How can all of the 200 million consumers with Experian credit reports trust that Experian is really protecting them?
In the wake of a massive data breach affecting Experian’s computers holding 15 million files of T-Mobile customers and applicants, we question why the firms are offering credit monitoring instead of paying to place credit, or security, freezes on all three of each victim’s credit reports. Only the security or credit freeze, available in any state, stops new account identity theft.Potential victims should freeze all of their “Big 3” credit reports from Experian, Equifax and TransUnion.
Reports indicate Experian lost data for 15 million customers and applicants of the wireless phone company T-Mobile, including names, addresses and birth dates and social security numbers, among other information breached from the consumer files.
First, this breach of 15 million records through an Experian server is completely outrageous, since credit bureaus are subject to very high security standards but losing Social Security Numbers — the keys to new account identity theft – makes this breach much worse. That’s why placing security freezes is the only way to guarantee consumers peace of mind.
Worse, Experian, which lost the data, has offered its own branded “Protectmyid” credit monitoring. While reports indicate that T-Mobile is not happy and will offer an alternate credit monitoring service, that doesn’t solve the underlying problem:credit monitoring tells you only after you’ve been victimized. Only the freeze blocks a thief from obtaining new credit accounts in your name. Placing a freeze on all three of your credit reports prevents new account financial identity theft but credit monitoring does not.
We will have further comments on this developing story. We will also be asking the CFPB, FTC, Department of Justice and state attorneys general to investigate how Experian, subject to very high standards for the security of its own credit reports, had such a sloppy system for protecting T-Mobile customer data. How can all of the 200 million consumers with Experian credit reports trust that Experian really is protecting them?”
The first defense against any kind of identity theft is to be vigilant about protecting your personal information by taking steps like creating secure passwords, installing anti-virus and anti-malware software, and shredding personal documents. However, if and when someone does steal enough of your information to commit any form of identity theft (new account financial identity theft, theft of medical services, theft of tax refunds, etc.) there is really only one type of identity theft that you can stop before it happens: New account identity theft, where someone opens a new account in your name. All other types of identity theft and fraud, at best, can only be detected after the fact. New account identity theft can only be stopped by a security or credit freeze; credit monitoring may detect it after it has already happened.
Security freezes are offered by state law in nearly every state; the credit bureaus now allow consumers to place them anywhere.
A security freeze does not affect your ability to use existing credit you already have, such as a credit card or loan, nor does it prevent existing creditors from reviewing your continued eligibility for current or additional credit.
- You can easily unfreeze or “thaw” your credit report when you want to apply for new credit. Freezes can be temporarily or permanently lifted when you want.
- A security freeze does not affect your credit score. In fact, a security freeze helps protect your score by preventing your credit from being negatively scored if someone tries to fraudulently apply for credit in your name.
- Security freezes are available to consumers in all 50 states and the District of Columbia. A security freeze costs between $3-10 for each of the three major national credit bureaus, depending on the state. There is a $2-12 fee, depending on the state, for unfreezing your credit report with each bureau. All states give you the right to free security freezes if you can prove that you are an identity theft victim. Some states offer them for free to consumer 65 years+. There are six states where freezes are free to all consumers, whether they are identity theft victims or not: Colorado, Indiana, New Jersey, New York, North Carolina, and South Carolina.
- Security freezes can also be placed by parents and legal guardians of minors and medically incapacitated consumers.
Consumers who chose a security freeze should account for the time it can take to thaw their reports if they want to apply for credit in the future. In most cases if a request for a thaw is made online or over the phone, a report can be unfrozen within 15 minutes. However, it can take longer if a consumer lost his or her PIN number that was assigned when the report was frozen. It can also take up to three days of receipt of a thaw request if it is made via postal mail.
How to Freeze (and Unfreeze) Your Credit Report
- It is recommended you freeze your credit report with at least the three main credit bureaus (Experian, Equifax and TransUnion). Placing a freeze with one bureau does not automatically freeze your account with the other bureaus. You have to place a freeze with each bureau where you want one. Some creditors use one, some use another, so your best coverage is to freeze all three.
- You will receive a PIN number for your credit freeze with each bureau. You will use this PIN number when you want to unfreeze your credit report any time you want to apply for new credit.
- If you want to temporarily lift a freeze because you are applying for credit or a job, try to find out which credit bureau the business uses to check credit reports. You can save some money and time by only lifting your freeze for that credit bureau.
- You can temporarily lift a freeze for a particular creditor or for a specific period of time, from one day to one year.
- Make sure to account for the time it can take to thaw your report. In most cases if you request a thaw online or over the phone, your report can be unfrozen within 15 minutes. However, it can take longer if you don’t have your PIN number that was assigned to you when you froze your report, so make sure to keep your PIN number in a safe, memorable place where you can quickly retrieve it when needed. It can also take up to three days of receipt of your request if you make it via postal mail.
Placing and Lifting a Security Freeze with Each of the Credit Bureaus
You can place a freeze online, over the phone, or in writing.
Phone: 1-800-685-1111 (NY residents please call 1-800-349-9960)
Mail: Equifax Security Freeze, P.O. Box 105788, Atlanta, Georgia 30348
Phone: 1 888 397 3742
Mail: Experian Security Freeze, P.O. Box 9554, Allen, Texas 75013
Experian includes a potentially confusing three paragraph “Security Freeze Warning.” They are just explaining that you will need to unfreeze your credit report before applying for credit if you ever wish to do so in the future. You might also notice right next to their warning is an offer to purchase their credit monitoring service for $15.95 a month – again, the credit freeze is the ONLY way to prevent new accounts from being fraudulently opened in your name and is much cheaper than paid credit monitoring.
Mail: TransUnion LLC, P.O. Box 2000, Chester, PA 19022
State Director, Maryland PIRG
Emily directs strategy, organizational development, research, communications and legislative advocacy for Maryland PIRG. Emily has helped win small donor public financing in Baltimore City, Baltimore County, Howard County, Montgomery County, and Prince George's County. She has played a key role in establishing new state laws to to protect public health by restricting the use of antibiotics on Maryland farms, require testing for lead in school drinking water and restrict the use of toxic flame retardant and PFAS chemicals. Emily also serves on the Executive Committees of the Maryland Fair Elections Coalition and the Maryland Campaign to Keep Antibiotics Working. Emily lives in Baltimore City with her husband, kids, and dog.