Follow-up to Equifax Data Breach
Since the Equifax data breach was publicly announced on Sept. 8, follow-up questions have been rolling in. To that end, we wanted to provide some additional guidance and updates to help clients navigate any fallout from the hack while protecting their personal and financial information.
In its press release, Equifax said it discovered “unauthorized access” to data belonging to 143 million U.S. consumers, including names, Social Security numbers, birth dates and addresses. Equifax also said that credit card numbers and other personal identifying information were accessed for a smaller number of people.
As part of their response, Equifax set up a website (https://www.equifaxsecurity2017.com/) where clients can enter their last name and the last six digits of their Social Security number to see if Equifax believes their data was accessed in this breach.
Equifax also has offered free access to its TrustedID Premier identity theft protection service for all U.S. consumers. Clients may sign up for it through Equifax’s incident website. The enrollment period for this service ends on Tuesday, Nov. 21, 2017, although there is pressure on Equifax to extend this deadline into early 2018.
Were You Part of the Equifax Data Breach?
With up to 143 million records compromised, clients should assume they have been affected by the Equifax data breach, regardless of whether Equifax says they were or not.
Results from entering a name and the last six digits of a Social Security number into Equifax’s incident website do not always appear to be accurate. In some cases, entering a nonsense word and six random numbers have generated a response that the fictitious individual “may have been impacted” by the data breach.
Because the 143 million people potentially affected in the data breach represents more than half the adult U.S. population, there is a strong chance clients’ information was compromised in this or one of several other high-profile breaches from recent years.
Should You Use Equifax’s TrustedID Premier Identity Theft Service?
TrustedID Premier is a service designed to monitor and alert participants to identity theft. In addition to identity theft monitoring, like many other services, TrustedID Premier will provide assistance to resolve issues around identity theft and in recovering your identity.
No credit card information is required to sign up for TrustedID Premier, and Equifax has said those who do will not automatically be enrolled or charged after their one-year complimentary period ends.
Initial reports indicated that registering for TrustedID Premier disqualified consumers from participating in any class action lawsuits related to this data breach. Equifax has since removed the arbitration and class-action waiver language from the service’s terms of use and clarified that those clauses do not apply to this cybersecurity incident.
Some people have had difficulty registering for TrustedID Premier, likely due to the volume of people who are attempting to sign up. Additionally, the secure PINs that Equifax issues as part of the service initially were just a timestamp and therefore easily compromised. Equifax has since reissued those PINs and created a new way to generate them.
There are other services similar to TrustedID Premier. Those consistently ranked among the best are Identity Guard, IdentityForce and LifeLock.
Some links to identity theft protection service comparisons are:
http://www.toptenreviews.com/services/protection/best-identity-theft-protection-services/
http://www.reviews.com/identity-theft-protection-services/
http://www.asecurelife.com/identity-theft-protection-reviews-table/
Clients have the ability to do on their own some of what these services provide by ordering a free copy of their credit report (https://www.annualcreditreport.com/). Other services they provide, such as monitoring the dark web for information or guaranteeing to pay for expenses related to recovering a stolen identity, are difficult for clients to do on their own.
The choice whether to use an identity theft or credit monitoring service often comes down to how much a client is willing to do on their own and how much they value the services and features of each provider. One advantage to TrustedID Premier is that clients can receive this service for no charge if they sign up by Nov. 21, 2017.
It is important to understand that what each of these services offer is simply notification if a client’s identity is stolen; they do not and cannot prevent it from happening.
Is a Security Freeze the Right Option?
A security freeze is the best way for clients to protect themselves from the financial implications of identity theft because it prevents thieves from opening new lines of credit in their name.
A security freeze takes monitoring and commitment on the client’s part, however, because it also prevents the client from opening new lines of credit without first having thawed or removed that freeze.
To perform a security freeze correctly, clients will want to freeze their credit with all three consumer credit reporting agencies:
Equifax
Website: https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp
Phone: 1.800.349.9960
Experian
Website: https://www.experian.com/freeze/center.html
Phone: 1.888.397.3742
TransUnion
Website: https://www.transunion.com/credit-freeze/place-credit-freeze
Phone: 1-888.909.8872
When freezing their credit, clients will be asked to supply their name, address, date of birth, Social Security number and other personal information.
Best Solution: Freezing Your Credit
Freezing and unfreezing their credit will in no way impact a client’s credit score. It also will not prevent a client from getting their free annual credit report.
There is generally a cost of $5-$15 to freeze a credit file, depending on your client’s state of residence and whether they already have been a victim of identity theft.
In most states, a credit freeze will stay in place until the client lifts it. However, there are a few states in which a credit freeze expires after seven years.
CreditCards.com has an article that provides credit freeze details for each state: https://www.creditcards.com/credit-card-news/credit-freeze-laws-50-states.php
For more information about what is involved in a credit freeze, how to lift it, and differences between a credit freeze and creating a security alert please visit: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs.
Don’t Forget the Kids!
Children are one of the biggest targets of identity theft because they have perfectly clean and unused credit histories.
Clients can request a free credit report for their minor children, and if everything is OK, there should be nothing to report back. If the credit report does reflect issues, and perhaps even if it doesn’t, clients may consider choosing to freeze their child’s credit.
Currently, only some states will allow parents to put a freeze on their minor child’s credit file, which can be an effective way to protect kids from identity theft. States that allow parents to do this are Alaska, Arizona, California, Connecticut, Delaware, Florida, Georgia, Hawaii, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Michigan, New York, North Carolina, Ohio, Oregon, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Washington and Wisconsin.
For more information please click here or call one of our offices in Williston (802.878.1963) or Rutland (802.775.7132) Vermont.
