Equifax Data Breach: What you need to do

The recent hacking of credit reporting giant Equifax has put as many as 143 million Americans and some U.K. and Canadian residents at risk of identity theft. The security beach includes names, Social Security numbers, birth dates, addresses and other private information. In addition, credit card numbers for about 209,000 U.S. consumers and dispute documents with personal information for around 182,000 consumers may have been accessed.

Equifax says it will be mailing letters to people whose information is included in the breach. This is helpful, but records sometimes contain erroneous or outdated address information, and despite the best efforts of Postal Service employees, letters do sometimes get lost in the mail. A quicker way to check is to visit the web page Equifax has set up for this purpose at  www.equifaxsecurity2017.com. Because this service will require you to provide personally identifying information, you should only access it from a secure computer using an encrypted network connection.

This service will tell you if your data “may” be at risk. Despite the ambiguity of this language, claims that it will return an affirmative in every case are unfounded. It has returned affirmative and negative responses to different consumers. It is likely that the company used the term “may” because they wished to err on the side of caution.

If you are told that your data may be at risk, you will be offered a chance to use Equifax’s credit monitoring service, TrustedID Premier for free for one year.

Should you sign up for TrustedID Premier?

As it was originally set up, a person wishing to use TrustedID Premier would need to agree to Terms of Service that included an arbitration clause. The problem with arbitration clauses is that they can impair the ability to file a legal claim in court or to join in a class-action lawsuit.

Equifax has since removed the arbitration clause from the www.equifaxsecurity2017.com website. It has issued a statement clarifying that Equifax’s general Terms of Service do not apply to the TrustedID Premier service:

We’ve added an FAQ to our website to confirm that enrolling in the free credit file monitoring and identity theft protection that we are offering as part of this cybersecurity incident does not waive any rights to take legal action. We removed that language from the Terms of Use on the website, www.equifaxsecurity2017.com. The Terms of Use on www.equifax.com do not apply to the TrustedID Premier product being offered to consumers as a result of the cybersecurity incident.

A quick glance at the Terms of Use at www.equifaxsecurity2017.com confirms the clause has indeed been removed. This should alleviate concerns about losing the right to litigate claims or join in a class action lawsuit against Equifax.

The benefits of enrolling in TrustedID Premier are: (1) free copies of your Equifax credit report; (2) credit file monitoring and automated alerts of key changes to your Equifax, Experian and TransUnion credit files; (3) allows you to prevent access to your Equifax credit report by third parties (to some extent); (4) searches suspicious web sites for uses of your Social Security number; (5) gives you up to $1 million in identity theft insurance.

The TrustedID Premier service will not prevent access to your credit file at Experian, TransUnion or other credit reporting agencies. It also will not prevent access to your Equifax file by government agencies; by companies reviewing your application for employment; by companies that have a current account or relationship with you; by collection agencies acting on behalf of a creditor; by companies that wish to make pre-approved offers of credit or insurance to you; for fraud detection and prevention purposes; or by Equifax.

The identity theft insurance could be a worthwhile benefit, but be sure to read the terms, conditions and exclusions in the policy carefully.

Is signing up for TrustedID Premier enough?

Unfortunately, if you are one whose data may have been breached, signing up for a free year of TrustedID Premier probably is not enough. It is only free for a year, but it can and often does take more than a year for stolen data to be used or offered for sale on the Dark Web. The threat of identity theft due to a data breach like this could be life-long. Moreover, as the TrustedID Premier website points out, the service will only enable you to prevent third-party access to your Equifax credit file, not those of other credit reporting agencies.

Credit freeze

Even if you sign up for TrustedID Premier, you should also consider setting up a credit freeze if you are among those who may be affected by the data breach. This restricts people from accessing your credit reports and scores. Because lenders check credit reports before approving applications for loans and credit, a credit freeze can go a long way toward preventing an identity thief from opening new accounts using your personal information.

Initiate the process by contacting credit reporting agencies. The three major ones are:

  1. Equifax — 1-800-349-9960
  2. Experian — 1‑888‑397‑3742
  3. TransUnion — 1-888-909-8872

A small fee may be required. If you have already been a victim of identity theft, you can initiate a credit freeze for free by providing copy of your police report or such other supporting documents as may be required in your state. Some states grant discounts to seniors over 65 and minors.

When the freeze is implemented, the credit reporting agency will send you a PIN code or password. These will be needed if you ever want to lift the freeze, so keep them in a safe place.

In most states, the freeze will remain in effect indefinitely. In a few states, it will automatically expire after a specified number of years.

A credit freeze will not affect your credit score, but you will not be able to open new credit accounts unless and until you lift it. If you temporarily lift the freeze (such as for a potential employer, etc.), you may need to pay a reinstatement fee.

During a credit freeze, your credit report may still be obtained by you; your current creditors and their collection agents; and persons acting pursuant to a court order, subpoena or search warrant.

An alternative to a credit freeze would be to place a fraud alert on your credit files. This warns creditors that the subject of a credit report may be a victim of identity theft and that they should verify the identity of the person seeking the credit. This is not as effective as a credit freeze because it does not prevent a careless or unscrupulous creditor from going forward with a credit transaction despite the warning.

Review your account statements

A credit freeze will not prevent identity thieves from using existing credit card and bank accounts to make unauthorized charges or withdrawals. Accordingly, even if you sign up for TrustedID Premier and/or a credit freeze, you should also monitor your account statements regularly for suspicious activity.

Exercise your right to a free annual copy of your credit report

Whether you sign up for TrustedID Premier or not, you have a right to one free copy of your credit report from each of the credit reporting agencies (Equifax, Experian, Transunion.) You may do this at annualcreditreport.com.

Don’t take bait from phishers

After a major data breach like this, “phishing” and other email scams are likely to proliferate. Phishing is a kind of scam in which a person pretends to be someone else in order to get someone to visit a website and/or divulge private information like their birth date, Social Security number, or the like. You can count on a flurry of phishing activity by identity thieves who will be sending emails fashioned to look as if they are from Equifax, a government agency or a fraud prevention or identity theft protection outfit of some kind. Don’t take the bait.

More information

For more information about what to do about identity theft, visit this FTC website.