Last month, Citibank issued me a brand new MasterCard that I never requested. The card has a credit limit equal to roughly 40% of my current gross annual income, and both the card and its associated PIN were mailed to an address where I have not lived for over seven years. Thankfully, this happens to be my parents' old address, but it's quite possible that they could have sent all of this to my old Fredericksburg address, where I would only have found out about the card after a collection agency came after me because of some stranger's fraudulent purchases.

Here's the deal: I had a dormant Hecht's store charge card, which I used a handful of times when I was in college and had mostly forgotten about. As you might know, Hecht's was bought by Macy's not that long ago, at which point my Hecht's account transferred to Macy's as well. Well, this summer Macy's announced their plan to "flip" 3.5 million dormant store charge accounts to new Citibank MasterCard accounts. Apparently, this is legal under the fine print of the original Hecht's and Macy's store charge card agreements, though the agreements refer to this activity as "information sharing" between the store and the bank, rather than something more obvious like "giving you a seemingly unrelated all-purpose credit card many years from now when you least expect it". Without confirming the account holders' addresses^*, Citibank sent an opt-out mailing to all of the customers whose accounts were to be flipped. A couple months later, Citibank sent out the actual cards and PINs.

Apart from the fairly obvious risk of credit card fraud, this apparently has led to an unavoidable reduction in my credit score.

I finally got the card from my parents this past weekend, and I've already written a letter to Citibank asking that they close my account immediately. I could call them, but I'm afraid that they will want me to confirm my identity using out-of-date information. If I couldn't confirm my own identity on the first try, then I'm afraid this would only get more complicated. Plus, I was a little bit afraid that I might accidentally let Citibank know what I thought of them if I actually got to talk to a live representative, and that might have been counterproductive.

Anyway, here are the morals of the story:

• Citibank is sleazy. If you can help it, don't give them your business.
• Macy's is sleazy. If you can help it, don't give them your business, either.
• It's still illegal for credit card companies to send you an unsolicited card, but the definition of "reissuing an existing card" is a loophole big enough to shove 3.5 million MasterCards through.
• Check your credit report. You can do it for free once per year per credit agency, which means you can actually check your credit report three times a year.
• If your credit report says you have an account open that you are not using, close it. This is the only mistake that I made, namely procrastinating about closing the Hecht's account. I failed to appreciate the bad things that people can do to you when you leave an old account open.

* - I read one article in which a Citibank spokesman said that they had verified all of the addresses with "national postal databases". Obviously, they didn't do a very good job, and I think they should still be held accountable for putting their customers at unnecessary risk of identity theft.