“On a scale of 1 to 10, this is a 10.”
So said fraud analyst Avivah Litan about the recent cyber-theft at credit-reporting firm Equifax that potentially compromised the financial and identity information of more than 140 million Americans. Equifax, one of the nation’s big-three credit-reporting companies, said the incident occurred over a period of months as hackers exploited a vulnerability in an Equifax “website application.”
Among the data accessed: Names, Social Security numbers, birth dates, home addresses and, in some cases, driver’s license numbers. In addition, thieves snatched the credit card numbers of more than 200,000 people, along with credit-dispute documents containing personally identifiable information for 182,000 people.
Although the attack isn’t the largest cybersecurity breach (a 2013 Yahoo incident that exposed data related to 3 billion user accounts tops it), the Equifax incident is the most severe data theft yet because of the multiple types of data involved. A swindler with access to a person’s name, SS number, birth date, and home address could get approved for credit in that person’s name, tap his or her health insurance coverage, and/or commit tax fraud.
Perhaps most worrying of all is that this particular cyber-theft is expected to have ongoing effects because the stolen information can be used (and resold to other thieves) for years to come.
What can you do?
The FBI is investigating the attack, but it may be months before there’s a breakthrough. Even if the thieves are caught, data theft can’t be undone. So it’s wise to do what you can to prevent illegal use of your personal data.
To start, find out if Equifax has tagged your information as being among the data compromised. Go to www.equifaxsecurity2017.com and click “Am I Impacted?” But whether or not the site says your data was included in the breach — Equifax may not know the full scale of the attack — it’s prudent to sign up for Trusted ID Premier, a suite of protective services Equifax is offering for one year at no charge. The sign-up deadline is Nov. 21, 2017.
- Credit Lock
Trusted ID Premier includes the ability to “lock” your credit report. The “lock” (a term Equifax uses to differentiate this one-year service from a longer-lasting and legally defined “security freeze”) prevents lenders from accessing your Equifax credit report — except for those lenders you’re already doing business with — thus making it more difficult for someone to get credit in your name. “[M]ost creditors need to see your credit report before they approve a new account,” notes the Federal Trade Commission. “If they can’t see your file, they may not extend the credit.”
That said, the credit lock will not prevent a thief from making charges on existing accounts. So monitor your bank, credit card, and insurance statements for fraudulent transactions.
Also, be aware that while locking your credit report won’t affect your credit score (a measure of your creditworthiness), it may create inconvenience. If you’re in the market for a loan, or if you’re trying to rent an apartment or buy insurance, you may have to request that your report be temporarily unlocked. However, Equifax says locking your report won’t prohibit a potential employer from accessing your report as part of the hiring process.
Unfortunately, the free lock-your-report offer is for Equifax reports only. It will have no impact on access to your credit files compiled by the other two big credit-reporting agencies, Experian and TransUnion. To freeze those reports, you’ll have to contact each company separately (and, depending on the state in which you live, you may have to pay a fee). If you’re at a stage of life where you’re not in the market for credit, it’s wise to lock or freeze all your credit reports.
- Credit Monitoring
Fortunately, all three bureaus are included in a monitoring service that’s part of the complimentary Trusted ID Premier package. Credit-file monitoring will alert you to any key changes that occur in your Equifax, Experian, or TransUnion reports.
Another Trusted ID Premier feature is identity-theft insurance that’ll cover certain out-of-pocket expenses (up to $1 million) in the event you’re a victim of identity theft.
In addition to signing up for the free services from Equifax, two other steps may help you avoid problems related to data theft.
Regularly review your credit reports from all three major credit bureaus. Since federal law allows you to get a free report from each bureau once a year, you may want to order one report every four months. Get details at AnnualCreditReport.com.
- File Early
File your 2017 income taxes as early in the tax season as possible. This will help prevent a fraudster from claiming a refund by filing as you.
If you don’t want the hassle (and potential cost) of adding and “thawing” a security freeze, you can add a 90-day “fraud alert” to your credit files at no charge. The alert requires lenders to take additional steps to verify your identity before issuing a credit card or opening a new account in your name. If you’re a victim of ID theft, you can request that each credit bureau place an “extended” alert that will remain in force for seven years.
Fraud experts are warning about scams related to the Equifax theft. One involves a phone call from a con artist posing as an Equifax rep. You’ll be told that your case is being investigated and that the caller needs you to “confirm certain information.” It’s a ruse to get you to reveal your account numbers and Social Security number.
You also might receive an official looking email, purporting to be from your bank or broker, asking to you to click a link to learn more about how you may be affected by the Equifax incident. Don’t click. The link likely will infect your computer with malicious software.