On Equifax: One year later

Ultimately, we are not the customers of Equifax or the other credit bureaus. We are their product. We did not ask or give them permission to collect or sell our personal information. At the very least, breached companies should be required to provide consumers clear information about what can be done to protect themselves against most types of identity theft.

Today, we released a new report,  Equifax Breach: 1 Year Later – How to Protect Yourself Against ID Theft & Hold Equifax Accountable with suggestions on how state authorities and consumers can safeguard personal information.

In September 2017, Equifax reporter the worst data breach in history weeks after the company knew about it. Equifax has yet to pay a price or provide consumers with the information and tools they need to adequately protect themselves. 

At Maryland PIRG, we want to make sure consumers understand how to best protect themselves against the very real threats of identity theft for the rest of their lives.

While the Equifax breach was not the largest breach (that’s Yahoo), it was the worst breach in U.S. history because of the types of data that was lost. Equifax put consumers at risk of several types of identity theft and fraud for the rest of their lives (by exposing sensitive personal information, including social security numbers and birthdates, and for some people, credit card numbers and driver’s license numbers.)

Although there has been action that has started (including Congressional hearings, lawsuits, government investigations, proposed legislation, and a consent order in the last year,) Equifax still has not paid any penalties or fines for putting so many consumers in harm’s way. 

We need both penalties against and new oversight of Equifax to compensate the victims and prevent future breaches of this scale. We support legislation introduced earlier this year by Senators Elizabeth Warren (MA) and Mark Warner (VA) that would give the Federal Trade Commission the authority to annually inspect large credit bureaus for cybersecurity and levy fines against them if they get breached.

At the very least, breached companies should be required to provide consumers clear information about what can be done to protect themselves against most types of identity theft

In Maryland this spring, state lawmakers passed a law backed by Attorney General Brian Frosh to make access to credit freezes, thaws, and temporary lifts free for all Marylanders. And on September 21st, a new federal law will go into effect tto eliminate fees for credit freezes across the country at all three nationwide credit bureaus for consumers, including minors and incapacitated individuals. As an alternative option to credit freezes, it also increases the length of an initial fraud alert for consumers from 90 days to 1 year. While the new law has this minor provision which may save consumers money on credit freezes, overall, the comprehensive deregulatory bill has broadly negative implications because its primary, unrelated provisions increase the likelihood of bad mortgages, racial discrimination in the marketplace, and risky banking practices.

For now, we reccommend several actions consumers can take action to protect themselves from identity theft. To learn more, make sure to check out our new report.

1. New account identity theft is the most preventable kind of identity theft. Place credit freezes on your credit reports with all three nationwide credit bureaus – consumer reporting agencies, also known as credit bureaus – Equifax, Experian, and TransUnion. That freezes access to your credit history and scores, denying thieves the ability to open fake credit accounts in your name We also recommend credit freezes at a fourth bureau, the National Consumer Telecommunications & Utilities Exchange (NCTUE) because some news outlets have reported fraudulent accounts being opened by cell phone companies using credit reports provided by the NCTUE.

2. Existing Account Fraud: Check your monthly credit card and bank statements. 

3. New Account Fraud (including cell phone, credit card, loan, and utilities): Get credit freezes at all three nationwide credit bureaus — Equifax, Experian, and TransUnion. A new federal law will eliminate fees for those credit freezes for consumers on September 21st, 2018.

4. Tax Refund Fraud: File your taxes as soon as possible, before thieves do. Also, if you qualify, get an Identity Protection (IP) PIN.

5. Social Security Benefits Fraud: Sign up for your “my Social Security” (MySSA) account before thieves claim it and change your direct deposit info to their own checking accounts. 

6. Health Care Services / Medical Benefits Fraud: Sign up for online accounts with your health care and insurance providers to periodically check for any fraudulent services on your statements.

7. Other Fraudulent Activity: Check your free annual consumer reports with companies that specialize in collecting information often misused by criminals.

8. Phishing Scams: Ignore unsolicited requests for personal information by email, links, phone calls, pop-up windows, or text messages. 

####