After my license number was leaked in the Latitude breach I decided to put a credit reporting ban in place to provide extra protection. Having applied for a couple of banking products since then and having had the bans lifted a couple of times I am a bit disturbed by how easy it is.
To lift the ban you just fill out an online form with name, address, birthdate and license number - the same information that someone trying to steal my identity would have. Why isn't there some sort of two factor identification check? It seems like it would be pretty easy for someone else to lift the ban in order to access credit in my name, and even though I would realise quickly that something was wrong when I received the confirmation email that the ban had been lifted it would be difficult to do anything about it.