News about the massive Equifax data breach has been unrelenting since the credit bureau publicly disclosed its lapse at the beginning of September. It’s difficult to keep up with all the company’s blunders, not to mention the complicated fiscal policy and regulatory debates the incident has fueled. But weeks later, most consumers in the United States are still just trying to figure out what the whole thing means for them, and how to steel themselves against identity theft and fraud.
To this end, Equifax’s interim CEO Paulino do Rego Barros Jr. (former CEO Richard F. Smith “retired” on Tuesday) published an update to consumers in The Wall Street Journal on Wednesday humbling himself before Equifax’s critics and announcing an additional identity protection service that the company will give consumers for life beginning in January. At this point, Equifax has at least three similar-sounding identity protection offerings as part of its breach response. But there’s always that pesky question in security that has plagued the company before—do they work?
“In the event something goes wrong, which unfortunately is inevitable, companies need to respond urgently, transparently, and empathetically—none of which Equifax did,” says Adam Levin, founder of the data security and privacy firm CyberScout and a former director of the New Jersey Division of Consumer Affairs. “So now they’re playing catch up and they’re coming up with all these options, like try this, try that.”
Experts maintain that Equifax’s offerings are ultimately productive, but caution that consumers need to really understand what the choices are so they can make the right defense decisions for themselves long-term.
For a Limited Time Only
Regos Barros announced in his public letter that Equifax will be extending the enrollment period for its credit monitoring and freezing services through January. Credit monitoring sends you alerts so you can catch any suspicious activity early, while credit freezes actually lock down your credit files so institutions you don’t already do business with can’t access your data without specific permission from you and special PIN numbers. A freeze significantly reduces the chance that a fraudster will be able to do things like take out a line of credit in your name. Personal identity security advocates have long favored freezes, but acknowledge that the measure isn’t necessarily for everyone (say, someone who anticipates applying for student loans) since it is fairly rigid and restrictive.
It is worth utilizing one or both of these tools, but at the end of the free year 143 million social security numbers (not to mention other valuable data) will still have been compromised in the breach, necessitating ongoing defense. “We generally tell people that if an entity is offering a free service they should strongly consider taking advantage of it,” says Eva Velasquez, president of the nonprofit Identity Theft Resource Center. “Consumers have to demand security over convenience so that businesses will respond. Just don’t be the low hanging fruit. Anything is better than nothing long term.”
The free monitoring and freezes have a short timespan, perhaps because they are services Equifax wants to resume capitalizing on as quickly as possible.
The third service Regos Barros mentioned on Wednesday, a so-called “credit lock” tool, will debut in January, and will be a more flexible option through which consumers can lock and unlock access to their credit data whenever they want. “By allowing consumers to conveniently lock and unlock their credit files and monitor their Equifax credit report, this new service will prevent new accounts from being opened without the consumer’s consent,” an Equifax spokesperson told WIRED in a statement.
The other two major credit bureaus (Experian and TransUnion) already offer this type of proprietary service, but credit locks are a sort of black box compared to credit freezes, which have a set procedure codified by legislation. “We’re still neutral on it—we don’t know yet if it’s the best way to go,” the Identity Theft Resource Center’s Velasquez says. “What it locks and doesn’t or how the data can be moved and accessed with a lock is unclear. I’m not saying they aren’t identical [to freezes] we just genuinely don’t know.”
Experts agree that to protect themselves, consumers need to see past the gimmicks and noise to the long game of utilizing what Equifax and other companies that have experienced data breaches provide while planning to supplement as needed. If your data is compromised in multiple breaches over time you may be able to daisy chain years of free services together. And everyone can pull and review one complete credit report per year for free from AnnualCreditReport.com. Additionally, consumers need to be aware that credit monitoring, locks, and freezes alike don’t protect against things like tax fraud and medical fraud, in which identity thieves can file bogus tax returns on your behalf to claim your refund or jeopardize your insurance coverage by scamming your provider.
Consumers also may have more resources available to them for free than they realize. Some tools like resolution services for active fraud or general identity monitoring are available as a perk from certain insurance companies, financial institutions, and even human resources departments of large employers. “There’s no silver bullet, but there are options,” CyberScout’s Levin says. “With a lock or whatever new thing it’s sort of like ‘mazel tov, you have a lock!’ It’s an advertising gimmick. But the bottom line is no matter what you use, you just need to know as quickly as possible when you have a problem, and you need to have a plan.”
If you’ve lost faith in Equifax (fair enough) you may not want to trust the protections the company offers. But with so much already beyond your control, take everything you can get. Channel your doubts instead into finding out what other services you have available and forming a more comprehensive plan than Equifax is offering.