Equifax ‘lock’ is insufficient
Lifetime service would not apply to other bureaus
The grilling of former Equifax CEO Richard Smith on Capitol Hill last week revealed how little the company has done to protect or compensate the 145.5 million consumers whose personal information was stolen through a gaping hole in its “dispute portal.”
Smith conveniently “retired” on Sept. 26, then went on to represent the Atlanta company in hearings before three congressional committees last week.
Given the scope of the breach, several committee members asked whether consumers should be able to delete their information from credit bureaus entirely, or at least have it “locked down” by default. Today, consumers who want to freeze access to their credit files must contact each of the three major credit bureaus separately, and usually pay one fee for freezing and another for thawing their reports.
Smith repeatedly told committee members that stronger protections are unnecessary because Equifax is offering “five free services” for one year and by Jan. 31 will begin offering a free lifetime “lock.”
Those protections are woefully inadequate.
The five free services, which you get by enrolling in Trusted ID Premier, will last for only a year. Consider that people whose personal information was compromised will be subject to identity theft for life.
The free lifetime lock will apply only to a consumer’s Equifax file, leaving them open to impersonation via Experian and TransUnion.
“Getting it from Equifax is like locking your front door but leaving your garage and back doors open,” said Mike Litt, a consumer advocate with U.S. PIRG.
Equifax is offering all con-
sumers a free credit freeze only through Jan. 31, after which it will be replaced by the free lifetime lock. But a lock is not the same as a freeze. (Neither should it be confused with fraud alerts, a weaker protection that no one is really recommending anymore.)
Freezes are regulated by states. Each state decides what fees, if any, the bureaus can charge its residents and sets other rules that apply to all three bureaus.
Locks are not regulated. They were created more recently by the bureaus.
“It’s essentially a marketing service,” said Brian Karimzad, vice president of research at LendingTree, an online loan market. Each bureau can make its own rules and fees, making it harder to generalize about locks.
A freeze is stronger than a lock. A freeze prevents any person or entity from seeing your credit report except for the credit bureau, existing creditors, debt collectors working on their behalf and, in certain cases, government agencies.
If you need to open your frozen credit file for a potential creditor, bank, landlord, employer, cell phone provider or insurance company, you will have to unfreeze your account — either for a specific period of time or a specific creditor — using a personal identification number, the Federal Trade Commission says.
A lock is similar, but can be more porous. You’ll need to read each bureau’s fine print to see who has access to locked files. None of the three bureaus would agree to an interview about their locks (or anything else, for that matter) since the Equifax breach was made public Sept. 8.
Equifax says its existing lock will not keep out “companies reviewing your application for employment” or “companies that have a current account or relationship with you.”
TransUnion says it allows access to locked files “in certain instances that are considered a low risk for identity theft,” such as “collection activities and insurance underwriting and claims administration.”
Experian lets “potential employers or insurance companies during the application process” view locked files. Experian offers its CreditLock feature in two credit monitoring products: CreditWorks and IdentityWorks, which cost $24.99 and $19.99 per month, respectively, after the first month.
When consumers request a lock, they might have to give up some of their legal rights.
TransUnion lets consumers lock and unlock their reports for free if they enroll in its TrueIdentity monitoring service. This service is free, but only if they agree to receive advertising and have disputes decided in arbitration rather than court, unless they opt out of the arbitration agreement, in writing, within 60 days.
“TransUnion is pushing its ‘lock’ product really hard, steering consumers away from a freeze, which seems questionable,” Chi Chi Wu, an attorney with the National Consumer Law Center, said in an email.
The bureaus say their locks are more convenient, because consumers can lock and unlock their credit reports themselves instantly rather than waiting for the credit bureau to do it. They warn that thawing a frozen report could take days, but credit expert John Ulzheimer found that not to be true in his case.
Ulzheimer froze his file at all three credit bureaus last month. A few days later, he went to open a business checking account and the bank said it needed to pull his credit report from Equifax. “I used my phone, went to their freeze and thaw website, thawed my report,” and in less than 10 minutes the bank had access. “Then I refroze it,” he said.
Neither locks nor freezes will prevent you from getting preapproved credit offers. To stop those, call 888-567-8688 or go to www.optoutprescreen.com. This number and website are operated by the credit bureaus.
A freeze should prevent thieves from opening a new account in your name, but it won’t prevent them from making charges to existing accounts, which is why you should monitor bank, credit card and insurance statements regularly.
(They also should not be confused with fraud alerts, a weaker protection against identity theft that no one is really recommending anymore.)
It’s not clear how Equifax’s lifetime lock will differ from its existing lock.
“We will announce more details on this service but, importantly, consumers will be able to use their smartphone or computer to lock and unlock their Equifax credit file directly and quickly,” a spokeswoman said in an email.
During his testimony, Smith suggested that the two other bureaus also offer free locking for life.
A stronger measure would be forcing all three bureaus to offer free credit freezes and thaws for life. A bill introduced by Sens. Elizabeth Warren, D-Mass., and Brian Schatz, D-Hawaii, would do just that. S.1816 also would “enhance fraud alert protections,” give consumers an additional free credit report each year and force the other credit reporting agencies to refund any fees they charged for freezes since the Equifax data breach, the sponsors said.
States could also take action. California Sen. Jerry Hill, D-San Mateo, said last week he will “introduce consumer protection legislation to make it free for Californians to lock down their credit by placing a freeze with the nation’s credit reporting agencies” when the state Legislature reconvenes in January.
“(Locks) are essentially a marketing service.” Brian Karimzad, LendingTree