People who froze their credit files before September may notice some changes when the time comes to thaw the files.
As of Sept. 21, a new law requires that the three major credit reporting bureaus — Equifax, Experian and Trans- Union — allow consumers to place or lift a security freeze on their credit files without charge. Freezing means lenders can't check your credit file unless you "thaw" the freeze, preventing criminals from opening credit cards or borrowing money in your name. Consumer advocates recommend a freeze at all three bureaus as a way to thwart identity thieves.
People who had already established security freezes, and now want to thaw them to apply for a loan or credit card, will see a difference. With the new law taking effect, two bureaus — Equifax and TransUnion — abandoned the use of personal identification numbers, or PINs, to manage freezes online. (PINs are still needed, though, if you want to lift a freeze by calling on the phone.)
Equifax, which suffered a major data breach last year, changed its approach on Sept. 19 in response to "consumer feedback," said spokeswoman Nancy Bistritz-Balkan. (Consumers had complained after the breach that the PINs issued by Equifax weren't generated in a secure way.) Now, instead of issuing PINs, Equifax has consumers establish a password-protected online account.
People who had placed a freeze at Equifax under the old system don't need to do anything to re-establish it, Bistritz-Balkan said. Their credit file remains on ice.
But if consumers want to suspend or lift the freeze at Equifax online, they must now create a "myEquifax" account by entering personal information including a Social Security number and a birth date. Their e-mail address serves as their user name; they create their own password, using Equifax's criteria. And Equifax has added extra security steps, such as sending a one-time code to your phone or e-mail to activate the account. (The steps vary by consumer.)
Once users are logged on, Bistritz-Balkan said, they may suspend or remove their freeze. The new process, she said, is intended to "establish, verify and authenticate that the consumer's identity is connected to the consumer every time."
TransUnion had already required consumers to have an account with a user name and a password, as well as a PIN. Now, users can log on to a computer or app using those credentials, to lift or suspend a freeze — no PIN needed, according to its website. Bob Skwarek, a TransUnion spokesman, said in an e-mail that consumers complete a "stringent" authentication process when they sign up for an account to freeze their credit.
"Only users who can verify that they are who they say they are can create a user name and password to log in, create and manage a freeze," Skwarek said.
The third bureau, Experian, still requires a PIN to lift a freeze.
"We've kept this in place as it provides a level of security that the consumer has control over," a spokesman said.
To lift a freeze, consumers enter personal details on Experian's website as well as their PIN. If consumers lose their PIN they can complete an online process to get a new one.
Ann Carrns writes for the New York Times.
