT&T data breach. Basically, the scam-o-sphere now knows everything about me.

But the real rub is, I also responded to a phishing email from The Bank. In detail. I couldn’t believe I’d done that. (Cue shame and embarrassment.) Note to self: never respond to important emails until after you’ve had your morning coffee.

This was a next-level identity crisis.

And it hurt.

Once I realized what had just happened (and confirmed it with the real bank), I sprang into action.

What to expect when you ride the hamster wheel of potential identity theft

If you believe your personal data might have been compromised, you’ll need to act fast.

You’ll need to:

Change your passwords. I’ve got a lot of ‘em, and I changed every single one. Mac has a cool feature where you can access a pull-down menu of passworded accounts. You’ll find it in System Preferences>Passwords.

Alert the credit bureaus. You really don’t want scammers opening credit accounts in your name. So, reach out to the credit agencies and tell them what’s going on. There are three national credit agencies: Experian, TransUnion, and Equifax. If you notify one, they’ll automatically notify the others. (But I chose to contact all three agencies, because this incident triggered trust issues.)

They’ll ask you if you want to do a security alert or a security freeze. Fraud alerts give creditors and lenders a heads-up so they can take extra precautions confirming your identity before issuing you credit. Credit report locks and security freezes restrict your credit file so news accounts can’t be opened.

Notify Social Security. The rep from the Social Security Administration said my account wouldn’t be in danger because I’m not currently receiving payouts. But she did tell me to call the Federal Trade Commission (FTC).

Notify the FTC. Good luck reaching them by phone. I called several times, followed different prompts each time, and was always directed back to the website.

Notify the credit card companies. Instead of simply alerting the credit card companies, I went for the nuclear option: I had the banks issue new cards with new account numbers. It’s going to be an activation bonanza.

Set up credit monitoring. Buy yourself some peace of mind by signing up for a credit-monitoring service. If you were part of the AT&T data breach, you can call the AT&T Free Credit Monitoring Enrollment Line to get free credit tracking for up to a year.

But it won’t necessarily be easy.

When I called, the guy on the phone, Jason, said he needed to verify that I am who I say I am. He asked a bunch of screening questions which, ironically, made me feel safe and secure for the first time since this ordeal began.

But after the screening questions, there was another step: The Verbal Quiz.

Bad news for anyone who ever choked on a test.

More things I wish I’d done differently

Jason was a fast talker, and he fired a million multiple-choice questions at me. It didn’t feel like a simple quiz, it felt like an interrogation. These questions were a combination of recent facts (easy stuff) and ancient history – such as old cars, old addresses, old phone numbers. Old license plate numbers. Old roommates. Even the year my current dwelling was built. (It’s an apartment building. How would I know when it was built?)

Apparently, I gave a wrong answer.

To which Jason blithely replied, “We can’t verify your identity. Call back in 72 hours to take the quiz again.”

That’s right: I flunked the identity test. 

I flunked my own identity test.

The bottom line

Staying ahead of identity thieves is a high-stakes game of Whac-A-Mole. If you think your personal data has been compromised, act quickly. And if you played a part in getting your data into the wrong hands, go easy on yourself.

What’s done is done.

And remember, anything worth having, like your virtual identity, is worth protecting.

I just hope the thieves have to deal with Jason.

DATA BREACH RESOURCES

AT&T Data Breach Free Credit Monitoring Enrollment Line
(866) 346-0416
(833) 931-4853
att.com/accountsafety

Free access to your credit report every 7 days
www.annualcreditreport.com

Experian
(888) 397-3742

TransUnion
(800) 680-7289

Equifax
(888) 766-0008

Social Security Administration (SSA)
(800) 772-1213

Federal Trade Commission (FTC)
IdentityTheft.gov

Good Writing Isn’t Enough. Before You Hire a Copywriter, Make Sure You Both Agree—in Writing—on Exactly What You’re Buying.

Recently, I was hired to take over a project another writer started, but didn’t finish. It wasn’t a quality issue—the writer’s work was good. Really good. The situation centered around a serious misunderstanding about the fee.

The client thought the writer’s quote was for writing the entire website (about 25 pages in all). But, in reality, the fee was for writing just the first five pages.

Yikes.

This was a costly mistake. For the client, it set the project back almost a year. Who knows how much business was lost during that delay? For the writer, it was a potential source of reputational damage.

The Lesson for Someone Hiring a Copywriter

Since I wasn’t privy to the original proposal and correspondence, I won’t try to identify where the communication broke down or assign responsibility for what went wrong.

But I will point out the practical takeaway for anyone buying copywriting services:

It’s not enough to evaluate the writer’s portfolio. It’s equally important to look for clarity in how they define and price the assignment, as well.

What Should Have Happened Before the Writing Started?

This situation could have been avoided by tying the fee to a clearly defined, written scope of work—then explicitly confirming that both parties understood it before work began. “Website copywriting” leaves room for interpretation; “copywriting for five specific website pages” is much harder to misunderstand. A scope of work should spell out both the included deliverables and the exclusions.

 For example, these guardrails could have reduced the chances of things going sideways:

  • Name the five pages included in the quote. List each page individually rather than relying on a general description such as “website content.” Website copywriting agreements can define deliverables in page-specific terms.

  • Explicitly exclude the remaining 20 pages. If the writer knew the website contained 25 pages, the proposal should have stated that the quoted fee covered only five, with the other 20 requiring a separate agreement. Defining what isn’t included helps prevent misunderstandings.

  • Confirm the fee, timeline, and process for additional work before starting. Both parties should approve the same written scope, including how additional pages would be priced and scheduled.

 The writer could have used proposal language like this:

“This fee covers copywriting for five website pages, listed below—not the complete 25-page website. The remaining 20 pages are excluded from this quote and would require a separate scope, fee, and schedule. Please confirm that this matches your understanding before we begin.”

 And the client could have asked questions like this:

“To confirm: Does this price cover all 25 pages of my website? If not, exactly which pages does it cover?”

As the saying goes: An ounce of prevention is worth a pound of cure. The next time you’re buying copywriting services, make sure you and your writer agree on what’s covered—before the first word is written.


Deborah Klaus