After Equifax announced a data breach affecting potentially more than 140 million U.S. adults, things have not gone smoothly.
The company has had to clarify or change its terms of service several times, after consumers flooded Equifax EFX, +0.40% with questions, and government officials have criticized Equifax’s response to potential victims.
Security experts suggested those who are potentially impacted request a “credit freeze” from all three credit reporting agencies, Equifax, Experian EXPN, +2.77% and TransUnion TRU, +5.00% . A freeze means no company or individual can run a credit check on you unless you give them permission. But it hasn’t been easy to do that for some, and it comes at a cost -- a credit freeze costs $10 in some states.
Don’t miss: What to do now if you’re among 143 million Americans affected by Equifax data breach
Plus, confusing language in Equifax’s terms of service temporarily prompted fears that consumers who signed up for Equifax’s security-monitoring service TrustedID had unwittingly waived the right to sue the company over the data breach. The company later said it removed the language from its website.
Do you still have questions? You’re not alone. Here are several lingering issues:
Lawsuits against Equifax are, in fact, possible
Equifax’s website now clarifies in its Frequently Asked Questions section that enrolling in free credit file monitoring and identity theft protection through the company will not require you to “waive any rights to take legal action.”
“We will not apply any arbitration clause or class action waiver against consumers related to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself,” an Equifax spokesperson told MarketWatch. “We are listening to concerns raised by consumers and in the media, and continue to work on improving the customer experience.”
“Make no mistake: Public outrage and consumer advocacy forced Equifax’s hand, compelling Equifax to remove the forced arbitration ‘rip-off’ clause,” said Robert Weissman, president of consumer advocacy group Public Citizen, in a statement.
Credit bureaus TransUnion and Experian are also overloaded with inquiries
Bruce Hayes, a business architect living in Atlanta, tried to freeze his Equifax credit report online on Tuesday, as security experts have recommended. But he received this error message from the company: “We cannot process your security freeze request online at this time. Please try back later.”
@Equifax can't seem to get it together... Error when freezing your credit report this morning... @AskEquifax #fail #Unbelievable pic.twitter.com/GlycQAj4gK— Bruce Hayes (@Sunflare98) September 12, 2017
Hayes had already frozen his reports through Experian and TransUnion with no problems, and he’s updating his login passwords to all of his financial accounts, too. “It’s shocking they cannot definitively say whether you have been impacted, and then not being able to freeze your request adds insult to injury,” he said in an email to MarketWatch.
Sean Coffey, a communications manager for the California Reinvestment Coalition, a nonprofit based in San Francisco, had no problems freezing his report through Equifax, but was unable to complete a freeze through TransUnion on his wife’s account. “The website was really clunky and kept giving me the same error screen,” he said.
He too will keep trying, but it was difficult to actually speak to a customer-service representative on the phone, because the lines were busy, and his call was disconnected several times, he said.
Indeed, TransUnion’s chief financial officer Todd Cello reportedly said at a conference this week that TransUnion’s call centers and website have been “overwhelmed” with consumers contacting the company after Equifax’s breach.
“We received an increase in call volume, so wait times are longer than usual,” a spokeswoman for Experian told MarketWatch. “We are working diligently to address the situation and will respond to callers in as timely a manner as possible.”
Experian saw an increase in traffic to its website, but “it is currently working properly,” she said.
Tried to set up a fraud alert on the @Equifax website re: the massive breach. The form is not working, of course. Good job.— Jeremy Riel (@jeremyriel) September 12, 2017
Coffey suggested anyone having problems should try using social media to express their concerns. “They’re pretty responsive when you tweet or Facebook them,” he said.
Freezing reports costs money, but getting details on the price isn’t easy
Equifax announced Monday it would waive fees on security freezes for the next 30 days. Previously, the service cost up to $10, depending on the state. It also can cost a fee to stop a freeze.
As of Saturday, Sept. 9, Equifax is also waiving all charges for placing or removing a security freeze on an Equifax credit file during the enrollment period for the credit file monitoring and identity theft protection service that is offered for free, a company spokesperson told MarketWatch. The company is also in the process of refunding any fees consumers may have paid since the company announced the breach Thursday, to put a security freeze on their Equifax credit file.
I am furious that I have to pay Equifax to freeze my credit due to their security breach. This isn't a 1-yr problem for us--it's lifelong.— MDS (@Mds97402) September 11, 2017
TransUnion offers two services, credit locking and credit freezing. A “lock” is free, and gives the consumer online, real-time control over whether a lender can get their credit report to open a new account, according TransUnion. A “freeze” also puts your credit report on lockdown, but reversing it can take time, although the TransUnion website doesn’t specify how long or which one is better in the event of a data breach. To freeze and unfreeze can cost up to $10, but again varies by state.
Experian offers a security freeze, which may cost a fee, depending on which state consumers live in. The company also offers a credit lock, as part of a credit product called CreditWorks Premium, which costs $4.99 for the first month and a steep $24.99 for each additional month. (Experian also has a free service called CreditWorks Basic, which provides fraud alerts, but doesn’t allow report “locking.”)
Experian doesn’t offer a credit lock aside from the CreditWorks Premium subscription. The Premium service includes similar services to a “freeze,” a company spokeswoman said, plus a few additional services including the ability to lock and unlock a credit file online or through an app and the ability to temporarily unlock a credit file without any delay. Consumers who don’t want to sign up for that monthly service can get a security freeze, a company spokeswoman said.
Experian also offers fraud alerts, which don’t block lenders from accessing consumers’ reports, but puts a notice on the credit report to let lenders or creditors know they should verify the consumer’s identity before approving them for new credit.
Security freeze PINs aren’t so secure
Some consumers pointed out on social media that the PIN numbers Equifax distributed to consumers who chose to freeze their credit reports were easy to guess. They were not randomly assigned, but instead were based on the time of day consumers asked for their freeze.
The company said Monday it was beginning to assign randomly generated PINs, after consumers raised “questions” about the PIN generation process.
An Equifax spokesperson told MarketWatch the company has given consumers the option to change an existing PIN. The requested new PIN will be sent to the consumer by U.S. Mail.
Homeland Security Adviser Tom Bossert and other government officials will look into the companies that handle Americans’ personal data “extensively,” said Sarah Huckabee Sanders, White House press secretary, on Monday.
The problems are probably just starting
Eric Schneiderman, New York’s attorney general, said in a statement Monday that consumers should be wary that the Equifax breach could encourage hackers and criminals to target confused consumers, pretending to be a credit reporting company or another financial institution. “Hackers are resourceful criminals who are constantly looking to exploit any vulnerabilities,” he said.
Beware of possible attacks including phishing emails that claim to be from Equifax, or claim there is a problem with your credit card, credit record or other personal financial information, he said.
Consumers should also be wary of phone calls they receive related to the Equifax breach; fraudsters have become increasingly sophisticated about masking their actual phone numbers, making it appear to the call recipient that they are from a legitimate organization. That’s called “spoofing” a phone number, and it can convince consumers they are speaking to a legitimate organization.
Instead of giving personal information over the phone, consumers should hang up on anyone who tries to ask for it. They should verify they are speaking with a legitimate organization by calling them themselves, through numbers they find on bank statements or other official documents.