Advertiser Disclosure

Equifax Messed Up — Who Pays? You Do

Oct. 1, 2018
Credit Score, Personal Finance
Many or all of the products featured here are from our partners who compensate us. This may influence which products we write about and where and how the product appears on a page. However, this does not influence our evaluations. Our opinions are our own.

In the days after the credit reporting agency Equifax disclosed the breach of nearly 148 million consumers’ private financial data, there were howls of outrage.

In May, Congress included free credit freezes for all in a rollback of some provisions of the Dodd-Frank Act. Those provisions, which took effect in September, made credit freezes and lifts free for all consumers and extended initial fraud alerts to a year.

Even those not affected by the breach should proceed as if they were.

Assume thieves have your information. Your chance to limit their ability to use it depends on what you do.

Don’t rely on a system that has already failed

Credit bureaus collect data on how you’ve repaid debts you’ve incurred. They make money by selling that information to creditors who use it to see if they want to do business with you. The data they collect include birth dates, addresses, driver’s license numbers and even Social Security numbers — the skeleton keys to your financial life.

You can’t avoid the three major credit bureaus if you use credit cards or have loans. Nor do you get a say in how the bureaus will protect your data or what the remedies will be if your information is compromised.

“We are the commodity, not the customer,” says attorney Chi Chi Wu of the National Consumer Law Center. “We can’t decide, ‘Oh, I don’t want to deal with Equifax, so just send my data to the other credit bureaus.’ We don’t get to decide which credit bureaus we want to deal with.”

Even taking the available steps now to protect your credit records is no guarantee.

“You should cross your fingers that the bureau system that was unable to protect your information in the past will do so in the future via that bureau’s freeze, lock, monitoring or ID theft protection programs,” says credit expert Barry Paperno.

»MORE: Your guide to cybersecurity and identity theft

What to do after the Equifax wake-up call

There’s no substitute for your own vigilance in checking your financial statements and credit records and acting immediately to limit the damage. Assume that your information is out there and that a criminal can get it.

Watch your credit card accounts for suspect charges

Even if your data weren’t compromised in this breach, identity thieves are always at work.

Don’t wait for your monthly statement to arrive; fraudulent charges may pile up before you notice. Check your accounts online frequently or set an alert to notify you whenever a charge above a set amount is made. You can challenge fraudulent credit charges, but your best protection from liability depends on alerting your issuer in a timely fashion.

Monitor your credit scores and reports

You also need to watch for signs that someone has opened new accounts using your data. Regularly check your credit scores for unexplained movements and your credit reports for accounts you don’t recognize.

You can do this yourself. Many personal finance websites offer alerts when new accounts are opened, when your score changes and so on. Look for one, such as NerdWallet, that offers free credit report information you can access anytime.

Decide how to secure your credit data

A credit freeze offers the best firewall against your data being misused because it restricts access to your records. You will have to keep track of your PIN to lift the freeze later if you want to apply for new credit without a big delay.

Fraud alerts offer less protection, merely flagging lenders and card issuers that credit applications should receive extra scrutiny. In most cases, a lender will contact you to verify a credit application. You only need contact one credit bureau for an alert; it contacts the other two.

All three credit bureaus have some sort of “credit lock” service. It’s easier to lift a lock when you want to apply for credit, but locks are voluntary and are not governed by federal law, as freezes are.

And Experian’s and TransUnion’s terms of service require you to waive your right to participate in a class-action lawsuit and use arbitration instead.

Learn more about protecting your credit

About the author