12

The FTC recommends those who may be impacted by the Equifax data breach do the following:

  1. Check credit reports at annualcreditreport.com.

  2. Enroll in the 1 year of free credit monitoring provided by Equifax.

  3. Place a credit freeze or a fraud alert on your files.

  4. Monitor existing credit and bank accounts closely.

  5. File taxes early.

These seem inadequate to me because:

  1. Annual credit reports are far too infrequent to catch bad guys in time.

  2. You need more than 1 year of protection.

  3. Credit freezes and fraud alerts both make my own life harder when opening new accounts.

  4. Monitoring existing accounts doesn't help protect against new fraudulent accounts.

  5. Filing taxes early doesn't address all the other issues besides fraudulent tax returns.

  6. Bank accounts, phone lines, mortgages, etc. all need constant monitoring, not just credit lines.

What else can I do to help protect my identity against this data breach while addressing the above shortcomings?

|improve this question
  • Considering the extensive nature of data stored by the credit bureaus, and the expansive scope of the Equifax data breach, the inconvenience and expense of a credit freeze may be the only practical response. – ChuckCottrill Sep 10 '17 at 4:36
  • @ChuckCottrill: It's not clear to me why that's necessary. It's not like someone can (say) apply for a credit card in your name and receive the card in the span of 1-2 days. If you just get an email notification in the meantime there should be plenty of time to act, right? – Mehrdad Sep 10 '17 at 4:47
  • 2
    Why does it matter what the FTC recommends? If the FTC cared about any of our data we would have the ability to prohibit all of these garbage big data brokers from maintaining anything about us to begin with. Credit reports and credit scoring exists to benefit lenders, why is it up to us to protect our data when they house it, ESPECIALLY if we can't prevent them from housing it or even so much as be notified when it's being housed? (This is probably an entirely offtopic comment). – quid Sep 11 '17 at 21:41
  • 1
    @quid: Because if I didn't put what the FTC recommends then someone would have complained and told me to do exactly what the FTC recommends. You just can't win on these sites. – Mehrdad Sep 11 '17 at 21:57
  • 1
    Security and accessibility are always going to be at odds. The very barriers that prevent criminals from screwing you also slow your own access/require your attention. For example, you say monitoring your own accounts (#4) doesn't protect against new fraudulent accounts. That's true, but setting up a credit freeze (#3) does by making it harder to open such accounts. This isn't a list of things to pick and choose from, you need to do all of them if you want to be really secure. And yes, that will mean making your own life difficult. The price of freedom is eternal vigilance, and all that. – Steve-O Sep 12 '17 at 14:55
6

Services like Credit Karma and Credit Sesame are free and will alert you to new accounts. Not as good as a freeze but zero pain.

|improve this answer
  • +1 I just heard about Credit Karma yesterday and tried it, hopefully it'll work. Wasn't aware of Credit Sesame though. Thanks! – Mehrdad Sep 9 '17 at 23:24
  • When you pull up your Equifax report in annualcreditreport.com it presents a link to Credit Karma that will allow the information to be linked automatically. – SDsolar Sep 15 '17 at 23:54
3

It's worth pointing out, because none of the other answers address this, credit alert monitoring is not done in real time. None of the credit monitoring/identity protection services, including those offered by the bureaus themselves, guarantee real time notification. If/when you are notified of a new account it likely has already been days or weeks since the credit pull.

Your assertion in the comments to your question that It's not like someone can (say) apply for a credit card in your name and receive the card in the span of 1-2 days. If you just get an email notification in the meantime there should be plenty of time to act, right? assumes real time notification with a wide enough window for you to act and stop the account from opening. It also assumes efficiency on the part of the lender to be able to stop a new account once the opening process has begun; for credit cards specifically, once that process is started there's likely no mechanism for the bank to pull the card out of the issuing process. It also assumes the credit pull happened at one of the big three reporting bureaus directly, not from a less expensive less real time data set compiled from credit bureau information.

The sad reality is even a credit freeze cannot, with certainty, stop an account from being opened in your name. Once in my life I was erroneously reported deceased, the wireless phone provider that I learned this from simply wanted a deposit to open the account and wasn't terribly concerned that the reporting bureau thought I was dead and my record was frozen.

Monitoring is a good initial step, it is not to be relied upon but it's better than nothing; just approach it with the knowledge that notifications will not be real time. Monitoring for free by Credit Karma and the like monitors less real time aggregated data. Paid monitoring didn't notify me of my new credit card last year. Monitoring services, and the bureaus (including Equifax) will make a fortune in the wake of this blunder, though Equifax will likely have to pay a penalty of some sort at some point down the road, not the the people exposed, but to a government body.

Separately, and probably much more alarming, there is a lot more to identity theft than credit cards and loans -- tax returns, employment, healthcare, driver's license, car insurance, etc.

|improve this answer
  • +1 wow, this was quite eye-opening, thank you. Short reply to something you mentioned: I don't expect the part about "efficiency on the part of the lender" should be a problem, right? They act quickly when you report a card as stolen, and I'd expect this to be similar? – Mehrdad Sep 11 '17 at 22:28
  • 2
    Not necessarily. An acquaintance of mine was recently delivered a few credit cards he did not apply for. He pulled his credit report, called the banks involved, for the cards he had not yet received. Two of them were unable to cancel a card that had not been activated yet. One card that had not been issued could not be stopped from being issued. A card that has been activated and lost is a lot different than a card that has been created and mailed or yet to be mailed, but not ever activated and used. – quid Sep 11 '17 at 22:32
  • Wow, this is ridiculous. Thanks for sharing all this! – Mehrdad Sep 11 '17 at 22:32
  • @Mehrdad, I'm sure they'll all get better at this as this sort of data breach becomes more frequent. But at this point, and from my experience, they are not terribly efficient. Also, it's worth pointing out, that you don't have liability on cards opened fraudulently, it's just a bit of a headache but you shouldn't have financial liability (in the US anyway). – quid Sep 11 '17 at 22:37
  • 1
    Neither do I :( – Mehrdad Sep 11 '17 at 23:43
2

-- EDIT FOR BREAKING NEWS--

Due to the Equifax breach, http://www.annualcreditreport.com will now allow you to run all three of your reports and provide opportunities for you to dispute adverse or incorrect items, for free, even if you have already used them within the last year. It will allow you to see your reports from the three major agencies. Plus, the Equifax report includes a link to Credit Karma which will give you your FICO score at no charge.

------------------------------------------------------------------------------------------------------

ANSWER:

According to this article:

Equifax breached, up to 143 million SSNx and DOBs stolen, all Americans offered credit monitoring

Excerpt:

Massive multinational credit reporting company Equifax has been breached by hackers, with up to 143 million U.S. residents having their names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers stolen from the company’s databases.

They direct you to this address to enroll in their identity theft protection by going to https://www.equifaxsecurity2017.com/

I believe the answer is that to answer the first part of your question(protect myself) is to get credit protection so you will be notified when new credit is taken in your name.

For Non-US customers: If you do not have a SSN, call 1-866-447-7559. The call center is open every day from 7a.m. to 1 a.m. Eastern time.

You can use http://www.annualcreditreport.com/ to look at your credit reports. They are not limiting it to annual due to the breach at Equifax.

HINT: While you do that, and while you are in the TransUnion and Equifax reports you will have the option to DISPUTE adverse items.

I always suggest that people dispute everything adverse. That puts the onus on the other parties to produce evidence to TransUnion within 30 days attesting to the validity of the adverse item.

You would be surprised how many will simply drop off your report after doing this.

Here is a direct way to get to TransUnion:

https://dispute.transunion.com/dp/dispute/landingPage.jsp

--> Once they have removed the adverse items, it is communicated to the other bureaus.

It is amazing how well it works. It can raise your credit score significantly.

You asked about risk aversion (not making your life miserable), so here are two risks to consider:

The risk of doing nothing about it:

Were you impacted by the Equifax breach? You risk financial chaos by doing nothing (MarketWatch)

  • Financial identity theft
  • Criminal Identity Theft
  • Many victims don’t have the time and money to sue
  • Your data may have already been breached

The (now-nullified) risk regarding class-action lawsuits:

Equifax TrustedID customers waive their rights to a class-action lawsuit

Excerpt:

created a website that would allow consumers to check if they were affected. Customers who were told their personal information may have been impacted were given the following message: “Click the button below to continue your enrollment in TrustedID Premier.”

There was one worry: Those who signed up to this TrustedID Premier security monitoring service for a year appeared to waive their rights to participate in a class-action lawsuit.

That risk has now been clarified as non-existent:

Consumer Backlash Spurs Equifax To Drop 'Ripoff Clause' In Offer To Security Hack Victims

Excerpt:

Direct quote from Equifax:

"In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."

Lawsuit potential:

As it turns out, EquiFax neglected to apply patches to their Apache servers which may have caused to happen in the first place:

Failure to patch two-month-old bug led to massive Equifax breach

Excerpt:

"Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted," company officials wrote in an update posted online. "We know that criminals exploited a US website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement."

Also,

Equifax hackers stole data for 200k credit cards from transaction history

Thus, there is every reason to expect multiple lawsuits.

|improve this answer
  • How effective would the TransUnion services you suggest be, given that this was an Equifax breach? – Mehrdad Sep 9 '17 at 4:20
  • With the disputes, once one bureau takes them off, it is communicated to the others. The three bureaus are constantly cross communicating. The dispute thing is very important and it works. Everybody should do it. As for the breach, it is over and done with. Finished. Period. The end. The data is out there. Everything. todo. --> Equifax itself is unaffected. --> But you could be affected in the future. All you can do it set up so you get notified if someone tries to use it. But for now, I highly recommend you take the moment and get your credit report cleaned up. – SDsolar Sep 9 '17 at 5:34
  • Makes sense, except I've already used my freebie credit reports this year, and what I'm still not sure about is whether I could necessarily expect see everything on a TransUnion report if I were to obtain another one for a fee. Would I need to get a report from every company to cover everything, or does TransUnion suffice? is what I mean. – Mehrdad Sep 9 '17 at 5:42
  • 1
    Then you can use the direct Transunion link. Also, I believe annualcreditreport.com is waiving all that because f this breach. It appears that Equifax was completely cleaned out, which means nearly everybody in the country. But no matter; just use the Transunion link. It works. – SDsolar Sep 9 '17 at 11:42
  • 1
    As far as I have heard, only Americans with SSNs were targeted. But that may be due to news bias - I am reading American news. In the case of UK customers I highly recommend the phone number: 1-866-447-7559. The call center is open every day from 7a.m. to 1 a.m. Eastern time. – SDsolar Sep 11 '17 at 21:32
1

Please refer to this earlier question about what actions to take when you become aware that your private information may have been exposed by a data breach.

The data exposed in a data breach is limited to the information the party breached has transported or stored. This information is typically limited to directory information (name, address, telephone, etc), may include financial information (income, specific account information, possibly credit card information), or may include private information (such as health information, and even SSN). Some notable data breaches (e.g. the Target breach), have exposed financial information such as credit card numbers. But a data breach at one of the credit bureaus could expose far more extensive information. Should the attacker(s) gain access to detailed credit file information, they could potentially use the information to open new lines of credit, or access existing accounts.

This Equifax breach is vast in scope (143M people affected), and it is still unclear exactly how much private or financial data was exposed for each person. Reports have suggested that the breach was ongoing, and was found at the end of July. This means there has been a delay of over 1 month where individual's data has been exposed and individuals were left uniformed. Considering the delay in providing information and the lack of clarity regarding the extent of information, a prudent person should immediately freeze their credit at all three bureaus. Credit monitoring will only tell you when someone tries to appropriate your identity and use your credit. Until we know the full scope of data exposed, the safest thing to do is assume the worst.

The amount of data that credit bureaus keep about individuals is extensive, and exposure of that data could affect credit, insurance, employment, and other areas. Expect that the fallout from this breach could be vast.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.