As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/
Options
The Equifax Consumer Information Leak and You (Updated 2019-07-25)
bowen
How you doin'?Registered User regular
How you doin'?Registered User regular
In September of 2017, Equifax announced they had had been hacked and consumer information was stolen in July of 2017. Almost 150 million people's information was exposed. That's nearly every single adult person in the United States, and maybe even more than that (children!).
"What can I do to protect myself?"
The first thing you should do is pull your credit report and get rid of any discrepancies (incorrect information about yourself). You can get this at https://www.annualcreditreport.com/ . Load up yours and any children/dependents and get rid of anything that's wrong. If you notice anything that's not right, like loans or lines of credit you might not have taken out, skip right to fraud : https://www.identitytheft.gov/
If nothing looks amiss yet, the next steps you might want to do are place a fraud alert on your credit, or, freeze it. A fraud alert is just a notice from the credit bureaus that someone is attempting to take out a line of credit in your name. Whether this will actually protect you or not is up in the air. These last for about 90 days, but can usually be renewed indefinitely. Some states allow the credit agencies to charge for this. You can place the Fraud Alerts below:
More Info - https://www.consumer.ftc.gov/articles/0275-place-fraud-alert
"That doesn't seem like it'd protect me, what else can I do?"
My personal recommendation is a credit freeze with all the major bureaus.
A credit freeze blocks banks and companies that give credit of any sort from pulling your credit report. Why is this important? This is the first step to taking out a new line of credit. Without it, banks can't (shouldn't) do anything, and it stops someone dead in their tracks. The fraud alert will still allow a fraudster to accomplish this first part, and potentially damage your credit before anything can be done about it. There are some less than great places that loan money to people on nothing more than a whim, like payday loans. The downside to shit is if you need credit you'll need to remove the freeze. But that is better than having your credit ruined. I'd recommend doing it a few days ahead of time, and then once the credit is established (can take up to a month) to reactivate the freeze.
Here's the top 3 credit agencies and their freeze pages:
You can also reach out to them over the phone:
Note: Some states allow you to be charged for freezing and unfreezing your credit.
(E: Equifax is waiving their fee until the 21st and is refunding fees from last thursday and forward)
You'll be asked or given a PIN when you do this. Write this down/print them out. Store it in something like 1password or keepass . DO NOT LOSE THESE. YOU WILL HAVE A ROUGH TIME. Get a safe deposit box at a bank and drop the paper versions in. Do not store plain text versions of these on your computers, but you absolutely do not ever want to lose these.
If you ever need to open a bank account or a line of credit, or get a loan, you will need to unfreeze your credit to do so. This is a pain in the ass, but it's the reality of the situation until the whole system itself gets fixed by all the credit agencies and Social Security itself. And it's far less of a pain in the ass than someone opening one of those in your name for themselves and ruining your credit.
There's also a 4th credit agency that doesn't get used a whole lot, but sometimes, and I'd recommend freezing that as well:
You might also want to freeze ChexSystems, which will slow down people trying to open bank accounts in your name too.
(you'll need the 9 digit zip code for your address for that one)
What's Next?
There are rumors of a class action lawsuit. Nothing's really definitive yet. There's also this, which was spun up by the DoNotPay people who fought parking tickets a while back. I assume this is a thing, but I haven't looked into it personally.
"Should I sign up with Equifax's fraud alert at https://www.equifaxsecurity2017.com/ ?"
It was being suggested that by signing up for their fraud protection on that website, you would be waiving your right to sue them and moving to arbitration. The NYS Attorney General said this was illegal, but it's better to be safe than sorry and ignore that site completely. There's a nearly 100% chance that if you've had a loan, a credit card, or a bank account in the past 10 years as a US resident, that you've been compromised by this data breach. They've since clarified that that portion of the terms of use will not apply to this breach, but, a credit freeze should be more than enough to address the problem going forward.
More information:
https://www.identitytheft.gov/Info-Lost-or-Stolen
https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs
Sources:
https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do
https://www.nbcnews.com/tech/security/massive-equifax-data-breach-could-impact-half-u-s-population-n799686
https://np.reddit.com/r/personalfinance/comments/6ysxxf/how_to_tell_if_you_got_equifaxd_and_what_to_do/
https://www.nbcnews.com/tech/security/here-s-what-you-can-do-about-equifax-data-breach-n800501
https://www.usatoday.com/story/money/2017/09/11/equifax-hit-least-23-class-action-lawsuits-over-massive-cyberbreach/653909001/
I will amend this as new information becomes available! Feel free to post it and @ me or PM me about stuff.
UPDATE:
You can now get reimbursed via the Equifax settlement:
https://www.ftc.gov/equifax
More information in the link above.
"What can I do to protect myself?"
The first thing you should do is pull your credit report and get rid of any discrepancies (incorrect information about yourself). You can get this at https://www.annualcreditreport.com/ . Load up yours and any children/dependents and get rid of anything that's wrong. If you notice anything that's not right, like loans or lines of credit you might not have taken out, skip right to fraud : https://www.identitytheft.gov/
If nothing looks amiss yet, the next steps you might want to do are place a fraud alert on your credit, or, freeze it. A fraud alert is just a notice from the credit bureaus that someone is attempting to take out a line of credit in your name. Whether this will actually protect you or not is up in the air. These last for about 90 days, but can usually be renewed indefinitely. Some states allow the credit agencies to charge for this. You can place the Fraud Alerts below:
- TransUnion - https://www.transunion.com/fraud-victim-resource/place-fraud-alert
- Experian - https://www.experian.com/fraud/center.html
- Equifax - https://www.alerts.equifax.com/AutoFraud_Online/jsp/fraudAlert.jsp
More Info - https://www.consumer.ftc.gov/articles/0275-place-fraud-alert
"That doesn't seem like it'd protect me, what else can I do?"
My personal recommendation is a credit freeze with all the major bureaus.
A credit freeze blocks banks and companies that give credit of any sort from pulling your credit report. Why is this important? This is the first step to taking out a new line of credit. Without it, banks can't (shouldn't) do anything, and it stops someone dead in their tracks. The fraud alert will still allow a fraudster to accomplish this first part, and potentially damage your credit before anything can be done about it. There are some less than great places that loan money to people on nothing more than a whim, like payday loans. The downside to shit is if you need credit you'll need to remove the freeze. But that is better than having your credit ruined. I'd recommend doing it a few days ahead of time, and then once the credit is established (can take up to a month) to reactivate the freeze.
Here's the top 3 credit agencies and their freeze pages:
- Transunion - https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp
- Experian - https://www.experian.com/ncaconline/freeze
- Equifax - https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp
You can also reach out to them over the phone:
- TransUnion - 1-888-909-8872
- Experian - 1‑888‑397‑3742
- Equifax - 1-800-349-9960
Note: Some states allow you to be charged for freezing and unfreezing your credit.
(E: Equifax is waiving their fee until the 21st and is refunding fees from last thursday and forward)
You'll be asked or given a PIN when you do this. Write this down/print them out. Store it in something like 1password or keepass . DO NOT LOSE THESE. YOU WILL HAVE A ROUGH TIME. Get a safe deposit box at a bank and drop the paper versions in. Do not store plain text versions of these on your computers, but you absolutely do not ever want to lose these.
If you ever need to open a bank account or a line of credit, or get a loan, you will need to unfreeze your credit to do so. This is a pain in the ass, but it's the reality of the situation until the whole system itself gets fixed by all the credit agencies and Social Security itself. And it's far less of a pain in the ass than someone opening one of those in your name for themselves and ruining your credit.
There's also a 4th credit agency that doesn't get used a whole lot, but sometimes, and I'd recommend freezing that as well:
You might also want to freeze ChexSystems, which will slow down people trying to open bank accounts in your name too.
(you'll need the 9 digit zip code for your address for that one)
What's Next?
There are rumors of a class action lawsuit. Nothing's really definitive yet. There's also this, which was spun up by the DoNotPay people who fought parking tickets a while back. I assume this is a thing, but I haven't looked into it personally.
"Should I sign up with Equifax's fraud alert at https://www.equifaxsecurity2017.com/ ?"
It was being suggested that by signing up for their fraud protection on that website, you would be waiving your right to sue them and moving to arbitration. The NYS Attorney General said this was illegal, but it's better to be safe than sorry and ignore that site completely. There's a nearly 100% chance that if you've had a loan, a credit card, or a bank account in the past 10 years as a US resident, that you've been compromised by this data breach. They've since clarified that that portion of the terms of use will not apply to this breach, but, a credit freeze should be more than enough to address the problem going forward.
More information:
https://www.identitytheft.gov/Info-Lost-or-Stolen
https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs
Sources:
https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do
https://www.nbcnews.com/tech/security/massive-equifax-data-breach-could-impact-half-u-s-population-n799686
https://np.reddit.com/r/personalfinance/comments/6ysxxf/how_to_tell_if_you_got_equifaxd_and_what_to_do/
https://www.nbcnews.com/tech/security/here-s-what-you-can-do-about-equifax-data-breach-n800501
https://www.usatoday.com/story/money/2017/09/11/equifax-hit-least-23-class-action-lawsuits-over-massive-cyberbreach/653909001/
I will amend this as new information becomes available! Feel free to post it and @ me or PM me about stuff.
UPDATE:
You can now get reimbursed via the Equifax settlement:
https://www.ftc.gov/equifax
More information in the link above.
not a doctor, not a lawyer, examples I use may not be fully researched so don't take out of context plz, don't @ me
bowen on
+25
Posts
Yes, credit freezes are just for issuance of new credit. If you're not getting out a new loan, applying for a new card, or buying/financing a new vehicle it's not going to impact your day to day. Some landlords will do credit checks when applying for an apartment, you should discuss your credit freeze with them and seek alternatives (or a temporary thaw if they need it).
What happens to my credit score during a credit freeze?
It'll still increase or decrease as normal depending on total available credit, on-time payments, age of the credit (among other things)
What happens if I don't freeze my credit?
The kind of information leaked potentially gives fraudsters the ability to freeze your credit on you, effectively locking you out of your own credit. This essentially denies you the ability to get credit ever again without someone leaning hard against the credit agencies (a lawsuit) since the only way to remove it is with the PIN that gets created. I know two of them will let you do it via snail mail with lots of proof of identities, but it's better to put it in your own hands than someone else's.
I'm outside the US, should I be worried?
There's been some reports that Canadians and others who happen to have accounts in the US were also compromised. Do whatever is appropriate for your country to secure your identity against fraud.
Equifax has confirmed that people in Canada and the UK have probably also been compromised, also it looks like it might have also impacted Argentina through an equally stupid reason.
Here's some I found via google -
How long should I thaw my credit before applying for a new loan or LOC?
The credit report agencies say to allow for up to 72 hours for a thaw to take hold.
Do I need to thaw with all 3(+) agencies to apply for a new loan or LOC?"
You shouldn't. Ask the person which of the three credit agencies they use to base their financial decision on.
Further Leaks
Equifax's report to congress near the beginning of 2018 reported that the leak might have involved more data than they originally thought. The original leak disclosure was "not exhaustive" and never intended to be the complete list of exposed data.
As it stands, currently, state issued IDs and licenses also might have been compromised.
No problem!
The 4th agency is rarely used by consumers. Near as I can tell it's a rarely used one for mortgages, so it's unlikely to impact you. It wouldn't hurt. I'd just jot down who I froze, when I froze it, and the pin, and then store everything in a safe deposit box (I use 1password personally since I'm 100% digital).
I'd be more worried about ChexSystems than Innovis.
CapitalOne and Bank of America use Innovis for their mortgages, I think.
In January of this year, there was a possibility that my SSN was compromised due to lax information security by my employer. As a result, I put a fraud alert on my credit through Experian, which came with a free credit check. I presume that was my free credit check for the year.
Should I still get a credit check? Even if the fee is small, isn't checking your credit too often something that's going to negatively impact credit history?
I'm hoping to put a freeze out on my credit as soon as I can find the time to actually get through to all these organizations, but I presume a credit check is something I want to do in addition just to ensure that nothing's happened yet.
Checking your own credit shouldn't impact your score or credit history. Doing a pull for new credit too frequently, will, though.
it's also important to note that you can get a free credit report annually from each of the three credit bureaus (TransUnion and Experian being the other two). this means THREE free reports per year.
it doesn't give your score but DOES provide you info on what accounts, credit accounts, loans, etc. the bureaus record you as having. this doesn't impact your score one bit. the "official" site is this: https://www.annualcreditreport.com/
steam | Dokkan: 868846562
This whole thing just feels like a nightmare, to be honest, so any help is very valuable.
(They did, I walked them through it the other day)
Possibly stupid question: I opted out of credit offers some time before because it's obnoxious wasteful junk mail and that was noted on the report. Would that offer any type of marginal protection as well if the companies aren't constantly monitoring your account or whatever to keep sending credit card offers?
It helps a tiny bit. One of the vectors of identity theft is people who just steal that junk mail right out of your mailbox.
But even those still need an actual credit check when you fill it in and send it back, so a freeze would stop them in their tracks.
Just keep in mind this leak was just made public, so your credit might not have been used just yet. It's within the realm of possibility that it'll be used in the near future. If it isn't addressed by the federal government (a program to transition to a new SSN without it being linked to the old one), this is a worry that will follow us in perpetuity.
As it stands I plan to keep my credit frozen forever unless I need to thaw it for a new loan (you can ask the lender who they use, and then thaw that one temporarily)
I have no loans/mortgages/significant debt in my history, so the answers to the "Is this really you?" questions tend to be all negative.
Just to expand on this slightly
There are two kinds of credit checks: A soft inquiry and a hard inquiry.
Soft inquiries are usually just a person checking their own credit score, and does not affect your credit rating. It can be important to note though, that a soft inquiry also includes background checks like a prospective employer might run, and receiving but not accepting pre-approved credit card offers. You can check your credit as often as you like and if it actually affects your score, something is wrong.
A hard inquiry usually includes actually actively applying for a loan, credit card, or mortgage. That includes going through with a pre-approved line of credit like a Target or Kohls or Macy's or store card.
Shamelessly stolen from Credit Karma's site:
It lets them know IIRC.
I have frozen all my credit scores, and decided to store my PINs for those in a private Google doc. I am aware that that information could also be hacked, but I think it's probably safer there than in my care, and a helluva lot cheaper than a safety deposit box.
What do you think? Good idea, or foolishly dangerous?
It's a generally good idea. I use 1Password, but same concept. There are some 3rd parties out there that make encryption plugins for google docs, if you want to add some extra security.
I would also point out though that for the most part safety deposit boxes are *absurdly* cheap (like a buck or two a month) and totally worth it. Passports, birth certificates, any number of legal documents, surplus house keys, small valuables (jewelry etc) that you don't ever use but would be devastated if you lost.
1Password provide what they call a Starter Kit that has the big long rando password you need to recover if you lose your phone/computer/password all at once. It also has a QR code I can scan on my phone that instantly sets my account back up in the mobile app. Print a copy, stick in the deposit box.
Dropbox has a copy of the encrypted database, which they can't decrypt.
That's it.
If you're really paranoid, you could keep it on an encrypted partition using something like VeraCrypt.
http://clark.com/podcasts/
Conversely, here are the relevant message board discussions:
http://mb.clark.com/forumdisplay.php?2-General-Discussion
http://mb.clark.com/showthread.php?54365-The-equifax-security-breach
Caveat that it's a message board/forum, so expect the typical hyperbole, jumps to conclusions, and wild accusations.
PSN:Furlion
As much as I'd like to freeze my credit I'm not really interested in spending $100 to do it ($10 x 5 agencies x 2 people).
If the cost concerns you, Equifax is waiving their fee; and I believe TransUnion is offering free freezes (but you'll have to confirm). I have not yet frozen Chex or Innovis so I can't comment on their fees. At the least, you should freeze the "big three" and then do the other two maybe a month or two down the line, when you have the free cash.
Re: Credit Karma, you need to set it up prior to instituting a freeze or it won't be able to grab the relevant info. If you set it up and then freeze your credit, the service still works fine.
I am thinking about doing the whole credit freeze, and am pondering what to do with the passcode they apparently give out. Once I do that, I will need a place to keep that passcode.
I am thinking, since I live in an area where house theft is basically imaginary, that I will get a fireproof lockbox and place the passcode in there. Probably one recommended here: http://thesweethome.com/reviews/best-fireproof-document-safe/
Does that seem sensible?
I'm not too familiar with the IRS stuff, is this the no-bid contract thing you're talking about?
That seems sensible enough. Just keep in mind if you plan to do something like purchase a car, you'll need to thaw ahead of time or keep the passcodes with you (you can thaw for a window of time, or for a particular entity).
Yes.
They've apparently patched their vulnerability. So it's unlikely you will be compromised the same way.
But I'd still keep a close eye on your credit because if you're relying on that wordpress site to tell you if you were compromised or not, you might not have gotten the correct answer (it was giving conflicting answers).
Yeah if it was that 2017 one or whatever, there's a significant possibility that it lied to you about your data being compromised or not (it was giving both a positive and negative confirmation on the same data over and over as people were testing it).
Your information might still be compromised
It doesn't matter as long as you do it regularly. Whatever works best for you.