Arizonia PIRG Education Fund
A never ending stream of news reports about data breaches – including T-Mobile, Target Corporation, the IRS, numerous Blue Cross Blue Shield and other health plans, the University of Maryland, and the U.S. Office of Personnel Management (OPM) – is a constant reminder that you’re at risk of a data breach and therefore, identity theft if you:
- Shop with credit or debit cards;
- Pay taxes;
- Have health insurance;
- Attend college;
- Patronize any business that keeps customer records; or,
- Work for the government or a company
These constant breaches reveal what’s wrong with data security and data breach response. Agencies and companies hold too much information for too long and don’t protect it adequately. Then, they might wait months or even years before informing victims. Then, they make things worse by offering weak, short-term help such as credit monitoring services.
The first defense against any kind of identity theft is to be vigilant about protecting your personal information by taking steps like creating secure passwords, installing anti-virus and anti-malware software, and shredding personal documents. (See Appendix A for more tips on protecting your personal information.) However, if and when someone does steal enough of your information to commit identity theft, there is really only one type that you can stop before it happens: New account identity theft, where someone opens a new account in your name. All other types of identity theft and fraud, at best, can only be detected after the fact. Unfortunately, the services and steps that are most offered and recommended to consumers are the ones that only detect identity theft or fraud but don’t stop it.
Peace of Mind
Whether your personal information has been stolen or not, your best protection against someone opening new credit accounts in your name is the security freeze (also known as the credit freeze), not the often-offered, under-achieving credit monitoring. Paid credit monitoring services in particular are not necessary because federal law requires each of the three major credit bureaus to provide a free credit report every year to all customers who request one. You can use those free reports as a form of do-it-yourself credit monitoring.
Credit monitoring only lets you know after someone has opened a new account in your name. A security freeze, on the other hand, prevents new accounts from being opened in the first place.
How does a security freeze prevent new accounts from being opened? It works by blocking your credit report from being shared with potential new creditors, such as banks or credit card companies. Most creditors will not issue new credit to a customer if they cannot see that customer’s credit report or score derived from it from at least one of the three major national credit bureaus. So if a thief applies for a new account in your name with your Social Security number and his or her own address, but your credit report is frozen, creditors will simply not open a new account. That’s why a security freeze offers peace of mind and is the only way to prevent someone from opening a new account in your name. (Note: Some creditors, such as some cell phone and utility companies, may not check with the bureaus before opening new accounts.)
So, the best course of action for most consumers is to place security freezes with the three major credit bureaus. Consumers in every state can choose to have their credit reports frozen until they want to apply for credit, at which time they can easily unfreeze or “thaw” their reports by lifting their freezes.
Consumers who choose a security freeze should account for the time it can take to thaw their reports if they want to apply for credit in the future. In most cases if you request a thaw online or over the phone, your report can be unfrozen within 15 minutes. However, it can take longer if you don’t have your PIN number that was assigned to you when you froze your report. By law, credit bureaus have up to three days of receipt of your request to lift a freeze.
This report explores the best options you have against new account identity theft, walks you through freezing and unfreezing your credit reports and explains defenses against other types of identity theft.
Best Options against New Account Identity Theft
These steps are recommended for all consumers whether their information has been stolen in a data breach or not:
- Place a security freeze, also known as a credit freeze, on your credit report at each of the three major national credit bureaus – This is the ONLY reliable prevention of someone opening new financial accounts in your name.
- Next steps, after placing security freezes include:
- Use your free annual credit reports as a form of “free credit monitoring.”
- Opt out of allowing your credit reports to be used to generate pre-approved (pre-screened) credit & insurance offers.
In addition to the above steps, the following steps are also recommended for consumers whose information has been stolen in a data breach:
- Sign up for free ID protection services and credit monitoring, if they are offered for free as a result of your personal information being stolen.
- Place free, renewable fraud alerts on your credit report (if your Social Security number was stolen and if you decide not to place security freezes on your credit reports.)
- Additionally, Identitytheft.gov is the government’s official website that will walk you through clear checklists of actions you can take to recover from identity theft.
Whether your personal information has been stolen or not, your best protection against new account identity theft is the security freeze (also known as the credit freeze).
Credit monitoring only lets you know after someone has opened a new account in your name. A security freeze, on the other hand, prevents most new accounts from being opened in the first place.
The best course of action for most consumers is to have their credit reports at each of the three major national credit bureaus frozen until they want to apply for credit, at which time they can easily unfreeze or “thaw” their reports.
If you chose the security freeze, it is still advisable to request and monitor your free annual credit reports, available under federal law with each of the three major credit bureaus. It is also recommended that you consider opting out of pre-approved credit and insurance offers.
 By law, 49 states and the District of Columbia require the availability of a security freeze. In 2007, the three major credit bureaus started offering the security freeze voluntarily to consumers in Michigan, the one state that doesn’t have a security freeze law. See Consumers Union, Consumers Union’s Guide to Security Freeze Protection, 5 February 2014.
 North Carolina Department of Justice, Lifting a Security Freeze, accessed at www.ncdoj.gov/getdoc, 27 October 2015. See also Experian, How Long it Takes to Thaw a Frozen Credit Report, accessed at www.experian.com/blogs, 27 October 2015.