Equifax Breach, Protect Your Identity

by Teri N. Benson, September 18, 2017

On September 7th, Equifax – one of the largest US credit agencies – announced a cyberattack was carried out by suspected criminal hackers on their servers from mid-May through July. This data breach compromised consumers’ personal information, including Social Security numbers, birth dates, addresses, etc., leaving up to 143 million people (roughly 44% of the US population) vulnerable to identity theft. As additional details emerge about the Equifax breach, what we know today is its magnitude is massive and, as a result, we suggest protecting yourself as though your information has been exposed. We have summarized below what you need to know about the Equifax cyberattack and share precautionary steps you can take now to help protect your identity.

DON’T rely on Equifax’s website. While Equifax has setup a website where consumers can check if they have been potentially impacted, we believe the site has a number of shortcomings from the consumer’s perspective. There have been glitches with this site from the start with many reported cases of misleading information being provided. For example, many consumers who checked their SSN last week received a message their personally identifying information had not been compromised, only to find out they may be affected when checking the same site just a day or two later.

If your information has been compromised, Equifax offers a free one-year subscription to their identity theft protection and credit file monitoring product. At first glance, this might seem like a reasonable solution, but a closer look at the Terms and Conditions reveals you may be waiving important consumer rights (e.g. to sue for damages and be limited to arbitration only). Regardless, we don’t believe any monitoring solution provides sufficient protection against identity theft (see below).

DO Setup a Security Freeze. If you have not already done so, it is highly recommended that you freeze your credit. A security freeze (aka credit freeze) is the single most effective way to guard against identity theft. Having a security freeze in place will create an extra step when you do wish to open a new account but the process can be far less time intensive than recovering from identity theft. Simply put, freezing your credit blocks who can see your credit and prevents thieves from opening new accounts using your personal information, which they may have gained in this latest breach. The Federal Trade Commission addresses Frequently Asked Questions about credit freezes on their website.

A credit freeze is a step beyond the heavily advertised “credit monitoring” or “credit lock” services offered by each bureau and companies like LifeLock. These services only notify you after after a potential fraud has occurred. The credit bureaus generally do not like credit freezes as they are less profitable than recurring credit monitoring subscriptions so be prepared to wade through several monitoring offers and/or discouraging language pertaining to security freezes (e.g. “cause delays”, “interferes with”, “prohibits”, etc.) when submitting your request.

It is important to note that a security freeze does not prevent thieves from making charges to your existing accounts so it is recommended you continue to check your bank, credit card and insurance statements for fraudulent activity.

Contact each credit bureau individually, either online, by mail or phone, to freeze your credit file. A small fee may be required ($10 in Florida, $0 in New York). Website links to freeze credit and contact numbers are provided below. These sites are experiencing high volume so if you receive a reply that the website is unable to process your request, you can phone in your request or try the website again later in the day. Contact us for a sample letter, if you would like to establish a credit freeze by mail.

Experian: 888-397-3742
Transunion: 888-909-8872
Equifax: 866-349-5191 * Waiving fee to freeze credit until November 21st.
Innovis: 800-540-2505

Once your identity is verified, you will receive a PIN code for use on those occasions when a new business has a legitimate reason to access your credit record. When needed, ask the business which specific credit bureau it uses to screen new customers. With your PIN and, in some cases, a small fee ($10 in Florida, $5 in New York), you can lift the freeze and often proceed with your transaction in a matter of minutes. If you misplace your PIN, it can take up to 72 hours to retrieve it. Save your PIN somewhere safe and easily accessible.

Fraud Alerts are free but temporary. For those whose credit reports are accessed often for work or who open new accounts on a regular basis, it is not recommended that you freeze your credit. The costs to regularly lift a credit freeze would tend to be excessive. Setting a temporary fraud alert with the credit bureaus is a simpler and no-cost alternative. A fraud alert, however, does not block access to credit reports and is initially in place for only 90-days (up to 7 years with extension). A fraud alert simply requires lenders to verify your identity before opening a new account, usually by calling the phone number that you supply with the alert. Filing a fraud alert entitles you to a free copy of your credit reports, beyond the free copy that is available to you annually. You can place a fraud alert on your credit report with one call to any one of the three nationwide credit reporting companies, whereas freezing your credit requires contacting each bureau individually.

The decision whether to implement a security/credit freeze or a simple fraud alert is a personal one. Generally, the advantages of a security freeze increase with age and net worth as the need for additional credit wanes. In addition, lifestyle considerations should also be weighed. For example, those who travel regularly and/or prefer to use credit cards over cash are at greater risk of having their financial identities stolen.

Please call us with any questions or if you would like to discuss this or any other aspects of your financial and personal information security.

Note: Links are provided for information purposes only. Raymond James is not affiliated with and does not endorse, authorize or sponsor any of the listed websites or their respective sponsors. Raymond James is not responsible for the content of any website or the collection or use of information regarding any website’s users and/or members.

Questions? Call us.