In the days since the credit reporting agency Equifax disclosed the breach of 143 million consumers’ private financial data, howls of outrage have only grown louder.
Dozens of potential class-action lawsuits have been filed, Congress has revved up hearings on the breach, and two legislators have promised bills targeting the credit reporting industry. For its part, Equifax is offering consumers a free credit freeze and one year of credit monitoring to compensate for a breach that permanently increases their risk of identity theft.
But consumers whose Social Security number or credit card information has been exposed can’t wait for reforms or depend on a limited monitoring service. Even those not affected by the breach should proceed as if they were: It’s just one of 313 hacking or unintentional disclosures so far this year as tracked by the Privacy Rights Clearinghouse.
Assume thieves have your information. Your chance to limit their ability to use it depends not on Equifax or Congress, but on what you do.
Don’t rely on a system that has already failed
Credit bureaus collect data on how you’ve repaid debts you’ve incurred. They make money by selling that information to creditors who use it to see if they want to do business with you. The data they collect include birth dates, addresses, driver’s license numbers and even Social Security numbers — the skeleton keys to your financial life.
You can’t avoid the three major credit bureaus if you use credit cards or have loans. Nor do you get a say in how the bureaus will protect your data or what the remedies will be if your information is compromised.
“We are the commodity, not the customer,” says attorney Chi Chi Wu of the National Consumer Law Center. “We can’t decide, ‘Oh, I don’t want to deal with Equifax, so just send my data to the other credit bureaus.’ We don’t get to decide which credit bureaus we want to deal with.”
Even taking the available steps now to protect your credit records is no guarantee.
“You should cross your fingers that the bureau system that was unable to protect your information in the past will do so in the future via that bureau’s freeze, lock, monitoring or ID theft protection programs,” says Barry Paperno, who blogs at Speaking of Credit.
What to do after the Equifax wake-up call
There’s no substitute for your own vigilance in checking your financial statements and credit records and acting immediately to limit the damage. Assume that your information is out there and that a criminal can get it.
Watch your credit card accounts for suspect charges
Even if your data weren’t compromised in this breach, identity thieves are always at work.
Don’t wait for your monthly statement to arrive; fraudulent charges may pile up before you notice. Check your accounts online frequently or set an alert to notify you whenever a charge above a set amount is made. You can challenge fraudulent credit charges, but your best protection from liability depends on alerting your issuer in a timely fashion.
Monitor your credit scores and reports
You also need to watch for signs that someone has opened new accounts using your data. Regularly check your credit scores for unexplained movements and your credit reports for accounts you don’t recognize.
Decide how to secure your credit data
A credit freeze offers the best firewall against your data being misused because it restricts access to your records. It can cost up to $10 per bureau, and you also have to pay to lift the freeze later if you want to apply for new credit.
While Equifax is covering the cost of credit freezes and monitoring of its own records, it’s not doing the same for freezes and monitoring through the other major credit bureaus, TransUnion and Experian.
Fraud alerts offer less protection, merely flagging lenders and card issuers that credit applications should receive extra scrutiny. In most cases, a lender will contact you to verify a credit application. The service is free, but most alerts last only 90 days unless you renew them.
All three credit bureaus have some sort of “credit lock” service, and they may offer these as an alternative when you try to freeze your credit. It’s easier to lift a lock when you want to apply for credit, but locks don’t block access as thoroughly as a freeze. Your data can be accessed by businesses that want to screen you for promotional offers, for instance.
And all three bureaus’ terms of service require you to waive your right to participate in a class-action lawsuit and use arbitration instead. Cost varies, from free to more than $20 a month, but you may be able to lock all three bureaus with one service.
Learn more about protecting your credit