Slashdot Mirror
Equifax Extends Free Credit Monitoring -- But Outsources It To Experian (krebsonsecurity.com)
An anonymous reader quotes Krebs on Security:
A year after offering free credit monitoring to all Americans on account of its massive data breach that exposed the personal information of nearly 148 million people, Equifax now says it has chosen to extend the offer by turning to a credit monitoring service offered by a top competitor -- Experian. And to do that, it will soon be sharing with Experian contact information that affected consumers gave to Equifax in order to sign up for the service... Equifax says it will share the name, address, date of birth, Social Security number and self-provided phone number and email address with Experian for anyone who signed up for its original TrustedID Premier offering. That is, unless those folks affirmatively opt-out of having that information transferred from Equifax to Experian. But not to worry, Equifax says: Experian already has most of this data. "Experian currently has and is using this information (except phone number and email address) in the fulfillment of the Experian file monitoring which is part of your current service with TrustedID Premier," Equifax wrote in its email.
Krebs also points out the big problem with all credit monitoring services: "while they might let you know when someone has stolen your identity, they're not likely to prevent that from occurring in the first place." The best mechanism for preventing identity thieves from creating and abusing new accounts in your name is to freeze your credit file with Experian, Equifax and TransUnion. This process is now free for all Americans, and simply blocks potential creditors from viewing your credit file. Since very few creditors are willing to grant new lines of credit without being able to determine how risky it is to do so, freezing your credit file with the Big Three is a great way to stop all sorts of ID theft shenanigans... All three big bureaus tout their credit lock services as an easier and faster alternative to freezes -- mainly because these alternatives aren't as disruptive to their bottom lines....
TransUnion and Equifax both offer free credit lock services, while Experian's is free for 30 days and $19.99 for each additional month. However, TransUnion says those who take advantage of their free lock service agree to receive targeted marketing offers. What's more, TransUnion also pushes consumers who sign up for its free lock service to subscribe to its "premium" lock services for a monthly fee with a perpetual auto-renewal. Unsurprisingly, the bureaus' use of the term credit lock has confused many consumers; this was almost certainly by design. But here's one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.
Krebs also points out the big problem with all credit monitoring services: "while they might let you know when someone has stolen your identity, they're not likely to prevent that from occurring in the first place." The best mechanism for preventing identity thieves from creating and abusing new accounts in your name is to freeze your credit file with Experian, Equifax and TransUnion. This process is now free for all Americans, and simply blocks potential creditors from viewing your credit file. Since very few creditors are willing to grant new lines of credit without being able to determine how risky it is to do so, freezing your credit file with the Big Three is a great way to stop all sorts of ID theft shenanigans... All three big bureaus tout their credit lock services as an easier and faster alternative to freezes -- mainly because these alternatives aren't as disruptive to their bottom lines....
TransUnion and Equifax both offer free credit lock services, while Experian's is free for 30 days and $19.99 for each additional month. However, TransUnion says those who take advantage of their free lock service agree to receive targeted marketing offers. What's more, TransUnion also pushes consumers who sign up for its free lock service to subscribe to its "premium" lock services for a monthly fee with a perpetual auto-renewal. Unsurprisingly, the bureaus' use of the term credit lock has confused many consumers; this was almost certainly by design. But here's one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.
Because people see this and go, meh, what can I do about it anyway?
We promise to tell you how many horses bolt from your barn.
What's that you say about closing the barn door? That's crazy talk!
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Replace them with a P2P for creditors, and REQUIRE a signed hard-copy release from the credit applicant before disclosing any data to anyone with the penalty of forbidding the violator from engaging in any form of credit, permanently.
That would stop all of the credit-phishing searches, for one thing, and yt would speed up the checkout lines at certain retailers (Target, for example), since they would no longer be signing up customers for credit there.
Everyone, listen to me, don't play the game.
Just freeze your credit at the big three and call it it good.
It is not a big deal to unfreeze for a period of time or unfreeze for a specific creditor.
These guys created a solution to a problem that consumers didn't ask for and now that it is a security disaster, they want you to pay them for protection and cleaning up their mess.
The credit reporting agencies have a track record of incompetence and apathy toward the people who have their identity stolen, (spoken from experience).
Freeze your credit, do it now. It takes about 20 minutes to do all three. Make sure you print all the screens, write down your PINS, and file them away safely.
Leaving aside the argument about the credit monitoring services themselves for a moment..
Freeze your credit record, if you haven't already. I did this years ago and it works really well. You give them a 6 digit PIN and without that PIN it's impossible to get so much as a cell phone much less open a line of credit. When you want to refi your home or some such, you just thaw it for a 10 day period and it re-freezes automatically.
"I shouldn't have to do that" is not going to much comfort if someone steals your identity.
For most non-Americans:
What is this business of credit monitoring and why is it needed?
After I moved to the US, I was really surprised how weak and how commonly used the SSN is. A real joke.
At some point, the federal government is gonna have to step up and seriously fix identity and identity theft.
This used to be called bank fraud. This put the banks on the hook for it and the feds investigated it.
With a magic want they kept telling everyone it was identity theft. Like someone stealing your bike from your yard. This made the person who's had the theft on the hook. And we all know how hard the local cops look for the bike thief.
All day long this is still bank fraud, and the banks who gave the thief the money should be on the hook for it.
love the taste, hate the texture
How are they supposed to perform due diligence?
The bank believes that it gave money to person A when in fact it gave it to person B because person B told the bank that he is person A. From the bank's POV, the bank gave credit to person A and thus expects that person A pays it back.
Oh. You mean that bank should ask the person asking for money for some proof of identity? Something that can be carried in a wallet. Something that is difficult to forge. Something with a person's picture. Something that can be verified against a central database. Something that is issued to everyone for free when they reach some legal age ... crazy talk, isn't it?
Why would a non-mutable, cryptographically signed data store not be part of the solution?
Wouldn't success largely depend on the key management scheme?