Protecting Yourself After the Equifax Security Breach

What Happened:

On September 7th, Equifax — one of the three large credit monitoring agencies — reported that it had suffered a massive data breach by hackers. Worse, they reported that the hack had occurred five weeks previously, on July 29th. That data breach exposed credit information, social security numbers and other information on more than 143 million Americans and some foreigners. Why did they wait five weeks before telling anyone? Your guess is as good a mine. But a data breach that severe, followed by a five-week delay in letting consumers know about isn’t OK with me, and it shouldn’t be for you.

To put this kind of hack in scope, I’d compare it to Hurricane Irma: catastrophic, massive in scope and something that will take many of us years from which to recover. It shouldn’t be taken lightly. Anyone with access to your Social Security Number and a will to cause harm can do great damage. Don’t let them have that chance.

Experts recommend implementing two tools you can begin using right now to help protect and — in some cases — lock down your financial information:

  1. Sign up for free credit monitoring at websites like Credit Karma
  2. Freeze your credit reports at all three major credit agencies

Let’s take a closer look at each of these tools.

Credit Monitoring

Credit Karma is free and, in my opinion, far easier to use than the annual free credit report systems put in place by The Federal Government. They also give you full-time access to your credit scores, not just once a year. Nice touch. Once you’ve signed-up, you get access to current credit scores AND any activity or requests on your credit accounts, including loans and credit cards. That can help you stay on top of any odd behavior on your accounts. Here’s an example of how Credit Karma’s web page alerts you to activity on your accounts. Note the bottom of the image:

Credit_Karma.jpg

Credit Freezing

Securing our credit information is also known as implementing a “security freeze”. Taking such action doesn’t impact us from using our own credit cards or financial accounts: it simply prevents anyone else (in most cases) from accessing our credit information without our express permission. For example, when we apply for car loans, mortgages or rentals, our potential lenders and landlords usually run credit checks. However, once we’ve provided our Social Security Number and legal name, anyone with that information and the right level of access can access our credit information, if our accounts are not “frozen”.

Once we freeze our accounts, this isn’t possible, something that can help prevent identity theft.

If our credit files are frozen, even someone who has our name and Social Security number probably can’tobtain credit in our name. I say “probably can’t” instead of “never” because professional hackers and others with special tools and unique access might still be able to. But freezing our accounts makes casual and intermediate level identity theft much, much harder to accomplish.

How Credit Freezing works:

First, you should understand that, in most states, there’s a $10 free to freeze your credit account access and additional $10 fees to temporarily lift those freezes. Victims of crimes can have that fee lifted with the correct documentation, but I don’t believe the Equifax breach constitutes a crime. Perhaps it will be in the coming days.

To activate a credit freeze, you’ll need to write letters to all three credit reporting agencies requesting this action. You can find samples of those letters included in the link at the bottom of this post. When writing, you’ll need to provide proof of who you are, proof of where you live and include the $10 fee. Applications are supposed to take effect within five business days of your in-writing request, but given what just occurred to Equifax, I’m guessing it might take longer for them to comply. TransUnion and Experian should comply quickly.

Once a credit freeze is activated, any future credit check on your accounts will be denied. However, you might need to allow certain people access to your credit records. For example, if you’re applying for a loan or a rental, you’ll most likely need to let potential lenders and landlords have access to your credit records. To do so requires the following:

  • Contacting the credit reporting agencies by a method their choosing: phone, fax or internet.
  • Provide proper identification to prove who you are.
  • Provide a unique PIN or password, to confirm your account.
  • Specifying to whom your credit report will be accessible and for how long.
  • Paying a $10 fee for each temporary access you personally approve.

Is this a pain in the you-know-what? WIthout question. But it’s far better than having your credit info stolen, abused or compromised. And it’s certainly better than having your identity stolen.

If you have better solutions: please share them in the comments section. I think it’s worth discussing as a community. 

Here is the link you can use to learn more about the formal process, including sample letters you can use when writing to all three credit agencies

As a bonus, here’s a link to a great article from noted security expert Brian Krebs on the very same matter: https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/