How to use credit freezes, fraud alerts after Equifax hack

IndyStar

Equifax's massive data breach — and its massive bungling when it comes to dealing with U.S. consumers left in the aftermath — has plenty of people just shaking their heads.

Find out if you're possibly at risk by handing over the last six digits of your Social Security number online to people who couldn't protect your data in the first place?

And what gives with signing up for a free Equifax monitoring service? As one reader put it: "Do I want these same people who screwed up to monitor my information again?"

The list goes on. At one point, we faced the concern of possibly signing away some legal rights just to get free services for one year. Oh, and did you hear the news that three Equifax executives sold off some of their stock after the hacking incident but before the news was disclosed more than a month later to the public?

"I find the whole thing ridiculous," said Tom Bower, a retired teacher in Saline. "They're collecting all this information on us and if they fail to keep it from being secure, the burden is on the consumer."

Equifax hit with at least 23 class-action lawsuits over massive cyberbreach

Equifax credit hack: The big risks and what to do now

At the end of the day, the fraudsters could still very likely have your name, Social Security number, date of birth and address in hand. The cyber attack could have impacted up to 143 million consumers. So exactly what do you do now?

Here's an update and more tips on how to handle the situation:

1) What's Equifax saying now?

To find all the updates, see Equifax's site for the crisis — www.equifaxsecurity2017.com — for more news.

Equifax has ironed out a few concerns. The credit reporting agency made a point to note earlier this week that consumers won't have to hand over credit card information or end up being automatically enrolled for more credit monitoring through Equifax's TrustedID Premier monitoring service after the one year of free service ends.

And no, you won't give up legal rights if you sign up for free services, either.

After much outcry from consumer watchdogs, including U.S. PIRG, Equifax changed its tune. The site now notes: "Enrolling in the free credit file monitoring and identity theft protection that we are offering as part of this cyber security incident does not waive any rights to take legal action."

Good thing. There were already more than 20 class action lawsuits in the works early this week, even though the extent of the damage is not known at this time.

If your data might be at risk, Equifax is offering its TrustedID Premier, which includes credit monitoring of Equifax, Experian and TransUnion credit reports, and copies of Equifax credit reports.

Equifax is also offering a credit file lock, which is similar to a security freeze and allows you to lock access to your Equifax credit report. You can unlock your account if you want to apply for a loan.

Two other services are offered, including identity theft insurance and a service that will scan the Internet to see if someone is selling your Social Security number.

Richard F. Smith, chairman and CEO of Equifax Inc., wrote in an opinion column published in USA Today that as of Tuesday, more than 15 million people have visited www.equifaxsecurity2017.com and 11.5 million are enrolling in credit file monitoring and identity theft protection.

"We took the unprecedented step of offering credit file monitoring and identity theft protection to every U.S. consumer," Smith wrote. "Every consumer, whether affected or not, has the option of signing up for the services."

Equifax credit hack:The big risks and what to do now

Massive cyberbreach:Equifax hit with at least 23 class-action lawsuits over massive data breach

2) What's so cool now about a credit freeze?

John Ulzheimer, a credit expert who formerly worked for credit-scoring company FICO, said he's concerned that some consumers who sign up for Equifax's free services will think "OK, if I'm signed up for this, I'm good to go."

But they're not fully protected. The lock feature will not shut down access through the two other major credit reporting agencies.

Ulzheimer and others say you might want consider putting a credit freeze at TransUnion and Experian, too.

Bower, 64, said he spent $60 to put credit freezes on his credit reports and those of his wife Karen at each of the three agencies. Bower isn't planning on taking out any loans soon.

"It's a higher level of security than just having credit monitoring," Bower said. He's not signing up for any of Equifax's free services.

Consumers in several states —- including Michigan, Florida, Delaware and Kentucky —will need to pay $10 to each credit bureau where you place a freeze. The fee in other states may be $3 or $5 in many cases.

Fees are typically waived if a person is a victim of identity theft and has a police report documenting that theft. In some states, such as Florida, fees are waived for those who are 65 and older but that's not the case in Michigan. Fees in some states might be waived in other cases too, such as active duty military or victims of domestic abuse.

Consumers in six states do not pay anything for freezes, even if they are not identity theft victims: Colorado, Indiana, New Jersey, New York, North Carolina, and South Carolina.

On Monday, though, Equifax said on Twitter that it would waive its fees for credit freezes for the next 30 days.

You'd need to contact each bureau for a freeze.

"There is no such thing as a three-bureau lock service," Ulzheimer said.

The phone for Equifax is 800-349-9960. Equifax notes that consumers can have either a security freeze or Equifax credit file lock on the Equifax credit report, but not both.

The phone for Experian is 888-397-3742. Or go to www.experian.com/freeze.

The phone for TransUnion is 888-909-8872. Or www.transunion.com/securityfreeze.

You can still obtain a copy of your free credit report if your file is frozen. See www.AnnualCreditReport.com. Or call 877-322-8228.

U.S. PIRG notes in its security freeze tip sheet that credit freezes can be placed by parents and legal guardians of minors and medically incapacitated consumers.

A credit freeze — even if you get one at three bureaus — will not prevent all identity theft. If a crook has one of your credit cards or the account number for an existing credit card in your wallet, you won't be protected by a credit freeze.

What do you do if you need a car loan and you just froze your credit? You can unfreeze it but there might be a fee. So you typically don't want to freeze your credit if you know you're going to be looking to take out a new car loan in a month or so.

There's a separate $10 fee for consumers in Michigan with each agency to lift the freeze, if you're not a victim of ID theft, according to the state Attorney General's Office.

Look for instructions from the credit reporting agency on how to lift the freeze. A PIN is needed to remove a freeze from your credit report.

You will need to lift the freeze temporarily to open a new credit account, get a loan, apply for insurance or authorize an employer to conduct a background check, according to the attorney general's office.

There is another option that does not have a cost: A Fraud Alert. With a fraud alert, a credit reporting agency puts a warning on your credit report. So lenders see a "red flag" and know to take extra steps to verify your identity. A fraud alert is free.

After you place an alert with one nationwide credit bureau, it will be automatically reported to the other two nationwide agencies.

3) Is this all frustrating and confusing? You bet.

The Equifax site remains difficult to navigate. You have to go to the site to find out if you've been impacted. See www.equifaxsecurity2017.com.

Then, you're given a date to return in order to enroll for the free services. If you return, you supply your detailed information, including your Social Security number and other ID, to enroll.

Once you enroll, you're sent an email with a link to finalize your enrollment and the services. But Equifax notes that because of the high volume of requests, emails may be delayed. And if you have not received your email within a few days, you're asked to check your spam and junk folders.

It's not exactly a reassuring process. AARP's Fraud Watch Network is warning consumers that scammers send phishing emails trying to get information. So you need to be careful here.

Some consumers could decide to wash their hands of the whole thing and wait it out for years for any kind of class-action settlement.

Whatever you do, make sure to check your statements, review your annual credit report and consider an fraud alert or a credit freeze.

This kind of thing can dog you for years — since a Social Security number can be valuable to crooks for years on end.

Contact Susan Tompor: stompor@freepress.com or 313-222-8876. Follow Susan on Twitter @Tompor.