What's All This We're Hearing About Equifax
Equifax. It should be something we don’t hear or think about much. But that’s hard to do lately. They messed up big-time. Hackers stole information on 143 million people. That’s almost half the U.S. population. The kicker is- they knew about it 6 weeks earlier but didn’t say anything- because they thought the “intrusion was limited.” Guess it wasn’t. In a USA Today piece, Equifax CEO Richard Smith assured us they “… are devoting extraordinary resources to make sure this kind of incident doesn’t happen again…” I’m feeling reassured- how about you.
So what is Equifax? It’s one of the three major credit reporting agencies (the others are TransUnion and Experian). Their business is to collect information about people, especially financial-related information: loans, credit cards, mortgages, etc. that you may have. They also have things like your payment history on your accounts, Social Security Number, names, addresses, date of birth, etc. This is a lot of information- all of which can be useful to someone wanting to benefit from your good name (and credit). Credit is where most of us run into these companies. Before someone will lend us money or issue us credit, they check our credit history with one or more of these companies. They work on the premise that past actions (by us) can predict future behavior. Paid our bills in the past- we probably will going forward. Didn’t pay them? Sorry- declined.
Besides the fact that it affects 140 million people, why is this such a big deal? It’s because the uses for this information are almost limitless, and there’s no possible way to put the genie back in the bottle. The information is out there and it will be forever. What kind of things can happen? We all think of someone getting a new credit card in our name. But that’s small potatoes. There’s a lot more they can do. They can “become you” (interesting term- synthetic identity theft). They can file fake tax returns. Apply for jobs using your SSN. They can cause problems with a mortgage, or deed for your home. They can tap your medical records- or maybe even use your health insurance. Starting to see the ramifications?
So what’s Equifax doing about this besides taking the above “extraordinary” measures? From a public relations standpoint, they haven’t done much well. They (and the other companies) offer a service called a “credit freeze”. It stops someone from looking at your credit report without your permission. Some states allow the companies to charge a fee for this (and another to remove it). In other states it’s free (NC is one). Now Equifax has waived the fees- but not initially. They also have a credit monitoring service that notifies you if something changes in your credit history (i.e. someone accesses it, or opens a credit card). They’re waiving the fee for this for now. But initially there appeared to be a clause in the agreement that prevented anyone using that service from being able to sue the company in court (a mandatory arbitration clause). That has now been removed. When you put a credit freeze on your account, you get a PIN number that you use if you need to unlock the freeze. Initially the number wasn’t random (and therefore potentially guessable) - they used the time of day you requested the freeze to generate the number. They are now generating them randomly and allowing folks who received them before to get new ones.
What should you do? This is tough- and complicated. It’s going to take some work on your part. And it’s not a short-term issue (remember- the information will always be out there). The people with the info don’t have to use it now. They can wait a year or two until we all relax. I’ve heard that a package of an individual’s information might sell for $30 on the market. My good credit for $30. What a deal. Here’s what the “experts” seem to be recommending now:
Were you affected by the breach? On Equifax’s site (www.equifax.com) you’ll find a link to see if they believe your data may have been compromised. You’ll need to enter your last name and the last six (6) digits of your SSN so they can match you.
Credit Reports: A first line of defense now is to check your credit report for fraudulent accounts. You can do this for free. No, not at freecreditreport. com. Instead, at www.annualcreditreport.com or 1-877-322-8228. Here you can get one free report annually (every 12 months from when last requested that report) from each of the (3) major reporting agencies. You can order all three at once, or one at a time over time. If you’d like a copy of an article I’ve written on how to request the reports and a strategy for monitoring your history over time, send me an email with “Credit Report Strategy” in the subject line. When you have a report, look for accounts you don’t recognize- especially if they’re new. See something? Contact the credit agency immediately.
Credit Freezes: You can stop creditors from accessing your credit report without your permission. You, current creditors, and government agencies (think subpoena or search warrant) can still see it. Credit freezes are good- but they have downsides, too. Besides the cost in some states ($5-$10 to initiate it, another $5-$10 to unfreeze it, and maybe another $5-$10 to permanently remove it), it means that any time you are applying for credit- a new card, car loan, mortgage, renting an apartment, starting a new job (in some cases), etc.- you have to remove the freeze temporarily. And it can take a few days for that to happen. So no more “instant credit”. While the current problem is with Equifax, you’ll need to put freezes on your accounts with the other agencies since you don’t know which one a credit request will go to. Different lenders may use different agencies- and they probably won’t look at more than one. So you need to go through the process of setting up the freeze, keeping your PINs (from each company) safe, removing when needed and making sure it stays on. For folks who are NOT applying for loans often, it’s not a big deal. For others- it’ll mean a bit more work. You can put freezes on your minor children’s accounts too- but you’ll definitely have some hoops to jump through. Please note: Equifax also offers a “credit lock” option. The “experts” seem to feel this isn’t the same thing and to avoid it. The other two agencies don’t seem to have this option.
Credit Monitoring: There are a number of credit monitoring services out there, including Equifax’s own, TrustedID, for which it is currently waiving fees. But that won’t last forever and other services will charge you, too. But if this brings some comfort, it may be worth it. Some services even offer assistance in correcting things if you are a victim of identity theft. The effectiveness of these services is something I can’t attest to. Sorry.
Some final thoughts, ideas, and wishes:
1. Below you’ll find links to some articles that have what I hope and think is good and useful information for navigating this mess.
2. Even if you’re lucky enough that you weren’t compromised this time around, you’re probably not out of the woods given the cumulative effect of all the other data breaches over time. You might want to consider doing all this in hopes of getting ahead of things.
3. One suggestion I read was that you NOT set up the credit freezes online, but rather call the agencies instead. Just realize, that for the time being, you may have a bit of a wait on the phone.
Equifax — 1-800-349-9960
Experian — 1‑888‑397‑3742
TransUnion — 1-888-909-8872
Innovis — 1-800-540-2505 (a fourth, smaller reporting agency)
4. Be very careful of phishing emails and phone calls related to this. You’re going to see emails about your data being used, or calls offering assistance from Equifax, etc. It’s just a different criminal element trying to get its share of the pie. Delete or hang-up. Call the agencies directly and ask them if there’s something you need to know. Basically, if you don’t initiate it, don’t trust it.
5. Remember- this isn’t a one month or even one year thing. You’re going to need to monitor your credit report regularly from here on out. The information is out there now.
6. See the Consumer’s Union link below for a list compiled by them of the fees, by state, charged for setting up and removing credit freezes. Do confirm this with a little more research as things might start changing in some states.
7. Lastly- what do I hope comes out of all of this?
a. I hope Equifax gets it head handed to it
i. The courts in the form of law
ii. Congress and regulatory oversight agencies.
iii. Maybe even businesses that use its services.
The cost to Equifax, and any of these other companies with data breaches (Target, etc.), needs to be so high that the cost of data security looks cheap in comparison.
b. We start the conversation, and process, of moving to a more secure system for identification than Social Security Numbers and 4-digit PINs. The SSN was never meant to be an identification tool. There was never anything secret about it. No system will ever be perfect, but given all the things a SSN and a little more info will give someone access to, something needs to change drastically.
If you have thoughts, comments, concerns or questions- please don’t hesitate to reach out by phone or email.
Please feel free to forward this to family, friends, and colleagues. We’re all in this together.
If they’d like to receive future articles on topics helpful to them, encourage them to visit my website (www.toddwashburn.com) where they can sign-up for this newsletter.
Some information that might be helpful:
1. https://consumersunion.org/research/consumers-unions-guide-to-security-freeze-protection-2/
3. https://lifehacker.com/how-to-find-out-if-you-were-affected-by-the-equifax-hac-1806121695
4. My article on using the free credit reports as an identity theft tool. todd@toddwashburn.com with “Credit Report Strategy” in the subject line.