Consumers affected by Equifax's huge data breach in 2017 may need to re-establish protections on their credit report if they "locked" their files as part of the company's free credit-monitoring offer. People who accepted Equifax's offer after the breach have been notified that the free service, TrustedID Premier, will expire at the end of January.
If subscribers locked their Equifax credit files using the service to prevent the opening of fraudulent accounts, the locks will automatically lift when TrustedID expires, according to Equifax. The locks will also end if, before Jan. 31, the consumer enrolls in a similar service that breach victims are being offered.
The upshot? Consumers who want to keep the lock on their Equifax credit files have to use a different product — like the company's free "lock & alert" service, the company suggested.
Perplexed? You are not alone. Notices e-mailed to Equifax subscribers explain the lock issue — if readers click through to a question-and-answer page. But some subscribers and consumer advocates worry that people may not absorb the details and remain unaware that they have to relock their Equifax credit report. Credit locks are marketed by credit bureaus as a convenient way to prevent lenders and others from obtaining your credit report without your knowledge.
"There's an opportunity for consumers to be confused," said Paul Stephens, director of policy and advocacy with Privacy Rights Clearinghouse, a nonprofit consumer advocacy group. If consumers don't relock their files — and if they haven't used another option, known as a security freeze — "they're still going to be very vulnerable," he said.
Christina Tetreault, a staff attorney at Consumers Union who specializes in financial services, said the situation illustrated why the best way to guard against account fraud is to place a security freeze — not a lock — on your files at all three credit bureaus.
Federal law now requires credit bureaus to offer security freezes free of charge. A freeze accomplishes the same thing as a lock, she said, but with a freeze, your rights are defined by law. With credit locks, she said, the bureaus set the rules. "With a freeze," Tetreault said, "the power belongs to the consumer."
Equifax initially told at least some subscribers that it would extend free credit monitoring through TrustedID Premier, according to e-mails shared with the Times. But later, it switched to an offer of a second year through the credit bureau Experian, a competitor. Some subscribers may already have switched, but the deadline to enroll for the free extra year is Jan. 31, the Equifax notice said. (Experian normally charges a monthly fee for its service, called IDnotify.)
Equifax spokeswoman Nancy Bistritz-Balkan said the company would continue to offer credit monitoring tools to consumers, but had a "strategic relationship" with Experian to provide a year of free credit monitoring to breach victims through IDnotify.
It's unclear how many people may be affected by the lock issue. Bistritz-Balkan declined to say how many consumers had enrolled in free credit monitoring after the breach, which compromised the personal information, including Social Security numbers, birth dates and other sensitive details, of more than 145 million people. Credit monitoring services notify subscribers of activity in their credit files, which are maintained by the three big credit bureaus (the third is TransUnion), as a way to flag possible fraud or identity theft. The services may also offer a package of other related features.
Stephens said he was puzzled by Equifax's move to offer consumers credit monitoring from a competitor. Still, he said he saw no harm in using free credit monitoring — as long as it covered all three bureaus and consumers realized that it was a "reactive" service that notified them of activity in their credit file after it occurred, rather than preventing it. Here are some questions and answers about credit protection:
Q: What if I subscribed to TrustedID Premier but have a security freeze on my Equifax credit file, rather than a lock?
A: The expiration of credit monitoring from TrustedID Premier won't affect credit freezes — just locks. "If your Equifax credit report is frozen and not locked," Equifax told subscribers, "the security freeze will stay in place."
Q: How do I establish a credit freeze?
A: To freeze your credit files, visit the website of each credit bureau (Equifax, Experian and TransUnion) and follow the instructions to register and apply the freeze. You will also get instructions on how to thaw the freeze if you want to apply for a loan or a credit card; details vary by bureau.
Q: What other steps can I take to protect myself from identity fraud?
A: A good practice is to check your credit file periodically for any suspicious activity. You are entitled to a free copy each year from the three credit bureaus at www.annualcreditreport.com.
Ann Carrns writes for the New York Times
