Equifax hack: Freezing your credit isn’t enough

The Equifax hack exposed the names, addresses, birthdates and Social Security numbers of up to 145.5 million Americans. Drivers license information for 10.9 million people was also exposed, according to a Wall Street Journal report.

Credit freezes won’t prevent criminals from taking over credit, bank, retirement and investment accounts, says security expert Avivah Litan with Gartner Research. Thieves also could use the purloined information to snatch your tax refund or mess with your Social Security benefits. Your email, phone, shopping and cloud-based storage accounts aren’t safe, either.

Read my Associated Press column for the steps you should take now.

Lies, damn lies and press releases

Customer Support liarA recent press release from an “identity theft protection company” was so filled with misinformation, I had to double-check make sure it wasn’t April Fool’s Day.

Here’s what it said:

The Federal Trade Commission believes ID Fraud will be a significant issue during this tax season. Many people will consider freezing their credit report if they fear they’ve been a victim of ID Theft but national ID theft protection company, Protect Your Bubble, says consumers may want to be patient before going through the the credit freeze process.

Reasons To Rethink Freezing Your Credit During ID Fraud Scare

Here are some reasons you may want to consider for any stories you might be planning around tax season:

  • If you do put a freeze on your credit report it can take up to a month for the credit bureaus to do the unfreeze

  • During a freeze, all credit cards are frozen

  • Your debit card may also be impacted

  • Consumers may need to go to a cash lifestyle even to pay bills

  • All of your automated bill payments are then frozen and that can negatively impact your credit even further if/when you miss payment

It goes on, but each of those bullet points is patently, demonstrably untrue. In reality:

  • Unfreezing a credit report takes a few minutes by phone or online. Credit bureaus have to respond to written requests within three days.
  • Credit cards are not affected by a credit freeze.
  • Debit cards are not impacted by a credit freeze (freezes apply to credit reports, not bank accounts).
  • There’s no reason to go to cash when your credit and debit cards still work.
  • Automated bill payments aren’t affected, since neither your credit cards nor your bank accounts are altered by a freeze.

When I asked the public relations person who sent out the press release to explain, I got back an apology for for “miswording the bank/credit card payments in the pitch” but then she repeated some of the [baloney]:

If they [individuals] are alerted to the fact that they may have been a victim of ID Theft, they should not rush to freeze their credit report since it can be a lengthy process to unfreeze. Due to the growth in phishing scams consumers need to be cognizant of the realities of what may or may not be taking place.

Um, what?

I tried again, contacting the company itself. This is what I got back:

Upon reviewing the press release, we see how the statement about the payment of bills and credit cards when a credit report is frozen was misleading. You’re correct: A frozen credit account will not prevent you from paying bills. But, I think it’s important to point out that consumers will have a difficult time applying for a new credit / debit card while their account is frozen. In any case, consumers should check with their financial institutions and creditors to verify their unique policies.

I’m not sure why you’d have trouble getting a debit card, unless you were opening a new account and the bank ran a credit check. But the fact that you have to unfreeze your credit reports if you want to apply for a new credit card is indeed a potential downside. It’s a potential downside that wasn’t even mentioned in the press release, however. And the statements weren’t “misleading.” They were wrong. As in “Holy cow, we blew it, this is embarrassing” wrong.

Credit freezes are something you should consider if you’ve already been the victim of identity theft or you’re at high risk because your Social Security number has been stolen or exposed in a breach. Credit freezes pretty much prevent new account identity theft, where someone opens new credit accounts in your name. If you’ve got a freeze in place, you likely won’t need “identity theft protection,” which is an oxymoron anyway because the companies can’t protect you from anything; at best, they can give you early warning and help you clean up the mess. The press release’s suggestion that you hold off on a freeze “until there has been an activity reported against you specifically” is rather witless. Waiting for the bad guys to steal your credit after they’ve got their hands on the keys is like closing the barn doors after the horses have fled.

Credit freezes come with costs. You typically must pay to freeze and unfreeze your reports ($2 to $15 per bureau, depending on your state law, for each freeze and thaw). If you’re planning to apply for credit, change insurers or wireless carriers, or start utility service, you have to remember to thaw your report so those providers can have access. So there’s a hassle factor, but credit freezes won’t mess up your day-to-day financial life.

A final thought: The press release mentions tax season identity theft, a reference to the fact that identity thieves are filing phony tax returns right and left. But nothing–not a credit freeze, and certainly not an “identity theft protection company”–can protect you from that crime. That’s what’s so awful about it. For more, read my Reuters column, “Why identity thieves are targeting your tax return.



Want to protect yourself from tax return theft? You can’t.

Zemanta Related Posts ThumbnailA surge of bogus tax return filings has highlighted a grim truth: We can’t protect ourselves from this rising threat.

An underfunded, understaffed IRS manages to thwart many attempts, but still sent more than $5 billion in refunds to identity thieves in the 2013 tax year. Most state tax agencies aren’t nearly as sophisticated in detecting fraud, which is why the bad guys seem to be targeting them this year.

The core problem is that the key to your tax refund–as well as to your credit and your health records–is your Social Security number, which was never intended as an all-purpose identifier.

Even if you’re vigilant in protecting your  number, you’re still at risk, because a lot of companies aren’t so vigilant.

Court Ventures, now a subsidiary off Experian, sold an unknown number of records including Social Security numbers to identity thieves from a database of 200 million files. Anthem’s breach exposed 80 million people’s records. And they’re hardly the only ones. The US Postal Service, University of California Berkeley, the Oregon Employment Department, dozens of hospitals and medical centers–the list of places Social Security numbers have been stolen goes on and on and on. (Check out the Privacy Rights Clearinghouse chronology of breaches, showing more than 1 trillion records have been compromised.)

You may be able to beat the thieves to your tax refund by filing early–but that boat has already sailed for many victims.

Read more in my Reuters column, “Why identity thieves are targeting your tax return.”