The flood of post-breach consumer action is encouraging, but many still didn’t check their credit
Sixty-one million Americans checked their credit in the immediate aftermath of Equifax’s massive data breach, according to a new CreditCards.com poll.
Our national telephone survey of 1,001 U.S. adults found 26 percent reviewed their credit scores or their credit reports within two weeks of the Sept. 7 breach announcement. The security lapse left nearly 146 million Americans’ personally identifiable information, including names, addresses and Social Security numbers, vulnerable to identity thieves. It also exposed the credit card numbers of 209,000 consumers and dispute documents for 182,000 people, Equifax said.
Concerned consumers flooded the websites and call centers of Equifax and the other two major credit bureaus – Experian and TransUnion – in the wake of the breach. Identity theft assistance groups were inundated as well.
“The Identity Theft Resource Center has received the most calls to its call center in any month since we’ve been tracking that,” Eva Velasquez, CEO of the ITRC, said in late September. “We’ve received by far the most visitors and page views to our website, specifically to our information on what to do if you receive a data breach letter and on credit freezes.”
The heightened awareness among consumers is encouraging, but many still aren’t taking the proper steps to fight fraud. Our survey found that 21 percent of consumers have never checked their credit reports or their credit scores – including many who said they’ve heard “a lot” about the breach. Meanwhile, fraudsters are licking their chops over a feast of personal data that can be used to open phony credit card accounts, steal tax refunds, file fraudulent medical claims and more.
Key poll findings
Here’s what else our survey found about consumers’ actions after the Equifax breach:
- Older millennials answered the alarm. Thirty-three percent of 27- to 36-year-olds checked their credit reports or credit scores in the two weeks after the breach – a higher percentage than any other age group.
- A lot of young millennials didn’t hear about it. Half of consumers age 18-26 said they weren’t aware the Equifax breach occurred.
- Many just ignored it. Fifty-three percent of respondents said they heard “a lot” about the data leak, but didn’t check their credit reports or scores.
- Some didn’t need it. Fourteen percent said they checked their credit within the past two weeks despite not hearing anything about the breach.
The scientific survey of 1,001 adults was conducted Sept. 21-24 via landline and cellphone. See survey methodology.
You checked your credit – now what?
Checking your credit report and credit score are important first steps in your post-breach protection plan. You can do both for free at CreditCards.com, and you’re entitled to one complimentary credit report from each of the three major bureaus per year at AnnualCreditReport.com.
But credit reports and scores provide only a snapshot of your credit profile the last time your account and payment information were reported to the credit bureaus. And the information stolen in the Equifax breach will reside in shady databases indefinitely, waiting to be misused or sold on the dark web.
“I hope this has awakened Americans’ consciousness about privacy and credit that they need to be paying far more attention to,” Rep. Debbie Dingell, R-Michigan, said in an Oct. 3 congressional hearing on the breach. “This breach is different from most. You can’t change your Social Security number and I can’t change my mother’s maiden name. This data is out there forever.”
There are signs that many consumers aren’t just pulling their credit reports once, checking them for phony accounts and moving on with their lives.
“Since Equifax announced its data breach on Sept. 7, TransUnion has been focusing on assisting millions of consumers coming through our call centers and website to freeze or lock their credit reports, or place fraud alerts,” David Blumberg, senior director of public relations at TransUnion, said in a statement.
There are many different security methods available, and not all are appropriate for every consumer. But taken together, they can form an effective barrier against fraud. Here’s a look at the primary methods.
Credit freeze: Protection at a price
A credit freeze bars lenders and other companies from accessing your credit report. Many experts say it’s the strongest protection available against fraudulent accounts opened in your name. But a credit freeze often comes with fees to place and remove it (depending on what state you live in) and it can complicate your life if you frequently need to access your credit.
“Maybe you have to move a lot, and every time you rent an apartment, you have to have a credit check,” ITRC’s Velasquez said.
Meanwhile, the fees associated with credit freezes – typically $5 to $10 – have come under scrutiny in the wake of the breach. The center launched a petition asking the CEOs of the three major credit bureaus to provide all consumers with one free credit freeze and a free thaw-and-refreeze per year. Additionally, Sen. Elizabeth Warren and a band of other senators introduced a bill in September that would make credit freezes free.
Currently, credit freezes are free to identity theft victims, but not to consumers whose information was exposed in a data breach. However, Equifax is offering to add, lift or permanently remove credit freezes through Jan. 31, 2018.
“We absolutely think that a credit freeze should be strongly considered by all consumers, and certainly when you know your information has been compromised,” Velasquez said.
The bureaus have also begun to advertise a service called a credit lock that they say functions the same way as a credit freeze. On its website, Equifax explains that a lock is more mobile friendly than a freeze and uses usernames, passwords and one-time passcodes instead of PIN-based authentication. But experts say the credit lock is more of a marketing ploy than a protection tool.
“They certainly position it as being the same thing as a security freeze, but common sense says that can’t be the case,” said Rob Douglas, an identity theft and scam expert based in Colorado. “If it was the same thing, then they wouldn’t be offering a secondary product.”
More on the Equifax data breach:
Fraud alert: Free, but not foolproof
When you place a fraud alert on your credit report, card issuers and lenders must verify your identity before they can access your credit file. It’s free, it lasts 90 days and you only have to notify one of the three major credit bureaus to cover all of them. But creditors are not legally bound to verify your identity and, in many cases, they don’t.
“There are plenty of stories of that not happening,” Douglas said. “It’s voluntary on the part of retailers and others who may open an account.”
However, Douglas said the Equifax breach may encourage lenders to pay closer attention to fraud alerts. He also noted that fraud alerts are relatively simple to enact and can be renewed as often as necessary. Identity theft victims can place fraud alerts that last seven years, but they are typically required to provide police reports and other documents beforehand.
Credit monitoring: Free for a year, if you trust Equifax
Consumers and experts alike debate the value of paying for monthly credit monitoring packages offered by credit bureaus and other companies. But you can get credit monitoring free from Equifax for a year if you sign up before Jan. 31, 2018. Experts say you should take the beleaguered bureau up on its offer.
“As much as we may all feel uncomfortable doing anything with Equifax because of what has taken place, I still recommend that people take advantage of that free monitoring,” Douglas said.
In general, credit monitoring services notify you of credit report changes within 24 hours and allow you to check your credit score at any time. Some scan the internet for misuse of your personal information and insure you against identity theft that occurs while you’re using the service (Equifax’s service does both).
But these services can’t prevent identity thieves from applying for credit cards and loans in your name. Veteran journalist and cybersecurity expert Brian Krebs noted in a blog post about the Equifax breach that credit monitoring packages are more effective at helping consumers recover from identity theft than protecting them from it.
“I hope we don’t go back to sleep,” Velasquez said. “We’ve seen this evolution before with a big scale breach. Everybody starts focusing on privacy and data security and what it means to them, and then it dies down. And then it happens again.”
CreditCards.com commissioned Princeton Survey Research Associates International to obtain telephone interviews with 1,001 adults living in the continental United States. Interviews were conducted by landline and cellphone in English and Spanish from Sept. 21-24, 2017. Statistical results are weighted to correct known demographic discrepancies. The margin of sampling error is plus or minus 3.9 percentage points.
See related: Q&A: What to know, what to do about Equifax breach, How to avoid unnecessary fraud freezes in the wake of Equifax breach