By Susan Tompor
Detroit Free Press
WWR Article Summary (tl;dr) Beginning Sept. 21, a new federal law will help consumers protect their financial information. The three big credit reporting agencies will be required to offer you a credit freeze, free of charge.
Detroit Free Press
Just one year ago, consumers woke up and discovered that hackers had one heck of a field day with their Social Security numbers and other information in a massive data breach at Equifax.
Equifax’s screw-up would forever leave millions just that much more vulnerable to ID theft.
Face it, it’s not like you can change the locks on the side door. Once hacked, your Social Security number is out there indefinitely.
Beginning Sept. 21, though, a new federal law will help consumers stop intruders in their tracks. The three big credit reporting agencies, Equifax, Experian and TransUnion, will be required to offer you a credit freeze, free of charge. Such a freeze will restrict access to your credit file and help stop crooks from opening credit cards in your name.
Also starting Sept. 21, parents across the country will be able to get a free credit freeze for children under age 16, too. A child’s credit file would be frozen until the child is old enough to use credit.
To be sure, the new law is but a minuscule response to the widespread outrage expressed by consumers just a year ago. Even so, it is a key step for regaining some control over our data.
Yet there’s a not-so-small challenge ahead: Many people may have absolutely no idea what a credit freeze actually is and how it works, according to new research conducted by a team at the University of Michigan School of Information in Ann Arbor.
Amazingly, some consumers wrongly think that a credit freeze stops them from using their own credit cards.
So what exactly is a credit freeze?
Yixin Zou, a U-M doctoral student, said she was astonished to hear consumers disclose that they somehow associated a freeze with stopping the use of their own credit cards or limiting their own access to their existing credit cards.
“I’m quite surprised,” said Zou, 23.
Perhaps some consumers associated a freeze with times that credit card issuers send out new cards and stop us from using old ones because the numbers of the old ones have been breached.
Perhaps others remember tips that once suggested putting your credit card in the freezer in a baggie to control spending.
Who knows?
Instead, a credit freeze stops many but not all businesses and others from reviewing your credit file.
The consumer who signs up for a voluntary credit freeze is given a PIN, a PIN that you want to keep track of, to use when you want to unfreeze that credit file in order to apply for new credit.
Under the new law, if a consumer asks for a freeze online or by phone, the credit reporting agency has to put the freeze in place no later than the next business day, according to a Federal Trade Commission blog.
If the consumer wants to lift the freeze, for example, to finance a new phone or fridge, that has to happen within an hour.
“It’s just assumed that people know what a credit freeze is,” said Florian Schaub, U-M assistant professor of information, whose research focuses on security and privacy issues.
But Schaub, 35, said too often “credit freeze” is just swept into the jargon in the industry, jargon that many consumers simply do not understand.
Many times, people only fully understand a credit freeze once they’re actual victims of ID theft and told that a credit freeze is essential.
And what is a fraud alert?
Some consumers had a hard time understanding the term “fraud alert,” as well. Some thought the alerts were when a bank or credit union would text you when fraudulent activity was detected on your account.
Instead, placing a fraud alert on your credit file actually means that you’re adding a red flag, if you will, to your credit report to alert a lender to carefully verify your identity before making a loan.
Under the new law, a fraud alert will last one year, instead of 90 days. If a victim of identity theft, you’d still be able to extend a fraud alert for seven years.
We’re not talking about buying some service or signing up for some credit lock product that might have certain strings and conditions, as well as a fee. This is a free freeze.
But all that jargon, freezes, locks, alerts, can truly confuse consumers who are already overwhelmed in their financial lives.
Schaub said the credit bureaus don’t have much incentive to carefully explain things like credit freezes or fraud alerts. After all, their business model is to collect and aggregate our information to provide to lenders who want to sell us loans.
“We, as citizens, are not their customers,” Schaub said. “What makes them money is sharing our credit reports with other businesses.”
Everyone has something to lose
Many times, particularly lower-income consumers wrongly believe that they have little reason to worry and don’t really need to protect their data after a breach, according to the U-M researchers. Those consumers thought that scammers would target people who were more affluent.
“They would say ‘I’ve got nothing to lose. Why would an identity thief go after me?’ ” Schaub said.
But he said other research has shown that people of low socioeconomic status are disproportionately affected by identity theft.
The U-M research found that most consumers took little to no action to protect themselves despite the risk of identity theft. Some consumers underestimated the likelihood of becoming a victim.
Some consumers reported that they were likely to delay taking the time to handle any security-related tasks until they’re actually harmed, even though recovering from ID theft can be far more time-consuming than prevention, researchers said.
Of course, ID thieves can see huge payouts using your stolen Social Security number for all sorts of things, including getting medical care or poaching your medical insurance, filing a fraudulent tax refund (which stops you from getting your refund cash until you take steps to clear up the matter), and filing for unemployment benefits or even Social Security benefits using your number.
Putting a credit freeze won’t stop all fraud, of course, including someone who tries to file a fraudulent tax return to collect refund cash.
The Equifax breach was significant because of the kind of data that was involved.
On Sept. 7, 2017, the major credit reporting agency announced a “cybersecurity incident” where crooks gained access to Social Security numbers, birthdates, names and addresses. And in some cases, Equifax noted that some partial driver’s license numbers were stolen, too.
The incident involved data for nearly 147 million people.
Without the change in the law, many consumers in several states, including Michigan, had to pay a fee of around $10 or so for each freeze they placed on their credit files, or $30 for putting a freeze with the three agencies. Then there could be a fee of $10 or so for lifting that freeze when you wanted to take out a loan or open a credit card. Fees could be waived under certain circumstances, such as when someone has stolen your identity to open credit.
Under the new law, you can unfreeze your report at no cost, too.
Enabling consumers to get free freezes, of course, should encourage people who don’t have a lot of extra cash to consider putting a freeze on their credit.
After the Equifax breach, U.S. consumers, whether they were part of the breach or not, were allowed to sign up to freeze their credit reports at Equifax if they made a move before July 1. But the new law will go much further and offer free freezes indefinitely.
The U-M research involved in-person, comprehensive interviews with 24 consumers in the Ann Arbor area during the first few months of 2018.
Typically, while those consumers had heard about the Equifax breach, more than half of them had done nothing to further protect themselves and prevent identity theft afterwards, the research concluded.
The key to all of this, of course, is that it’s up to consumers to lock that door.
“The level of vulnerability is pretty stunning,” said Chi Chi Wu, staff attorney at the National Consumer Law Center in Boston.
Wu said being able to obtain a free credit freeze for children could be more important than some families realize _ even though children wouldn’t be part of a data breach such as Equifax.
“Children are lucrative targets for ID theft because they have clean records,” Wu said.
In many cases, though, children become victims of ID theft because parents or other family members steal the child’s ID to apply for utilities, such as electricity.
Wu said consumers need to realize that the data that’s out there can be used now or years from now.
“Now how do you prevent ID theft given that this information is out there?” Wu said. “Most people’s Social Security, birthdates, are just hanging out there.”
“It can never be taken back.”
The U-M researchers concluded that it’s not enough for companies to simply report data breaches.
The researchers maintain that companies should clearly inform consumers on how they’re affected, what their risks once ID thieves can get access to that data and what immediate steps consumers can take to protect themselves.
Even if not affected by a data breach, people should consider placing a credit freeze with each of the three credit bureaus after Sept. 21, as it substantially limits potential abuse of one’s credit report, Schaub said.
The new law, called the Economic Growth, Regulatory Relief and Consumer Protection Act, also provides that if you have guardianship, power of attorney, or conservatorship over an adult, you can get a free credit freeze for that person after providing proof of authority.
When is a credit freeze a bad idea?
Like many tools, this strategy isn’t for everyone. If you’re about to apply for a mortgage, a car loan or a student loan, don’t take out a credit freeze before you get the loan.
If you do, you’re going to have to unfreeze that credit report before you can get approved for a loan. You’ll need to consider the hassle factor.
Some entities, such as insurers and employers, are exempted under the new federal law and would still have access to your credit report even under a free credit freeze. The Federal Trade Commission notes that your report could still be released to your existing creditors or to debt collectors acting on their behalf, as well. And government agencies may have access in response to a court or administrative order, a subpoena, or a search warrant.
Most consumers are being more watchful when it comes to checking their credit card and bank statements every month to make sure that the charges are accurate or looking at their credit reports, said Matt Schulz, chief industry analysts for CompareCards by LendingTree.
“Equifax may have been the tipping point where people from now on just assume their information is already out there,” Schulz said.
How do you get a free credit freeze?
If you won’t need new credit soon, then a credit freeze may be for you. But remember, the free credit freezes for all do not hit until Sept. 21.
Under the new law, the Federal Trade Commission and the credit reporting agencies must set up web pages to make it easier for consumers to take advantage of their new rights. Those links will be in operation when the law takes effect, according to an FTC blog.
If you want a free freeze, you’d need to contact each of the agencies individually. Here are some current numbers:
Equifax’s automated security freeze system can be reached at 800-349-9960
Experian can be reached at 888-397-3742.
TransUnion is at 888-909-8872.
You’re going to need to supply data such as your name, address, date of birth, Social Security number and other personal information.
After receiving your freeze request, each credit reporting company will send you a confirmation letter containing a unique PIN (personal identification number) or password. Keep the PIN or password in a safe place. You will need it if you choose to lift the freeze.
ABOUT THE WRITER
Susan Tompor is the personal finance columnist for the Detroit Free Press.
