A year after the massive data breach at Equifax, a new federal law will help consumers stop intruders in their tracks by requiring the three big credit reporting agencies to offer you an indefinite credit freeze, free of charge.
Just one year ago, consumers woke up and discovered that hackers had one heck of a field day with their Social Security numbers and other information in a massive data breach at Equifax.
Equifax’s screw-up would forever leave millions just that much more vulnerable to ID theft. Face it, it’s not like you can change the locks on the side door. Once hacked, your Social Security number is out there indefinitely.
Beginning Sept. 21, though, a new federal law will help consumers stop intruders in their tracks. The three big credit-reporting agencies — Equifax, Experian and TransUnion — will be required to offer you a credit freeze, free of charge. Such a freeze will restrict access to your credit file and help stop crooks from opening credit cards in your name.
How do you get a free credit freeze?
Under the new law, the Federal Trade Commission and the credit reporting agencies must set up web pages to make it easier for consumers to take advantage of their new rights. Those links will be in operation when the law takes effect Sept. 21, according to an FTC blog.
If you want a free freeze, you’d need to contact each of the agencies individually. Here are some current numbers:
Equifax’s automated security freeze system can be reached at 800-349-9960
Experian can be reached at 888-397-3742.
TransUnion is at 888-909-8872.
You’re going to need to supply data such as your name, address, date of birth, Social Security number and other personal information.
After receiving your freeze request, each credit reporting company will send you a confirmation letter containing a unique PIN (personal identification number) or password. Keep the PIN or password in a safe place. You will need it if you choose to lift the freeze.
Source: Detroit Free Press
Also starting Sept. 21, parents across the country will be able to get a free credit freeze for children under age 16, too. A child’s credit file would be frozen until the child is old enough to use credit.
Most Read Business Stories
- Protecting your Internet accounts keeps getting easier. Here’s how to do it.
- Renter boom: Apartments filling up faster in Seattle area than anywhere in the U.S.
- Mom jeans made women love denim again
- 'Delete' doesn't really delete your data in most programs | Patrick Marshall Q&A
- Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system | Times Watchdog
To be sure, the new law is but a minuscule response to the widespread outrage expressed by consumers just a year ago. Even so, it is a key step for regaining some control over our data.
Yet there’s a not-so-small challenge ahead: Many people may have no idea what a credit freeze is and how it works, according to new research by a team at the University of Michigan School of Information in Ann Arbor.
Some consumers wrongly think that a credit freeze stops them from using their own credit cards.
Perhaps some consumers associate a freeze with times that credit-card issuers send out new cards and stop us from using old ones because the numbers of the old ones have been breached. Perhaps others remember tips that once suggested putting your credit card in the freezer in a baggie to control spending.
In fact, a credit freeze stops many but not all businesses and others from reviewing your credit file.
The consumer who signs up for a voluntary credit freeze is given a PIN — a PIN that you want to keep track of — to use when you want to unfreeze that credit file in order to apply for new credit.
Under the new law, if a consumer asks for a freeze online or by phone, the credit-reporting agency has to put the freeze in place no later than the next business day, according to a Federal Trade Commission blog.
If the consumer wants to lift the freeze — for example, to finance a new phone or fridge — that has to happen within an hour.
Many times, people only fully understand a credit freeze once they’re actual victims of ID theft and told that a credit freeze is essential.
And what is a fraud alert?
Placing a fraud alert on your credit file actually means that you’re adding a red flag, if you will, to your credit report to alert a lender to carefully verify your identity before making a loan.
Under the new law, a fraud alert will last one year, instead of 90 days. If a victim of identity theft, you’d still be able to extend a fraud alert for seven years.
But all that jargon — freezes, locks, alerts — can confuse consumers who are already overwhelmed in their financial lives.
Florian Schaub, a University of Michigan assistant professor of information whose research focuses on security and privacy issues, said the credit bureaus don’t have much incentive to carefully explain things like credit freezes or fraud alerts.
After all, their business model is to collect and aggregate our information to provide to lenders who want to sell us loans.
“We, as citizens, are not their customers,” Schaub said. “What makes them money is sharing our credit reports with other businesses.”
Many times, particularly lower-income consumers wrongly believe that they have little reason to worry and don’t really need to protect their data after a breach, according to U-M researchers. Those consumers thought that scammers would target people who were more affluent.
“They would say ‘I’ve got nothing to lose. Why would an identity thief go after me?’ ” Schaub said.
But he said other research has shown that people of low socioeconomic status are disproportionately affected by identity theft.
ID thieves can see huge payouts using your stolen Social Security number for all sorts of things — including getting medical care or poaching your medical insurance, filing a fraudulent tax refund (which stops you from getting your refund cash until you clear up the matter), and filing for unemployment benefits or even Social Security benefits using your number.
Putting a credit freeze won’t stop all fraud, of course, including someone who tries to file a fraudulent tax return to collect refund cash.
The Equifax breach was significant because of the kind of data that was involved.
Breach last year
On Sept. 7, 2017, the major credit reporting agency announced a “cybersecurity incident” where crooks gained access to Social Security numbers, birth dates, names and addresses. And in some cases, Equifax noted that some partial driver’s license numbers were stolen, too.
The incident involved data for nearly 147 million people.
Without the change in the law, many consumers had to pay a fee of around $10 or so for each freeze they placed on their credit files — or $30 for putting a freeze with the three agencies.
Then there could be a fee of $10 or so for lifting that freeze when you wanted to take out a loan or open a credit card. Fees could be waived under certain circumstances, such as when someone has stolen your identity to open credit.
Under the new law, you can unfreeze your report at no cost, too.
Enabling consumers to get free freezes, of course, should encourage people who don’t have a lot of extra cash to consider putting a freeze on their credit.
After the Equifax breach, U.S. consumers — whether they were part of the breach or not — were allowed to sign up to freeze their credit reports at Equifax if they made a move before July 1. But the new law will go much further and offer free freezes indefinitely.
The key to all of this, of course, is that it’s up to consumers to lock that door.
“The level of vulnerability is pretty stunning,” said Chi Chi Wu, staff attorney at the National Consumer Law Center in Boston.
Wu said being able to obtain a free credit freeze for children could be more important than some families realize — even though children wouldn’t be part of a data breach such as Equifax.
“Children are lucrative targets for ID theft because they have clean records,” Wu said.
Even if not affected by a data breach, people should consider placing a credit freeze with each of the three credit bureaus after Sept. 21, as it substantially limits potential abuse of one’s credit report, Schaub said.
The new law — called the Economic Growth, Regulatory Relief and Consumer Protection Act — also provides that if you have guardianship, power of attorney, or conservatorship over an adult, you can get a free credit freeze for that person after providing proof of authority.
If you’re about to apply for a mortgage, a car loan or a student loan, don’t take out a credit freeze before you get the loan. If you do, you’re going to have to unfreeze that credit report before you can get approved for a loan. You’ll need to consider the hassle factor.
The Federal Trade Commission notes that your report could still be released to your existing creditors or to debt collectors acting on their behalf, as well.
And government agencies may have access in response to a court or administrative order, a subpoena, or a search warrant.