CONSUMERS

LifeLock used to electronically track Arizona woman

Robert Anglen
The Republic | azcentral.com
  • A Gilbert woman says her ex-husband used LifeLock to electronically track her for two years and across several states
  • Suzanna Quintana said LifeLock alerted her ex-husband when she applied for credit, opened accounts and other financial activity
  • Tempe-based LifeLock apologized and promised a comprehensive review of policies and procedures after contacted by The Republic
  • LifeLock officials acknowledged that they failed to work with law enforcement in a timely manner
Suzanna Quintana, 47, of Gilbert. She says her ex-husband used LifeLock to secretly stalk her financial moves for years after their divorce.

A Gilbert woman says her ex-husband used LifeLock's credit-monitoring systems to create an account in her name and secretly track her every financial move since their separation two years ago.

Suzanna Quintana, 47,says that when she applied for credit cards, leased a car, signed a cellphone contract and opened a bank account, her ex-husband received e-mails and alerts detailing the activity.

"He knew everything I did," she said. "I had no idea about all the things he knew."

Quintana said when she discovered the bogus account in March and alerted LifeLock,  company officials, from customer-service representatives to managers, ignored her. She said they didn't respond to e-mails, delayed responses and denied her access to the account so that critical records were lost.

LifeLock describes itself as an industry leader in identity-theft protection services, promising on its website to give people "a sense of confidence to live freely in an always-connected world."

Days after being contacted by The Arizona Republic in November, officials with the Tempe-based company apologized to Quintana and acknowledged they were slow to respond to law-enforcement officers investigating the complaint she filed against her ex-husband alleging identity theft and cyberstalking. They offered to cover Quintana's legal fees and said LifeLock is reviewing its procedures.

Quintana's records show LifeLock allowed her ex-husband to track her new and existing accounts, credit score, credit reports, financial activity and public records.

Through LifeLock's fraud-detection system, Quintana's ex-husband also would have had control over her financial activity and been asked to review each transaction or initiate a fraud investigation.

"They didn't listen to me. It's almost like they didn't believe me," Quintana said. "They did not want to admit what they'd done. Since they are an identity-protection company, it was not in their best interest to admit my identity wasn't protected. They tried to shift the blame to me."

A LifeLock executive on Nov. 9 said the company was conducting a comprehensive review of procedures to ensure better protection for spouses and to work with law enforcement in a timely and effective manner.

"We’re distressed that someone was able to use our service to victimize his (ex-)wife,"  Kelley Bonsall, LifeLock's vice president of media relations and corporate social responsibility, said in a statement. "There’s often little a company can do to stop someone who is intent on causing harm using the personal information of a partner, but we owe this victim an apology because we did not assist her with the speed and care that the situation required."

Julio Quintana said in a phone interview earlier this month that  he wasn't "at liberty to discuss" LifeLock or his ex-wife's allegations. Julio, however, said he was the victim of a harassment campaign orchestrated by Suzanna.

Julio, who owns Wild West Properties in Sheridan, Wyo., declined to comment on records showing that he had opened the LifeLock account in his wife's name and that alerts about her activities still were being sent to his e-mail this year.

Sgt. Mike Gale of the Sheridan County Sheriff's Office confirmed his office investigated stalking claims against Julio Quintana. He said the case recently was submitted to the County Attorney's Office to review what, if any, charges would be filed.

Gale would not discuss any findings but said LifeLock did not make the investigation easy. He said the company didn't immediately turn over records. E-mails show Gale repeatedly asked LifeLock for documents in June and was still waiting for them more than a month later.

"The information is necessary for me to obtain a search warrant," Gale wrote to a Lifelock official on July 24. "As the days and weeks go by, I fear that the information in my affidavit may go stale."

Gale said on Nov. 9 that he eventually received the records he requested.

"The timeliness of the information from LifeLock wasn't to my satisfaction," he said.

Spreadsheet discovered

It's unclear when the LifeLock account was opened in Quintana's name. Quintana said investigators told her Julio said the account was a fluke; that he had opened it while they were still married and just hadn't closed it.

The core of LifeLock's service is fraud detection that costs $9.99 to 29.99 per month. It alerts customers by phone, e-mail or text when activity occurs on their accounts.

If they tell LifeLock the activity is suspicious, the company promises to respond with a team of interdiction agents to trace the activity, report it to financial institutions and restore credit reports.

Lifelock

Quintana said her accounts never were blocked. Instead, she said, her ex-husband was able to use LifeLock to scan and record her every move on a spreadsheet he kept in his computer.

Suzanna said she separated from her husband in 2013 after 16 years of marriage. She and her two sons, now 12 and 14, left Sheridan and moved into her mother's Gilbert home. She filed for divorce in 2014, and it was finalized in June.

Quintana said one of her sons discovered the LifeLock account and the spreadsheet by accident during a visit to his father's home in March. She said he was playing on the computer when he found a five-page Excel file documenting her bank accounts, credit cards and other financial activity.

Quintana said her son uploaded the file to the cloud and showed it to her when he returned home. Quintana said she was stunned by the depth of information, which included passwords and answers to security questions.

Quintana said among the spreadsheet's rows and columns was an entry for LifeLock. Quintana went online and found the account had been set up using her Social Security number and other private information and that her ex-husband was paying for it. Alerts were sent to his contact number and e-mail.

She said she changed the LifeLock user ID and password to lock out her husband from the account. She changed the user ID to "ImontoyouJulio," records show.

She then contacted authorities and sought help through the court system. On March 26, Quintana obtained an order of protection against her ex-husband specifically prohibiting him from accessing her financial information.

"This would include in-person contact with companies or doing so telephonically or cyber stalking," a Gilbert Municipal Court judge wrote, adding that Julio Quintana was not allowed to contact any companies about his ex-wife's accounts, including "credit card companies, LifeLock, credit agencies, bank accounts, e-mail address, Facebook, etc."

Company under scrutiny

LifeLock officials said Quintana's is the second case in which the company's services were alleged to have been used to stalk a victim.

"While every case is different and this type of fraud is unusual, we do know about a case from earlier this year that had some similar characteristics," Bonsall said. "It's very difficult to prevent a spouse who has access to personal information from misusing a service if they are determined to do so."

LifeLock's business model centers on a pledge to protect its customers. The 10-year-old publicly traded company has faced government lawsuits and consumer complaints alleging false marketing claims and security services it didn't deliver.

Last month, company officials announced they were putting aside nearly $120 million to settle a class-action lawsuit filed by consumers and claims filed by the Federal Trade Commission and a group of 35 state attorneys general.

The FTC accused LifeLock in July of deceptive advertising and of violating terms of a 2010 settlement.

Federal regulators said from 2012 to 2014, LifeLock falsely claimed it provided alerts to customers as soon as it received an indication of a problem. The FTC also said the company falsely advertised that it protected its customers' data with the same safeguards as financial institutions and failed to establish a security program to protect the sensitive data of users.

LifeLock's CEO published his full Social Security number on the company's website and billboards in 2008 as a challenge to identity thieves. In a little more than a year, LifeLock's revenues rose to $35 million from $2 million and its customer base rose to 500,000 from 30,000.

In 2010, LifeLock agreed to pay $11 million to the FTC and $1 million to state attorneys general to settle charges it promised identity-theft protection and security safeguards it couldn't deliver. Federal regulators said the company's data system was vulnerable and could have been exploited by those seeking access to customer information.

LifeLock last year suspended its new mobile app over security issues and because the system didn’t comply with credit-card security standards.

LifeLock reported a net quarterly loss of $65.1 million in October, mostly related to money set aside for proposed settlements. It reported $152 million in revenue, up 24 percent from the third quarter of 2014.

Inaction and delays

Quintana said she thought once LifeLock officials heard her story, they would be eager to help.

But she said LifeLock officials blocked her from full account access because of privacy concerns over her ex-husband's billing information.

"I had this overwhelming feeling that nobody was taking me seriously," she said. "Like this was the 1950s or something and that this is something I should just live with."

Quintana said company representatives blocked her from obtaining account records to turn over to law enforcement. She said she was able to capture more information using screen shots than with what the company provided.

And then, she said, her ex-husband closed the account.

Quintana said she fought with LifeLock to keep open the account, at least long enough to get copies of the records. She said company officials told her the best way to preserve records in the old account would be through a new account in her name.

"They told me I could have all of the account info and then they did a flip-flop and told me I couldn't get the information once an account was closed," she said.

In a May 12 e-mail, LifeLock manager Maurice Fogel told Quintana he was reviewing her account "in order to determine the status, including the history of your previous profile." About a week later, on May 18, he told her the data was inaccessible.

"I have been advised by my technical support teams that when an account is cancelled and then reinstated following cancellation, past records from the old profile cannot be retrieved or made available online," he wrote.

Fogel told her in another e-mail the records were still available "to any law enforcement agency or via a subpoena."

But e-mails show Sgt. Gale also had trouble getting LifeLock to respond. They show Lifelock officials reneged on promises to provide records.

"I can only speculate on any reasons for the delays, but I want to assure you that my interest and jurisdiction in this investigation concerns only Julio Quintana," Gale wrote in his July 24 e-mail to LifeLock.

Company apology

LifeLock officials said in their apology letter that they will work with "organizations dedicated to preventing cyberstalking and domestic violence" as part of its policy review.

LifeLock has offered to cover Quintana's legal fees as "a gesture of apology and support."

Quintana said LifeLock's apology distorts the situation and is worded to minimize the company's role.

She is especially angry that the company insisted on referring to this as a dispute between a husband and wife and didn't acknowledge that she and her ex-husband were separated and living in different states.

Quintana said the apology doesn't reflect the reality of her situation, "which is that my estranged and then ex-husband, whom I have a protection order against, was ... hacking into my entire life."