Equifax Offers Incomplete Protection After Breach

Statement by Mike Litt, U.S. PIRG's Consumer Advocate, on Equifax's response to its breach affecting over 140 million Americans.

"Consumers should know the risks and limits of what Equifax is offering and consider getting credit freezes with all three national credit bureaus instead.

Equifax's response to its breach fell short to begin with. But to make matters worse, there is an arbitration clause in its agreement for the free services it is offering. While the FAQ section of their website says the arbitration clause only applies to disputes that might arise from the services provided, the language in the actual agreement as of today is vague. It is unclear in the agreement whether or not Equifax also intends to bar victims of the data breach from joining class action lawsuits.

Equifax should get rid of the arbitration clause from this agreement. Until Equifax removes this clause or at least clarifies these terms in the agreement itself, consumers should hold off on accepting Equifax's package.

In the meantime, consumers should consider the following actions:

• Request free credit reports at all three credit bureaus to spot any unauthorized activity. The official website authorized by the government for requesting these free reports is annualcreditreport.com.
• Place credit freezes on their credit reports with all three credit bureaus. Steps for doing this are available here.
• Place free, renewable fraud alerts on your credit report if you decide not to place credit freezes on your credit reports.
• Additionally, identitytheft.gov is the government's official website that will walk you through clear checklists of actions you can take to recover from identity theft.

The types of stolen information, particularly social security numbers and dates of birth, can be used to commit new account identity theft against everyone whose info was breached. This means bad guys could open fraudulent credit accounts and rack up tons of debt in your name.

Due to huge marketing pushes by credit monitoring services that only alert consumers to fraud after the fact, most Americans are not aware that they can actually prevent id thieves from opening new credit accounts in their names in the first place by placing freezes on their credit accounts at all three national credit bureaus. Credit freezes help prevent new account identity theft because they keep potential creditors from seeing consumer credit history, without which new accounts are typically not opened

Equifax's package includes credit monitoring at all three bureaus for only one year. Equifax should make it clear that monitoring only alerts people to fraudulent activity after it has occurred, and they should offer it indefinitely, not just one year. The stolen information does not have a shelf life.

Equifax's package also includes something similar to a credit freeze, something they call a "credit report lock," but only for Equifax reports. Bad guys could still try to open credit accounts with companies that use the other two credit bureaus for credit checks. So a credit freeze with only one bureau is incomplete protection. Equifax should make clear the benefits of the credit freeze and offer it for free with all three bureaus, not just themselves. Equifax should reimburse consumers who place freezes on their own.

Furthermore, it's worth pointing out how long it took Equifax to alert the public about the breach. Equifax discovered the breach on July 29th, 2017. It has left people vulnerable to new account identity theft for over a month while it conducted its investigation. That's a problem - people should have been alerted sooner and been given clear explanations about their options.

More information about placing credit freezes is available at https://uspirg.org/reports/usf/why-you-should-get-security-freezes-your-information-stolen