Mike Litt
Director, Consumer Campaign, U.S. PIRG Education Fund
Director, Consumer Campaign, U.S. PIRG Education Fund
Consumers should know the risks and limits of what Equifax is offering and consider getting credit freezes with all three national credit bureaus instead.
Equifax’s response to its breach fell short to begin with. But to make matters worse, there is an arbitration clause in its agreement for the free services it is offering. While the FAQ section of their website says the arbitration clause only applies to disputes that might arise from the services provided, the language in the actual agreement as of today is vague. It is unclear in the agreement whether or not Equifax also intends to bar victims of the data breach from joining class action lawsuits.
Equifax should get rid of the arbitration clause from this agreement. Until Equifax removes this clause or at least clarifies these terms in the agreement itself, consumers should hold off on accepting Equifax’s package.
In the meantime, consumers should consider the following actions:
The types of stolen information, particularly social security numbers and dates of birth, can be used to commit new account identity theft against everyone whose info was breached. This means bad guys could open fraudulent credit accounts and rack up tons of debt in your name.
Due to huge marketing pushes by credit monitoring services that only alert consumers to fraud after the fact, most Americans are not aware that they can actually prevent thieves from opening new credit accounts in their names in the first place by placing freezes on their credit accounts at all three national credit bureaus. Credit freezes help prevent new account identity theft because they keep potential creditors from seeing consumer credit history, without which new accounts are typically not opened.
Equifax’s package includes credit monitoring at all three bureaus for only one year. Equifax should make it clear that monitoring only alerts people to fraudulent activity after it has occurred, and they should offer it indefinitely, not just one year. The stolen information does not have a shelf life.
Equifax’s package also includes something similar to a credit freeze, something they call a “credit report lock,” but only for Equifax reports. Bad guys could still try to open credit accounts with companies that use the other two credit bureaus for credit checks. So a credit freeze with only one bureau is incomplete protection. Equifax should make clear the benefits of the credit freeze and offer it for free with all three bureaus, not just themselves. Equifax should reimburse consumers who place freezes on their own.
Furthermore, it’s worth pointing out how long it took Equifax to alert the public about the breach. Equifax discovered the breach on July 29th, 2017. It has left people vulnerable to new account identity theft for over a month while it conducted its investigation. That’s a problem – people should have been alerted sooner and been given clear explanations about their options.
More information about placing credit freezes is available at http://uspirg.org/reports/usf/why-you-should-get-security-freezes-your-information-stolen.
-30-
U.S. PIRG is a non-partisan, non-profit consumer organization that stands up to powerful interests whenever they threaten our health and safety, our financial security, or our right to fully participate in our democratic society. On the web at www.pirgold.jeffreyoconnell.com.