The Atlanta Journal-Constitution
Equifax breach: What you can do to lower risk
Confirm identity theft, freeze credit, monitor accounts, be patient.
It’s a modern-day nightmare. Everyone fears a massive hack in which millions of Americans’ Social Security numbers, driver’s license information and credit card numbers are compromised, leaving them vulnerable to identity thieves who seek to wreak financial havoc.
That’s the reality that Atlanta-based Equifax Corp., one of the nation’s key credit reporting bureaus, disclosed last week.
So now what are you supposed to do, since odds are someone has that info on you?
According to the experts, you’ve got some work to do. The Federal Trade Commission has a good checklist of what to do at www. identitytheft.gov.
But the to-do list basically boils down to this:
Step One: Find out if any damage has been done.
Get credit reports from all three credit-tracking agencies, Equifax, Experian and TransUnion, suggests Christopher Hart, a Boston lawyer with FoleyHoag, who works on cybersecurity cases for companies and other clients. Such reports can be obtained free once a year from AnnualCreditReport.com.
Lori Silverman, director of local consumer expert Clark Howard’s Team Clark Consumer Action Center, says there’s another important early step: sign up on Credit Karma (creditkarma.com) for free credit monitoring.
They say do those steps first because you won’t be able to do them after the next step, which is most important.
Step Two: Freeze your credit at all three credit bureaus.
This involves signing up with each credit bureau separately to block anyone from signing up for new loans or credit card accounts without your permission. You need to keep track of a personal identification number if you want to later “thaw” your credit to apply for new credit cards or bank accounts.
In Georgia, the service typically costs $3 each time you freeze or unfreeze your credit information, and you need to do it at all three bureaus to block thieves. It’s free for seniors over 65.
“You just have to do it,” said Silverman. She doesn’t recommend the credit monitoring services that Equifax initially offered. They sim- ply notify customers after identity thieves have already done damage, she said.
Equifax has since offered free credit freezes to people who sign up within 30 days of the Sept. 7 data breach announcement.
Legislative action is needed to provide more protection to consumers, said Al Pascual, research director and head of fraud and security at Javelin Strategy and Research.
“One year of [credit] protection isn’t enough,” he said.
Some experts say it’s bet- ter to call rather than use the bureaus’ online sites to set up freezes. Their numbers for setting up freezes are: Equifax — 800-349-9960; Experian — 888-397-3742; TransUnion — 888-909-8872.
Step Three: Monitor your accounts. (This may last forever.)
Freezing your credit only protects you from new crim- inal activity.
Because of the depth of what the hackers got, and the permanent nature of Social Security numbers, experts say they can cause problems with your existing accounts and go beyond credit cards or loans.
They could possibly use a combination of information to create new passwords on bank accounts or to send in false tax returns.
Stolen data could allow a crook to call a bank and get access to bank accounts or change log-in information. it’s “For going financialto cause institutions, chaos,”
Pascual said.
If there’s evidence an iden- tity thief is at work, Hart suggests filing a Form 14039 with the IRS, an “Identity Theft Affidavit.”
Some accounts, such as 401(k) savings accounts and IRAs, may be difficult to mess with unless hackers also got account numbers, personal identification (PIN) numbers and passwords, said Hart.
To be safe, Silverman suggests signing up for so-called two-tier authentication. Many banks, investment firms and other financial institutions now offer this type of account secu- rity feature.
It works like this: The customer signs in with his or her normal password, then receives a second ID number by text or a phone call that needs to be typed in to gain access to the account.
Step Four: Hurry, but be patient. (There may be technical difficulties.)
ble freethe swamped,expertstried. Paigeand PeopleThe signingCOO company’scredit breach Schaffer,andof are accordingup insurerfreezefolksis havingfor “grisly,” presidentsystemwho Equifax’sbecause Generalito trou-have saidthe is Globaland vices victimsAt Digital“our division, Assistance’sof resolution cybercrimes.Protectionwhich Identity center,helpsSerthetheget throughwalls phones becauseto are the ringingthey bureaus,”can’t off she Silvermansaid. said 1,500 people Consumercalled Clark Action Howard’s Center on Wednesday, mostly for help with their questions on Equifax. The normal volume is 200 calls, she said.
“I’m telling people to wait” on ordering a credit freeze at Equifax, she said.
Hart disagrees. “I don’t think that it’s wise to wait, just because of the sensitivity of the information involved,” he said.
Vernon Keenan, director of the Georgia Bureau of Investigation, said he has tried four times since Wednesday to sign up on Equifax’s website, without success.
“It’s very frustrating to load in the information they ask for, only to get an error message,” he said. It’s sensitive information he doesn’t like putting online: full name, Social Security number, address, date of birth.
But he said he’s going to keep doing it until he gets Equifax to freeze his credit information. “I don’t have a choice,” he said. He said Equifax should be “penalized. I’d like to see them being held accountable ... for having my personal information and losing it.”