Temporary Credit Freeze Lift and non-required PINs - no security

Questions on how we spend our money and our time - consumer goods and services, home and vehicle, leisure and recreational activities
Post Reply
User avatar
DaftInvestor
Posts: 4064
Joined: Wed Feb 19, 2014 10:11 am

Temporary Credit Freeze Lift and non-required PINs - no security

Post by DaftInvestor » Thu Oct 18, 2018 11:12 am

So back after the Equifax debacle happened I froze all my credit. Each of the 3-major agencies gave me a PIN - very important to keep this in a safe place in case you ever want to remove the freeze - or so they said. Turns out this appears FALSE.
I just went through and removed the freeze at the Big 3 agencies and NOT ONE of them asked for the PIN! So anyone with my information would have been able to do so....so what's the point???!!
Anyone understand this? What's the point in having a freeze that requires a PIN if the PIN isn't required to unfreeze? If someone has my Name/Address/SS# they can unfreeze my credit.
Of the three:
EquiFax - made me set up a new account with a username and password in order to unfreeze my credit. Never asked for the PIN. Anyone could have done this on my behalf. They are the least secure. They are the one that had the breech and appear to be the least secure - you would have thought they would be most secure. I did establish a user-login this time so hopefully no further actions can be taken without these credentials.
TransUnion - Back when I froze my credit I had entered username/password as part of the freeze process. I used this to unfreeze - so at least someone would have needed this password to unfreeze (unless there is an easy password reset mechanism that can be used). More secure than Equifax at least.
Experian - Had me enter my address, SS#, etc. Never asked for the PIN. They did have a few questions (similar to those when you request a credit report) to establish my identity so were better than Equifax. After this they actually showed me the PIN (which I already knew) that I had written down prior.

I'm baffled at how flawed these unfreezes were. Anyone have any insight into why these agencies still don't take security seriously? I'm wondering if its a waste of time to have freezes in place since anyone with information to get a loan in my name can apparently use that same info to unfreeze my credit.

Rupert
Posts: 3731
Joined: Fri Aug 17, 2012 12:01 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Rupert » Thu Oct 18, 2018 11:18 am

I think they've all recently changed their policies in response to the new federal law that makes freezing and unfreezing free for everyone.

shell921
Posts: 141
Joined: Fri Jul 06, 2018 5:13 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by shell921 » Thu Oct 18, 2018 11:18 am

I had a credit freeze by Experian in 2012 and lost my PIN. I called them and they MAILED me a letter in the mail that had the PIN.
This was about 3 years ago so maybe now it's different.

User avatar
DaftInvestor
Posts: 4064
Joined: Wed Feb 19, 2014 10:11 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by DaftInvestor » Thu Oct 18, 2018 11:20 am

Rupert wrote:
Thu Oct 18, 2018 11:18 am
I think they've all recently changed their policies in response to the new federal law that makes freezing and unfreezing free for everyone.
This was what I was wondering. Seems by being mandated to do it for free they, all three, decided to make it less secure.

delamer
Posts: 6264
Joined: Tue Feb 08, 2011 6:13 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by delamer » Thu Oct 18, 2018 4:31 pm

I did a temporary “unfreeze” recently at Equifax, and I needed to supply my PIN.

Why did you need to open a new account if you already had an account?

Leesbro63
Posts: 5511
Joined: Mon Nov 08, 2010 4:36 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Leesbro63 » Thu Oct 18, 2018 4:35 pm

I had an experience exactly the same as that of the original poster, with Equifax. Also made me a little skeptical of the situation. The PIN thing, however, was a PITA and I prefer the new setup. And I like the new law requiring the ability to freeze and unfreeze as often as I like, at no cost.
Last edited by Leesbro63 on Thu Oct 18, 2018 5:16 pm, edited 1 time in total.

User avatar
Soul.in.Progress
Posts: 99
Joined: Sun Jan 08, 2017 10:24 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Soul.in.Progress » Thu Oct 18, 2018 4:45 pm

Thanks for posting, OP. This is indeed troubling. I guess the actionable learning for me is that I need to create accounts for all of them with secure passwords. To date I have always used my PIN on the phone or website for the credit agencies.
Start by doing what is necessary; | then do what is possible; | and suddenly you are doing the impossible. | -- Francis of Assisi

Rupert
Posts: 3731
Joined: Fri Aug 17, 2012 12:01 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Rupert » Thu Oct 18, 2018 4:54 pm

No one believed the PINs were secure (and, at least in the case of Experian, they weren't -- see https://www.nytimes.com/2017/09/10/your ... reeze.html) and with federal law changing anyway, they scrapped the whole system and started over, giving their "customers" (read: "victims") the ability to create their own secure identifiers.

User avatar
DaftInvestor
Posts: 4064
Joined: Wed Feb 19, 2014 10:11 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by DaftInvestor » Thu Oct 18, 2018 7:22 pm

One minor correction to my original post (since I just re-went through the process on my spouse's reports and went very slowly and thoroughly through each screen and option).
Experian will take the PIN if you notice the "Remember your PIN Yes/NO" checkbox - which defaults for some reason to NO. If you switch it to Yes you can enter your PIN and take action right away. If you leave it on No it proceeds to ask you a few security questions. Seems Experian is most secure (but still doesn't force use of the PIN).
ChexSystems is the only one that seems to be enforcing the use of the PIN. (Although I didn't try to unfreeze Innovis)

delamer wrote:
Thu Oct 18, 2018 4:31 pm
Why did you need to open a new account if you already had an account?
.

I didn't already have an Equifax account. I only went on their site to freeze my credit which, at the time, didn't force you to create an account with a login to do so. Now it seems to push you through these steps if you don't have an account. I just did this a second time for my wife and again, it never even asked for the PIN or had anywhere an option to enter one.

Calli114
Posts: 65
Joined: Tue May 16, 2017 12:54 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Calli114 » Thu Oct 18, 2018 8:31 pm

Rupert wrote:
Thu Oct 18, 2018 4:54 pm
No one believed the PINs were secure (and, at least in the case of Experian, they weren't -- see https://www.nytimes.com/2017/09/10/your ... reeze.html) and with federal law changing anyway, they scrapped the whole system and started over, giving their "customers" (read: "victims") the ability to create their own secure identifiers.

Mine is still frozen after the Equifax thing.
So if the PINs are a moot point, is it better to start over with new identifiers before someone else can do it? I don't need credit or a temporary unfreeze for the foreseeable future.
But as an aside, SS would not let me open up an online account without going to the office in person, because they access Equifax to confirm your details and could not in my case.

OnTrack2020
Posts: 289
Joined: Mon Mar 20, 2017 10:24 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by OnTrack2020 » Thu Oct 18, 2018 9:32 pm

Hmmm, I had to do some unfreezing of all three here in the past few weeks, and all requested the PIN.

delamer
Posts: 6264
Joined: Tue Feb 08, 2011 6:13 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by delamer » Fri Oct 19, 2018 11:05 am

Calli114 wrote:
Thu Oct 18, 2018 8:31 pm
Rupert wrote:
Thu Oct 18, 2018 4:54 pm
No one believed the PINs were secure (and, at least in the case of Experian, they weren't -- see https://www.nytimes.com/2017/09/10/your ... reeze.html) and with federal law changing anyway, they scrapped the whole system and started over, giving their "customers" (read: "victims") the ability to create their own secure identifiers.

Mine is still frozen after the Equifax thing.
So if the PINs are a moot point, is it better to start over with new identifiers before someone else can do it? I don't need credit or a temporary unfreeze for the foreseeable future.
But as an aside, SS would not let me open up an online account without going to the office in person, because they access Equifax to confirm your details and could not in my case.
I don’t think PINs are irrelevant since I had to use one a few weeks ago. And it was to “unfreeze” to set up my online Social Security account.

kaneohe
Posts: 5097
Joined: Mon Sep 22, 2008 12:38 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by kaneohe » Fri Oct 19, 2018 4:15 pm

I had to unfreeze for the Ally promotion. TU required the PIN when I called and it was quick & simple...lifted freeze temporarily and by the time I called Ally a few minutes later it was effective.

User avatar
Ice-9
Posts: 1326
Joined: Wed Oct 15, 2008 12:40 pm
Location: Rockville, MD

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Ice-9 » Wed Oct 24, 2018 7:39 am

Thank you OP for posting this. As I result, I've tested each of my pins acquired back in 2015.

EXPERIAN
Per US PIRG suggestion, I permanently removed my freeze and then re-added and created a new pin.

EQUIFAX
I created an account at my.equifax.com. The language on the page indicated I would need my PIN for a lift. However, while logged in, I submitted a temporary two-day lift and the site implemented it without ever asking for the PIN. On the completion screen, it again mentioned that a PIN is needed for a lift. (WHAT?!?!) Not too concerned because my login was required, but Equifax should fix the wording.

TRANSUNION
The username and password I created back in 2015 did not work. I went through the "Forgot Login Information" process, and it returned "If you have not used our Freeze site since it was updated, you may need to create a new user account." So I created a new account. Once logged into the account, it confirmed my report was frozen. I noticed a link asking "Need to Change your PIN?" The tooltip for this link explained "You'll only need your PIN if you make changes to your freeze via phone." So, apparently, if you want to call or use their phone app to lift a freeze, probably you'll need a PIN. Whether the same PIN I was given back in 2015 would have worked, I don't know.

INNOVIS
I had arranged a security freeze online, and Innovis had mailed me a PIN. I was able to successfully implement a temporary lift using the old information from 2015, and the website indicated I would be mailed a confirmation. There does appear to be an option to log in to one's Innovis account on the page, though I did not have to use it to execute the lift.

Leesbro63
Posts: 5511
Joined: Mon Nov 08, 2010 4:36 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Leesbro63 » Wed Oct 24, 2018 10:01 am

Ice-9 wrote:
Wed Oct 24, 2018 7:39 am
Thank you OP for posting this. As I result, I've tested each of my pins acquired back in 2015.

EXPERIAN
Per US PIRG suggestion, I permanently removed my freeze and then re-added and created a new pin.

EQUIFAX
I created an account at my.equifax.com. The language on the page indicated I would need my PIN for a lift. However, while logged in, I submitted a temporary two-day lift and the site implemented it without ever asking for the PIN. On the completion screen, it again mentioned that a PIN is needed for a lift. (WHAT?!?!) Not too concerned because my login was required, but Equifax should fix the wording.

TRANSUNION
The username and password I created back in 2015 did not work. I went through the "Forgot Login Information" process, and it returned "If you have not used our Freeze site since it was updated, you may need to create a new user account." So I created a new account. Once logged into the account, it confirmed my report was frozen. I noticed a link asking "Need to Change your PIN?" The tooltip for this link explained "You'll only need your PIN if you make changes to your freeze via phone." So, apparently, if you want to call or use their phone app to lift a freeze, probably you'll need a PIN. Whether the same PIN I was given back in 2015 would have worked, I don't know.

INNOVIS
I had arranged a security freeze online, and Innovis had mailed me a PIN. I was able to successfully implement a temporary lift using the old information from 2015, and the website indicated I would be mailed a confirmation. There does appear to be an option to log in to one's Innovis account on the page, though I did not have to use it to execute the lift.

My recent experience with 3 of these (I don’t worry about Innovis...maybe I should) was the same. PINs going the way of the dinosaur, but remnants and language of the PIN era still not gone/up to date.

Trism
Posts: 245
Joined: Mon Jul 18, 2016 6:34 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Trism » Thu Oct 25, 2018 12:49 pm

I have to use a PIN with my debit card at an ATM, but I can go inside the bank and withdraw cash without the PIN!

O

M

G

This seems to be happening everywhere.

mouses
Posts: 3811
Joined: Sat Oct 24, 2015 12:24 am

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by mouses » Wed Oct 31, 2018 11:02 pm

Trism wrote:
Thu Oct 25, 2018 12:49 pm
I have to use a PIN with my debit card at an ATM, but I can go inside the bank and withdraw cash without the PIN!

O

M

G

This seems to be happening everywhere.
At least two of my credit unions have a photo of the customer on their display, so they know if you're legit.

rkhusky
Posts: 5710
Joined: Thu Aug 18, 2011 8:09 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by rkhusky » Thu Nov 01, 2018 7:04 am

Trism wrote:
Thu Oct 25, 2018 12:49 pm
I have to use a PIN with my debit card at an ATM, but I can go inside the bank and withdraw cash without the PIN!
My bank asks for photo ID.

Trism
Posts: 245
Joined: Mon Jul 18, 2016 6:34 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Trism » Fri Nov 02, 2018 6:46 am

rkhusky wrote:
Thu Nov 01, 2018 7:04 am
Trism wrote:
Thu Oct 25, 2018 12:49 pm
I have to use a PIN with my debit card at an ATM, but I can go inside the bank and withdraw cash without the PIN!
My bank asks for photo ID.
Right. They have multiple ways to verify your identity.

Exactly my point.

Trism
Posts: 245
Joined: Mon Jul 18, 2016 6:34 pm

Re: Temporary Credit Freeze Lift and non-required PINs - no security

Post by Trism » Fri Nov 02, 2018 6:46 am

rkhusky wrote:
Thu Nov 01, 2018 7:04 am
Trism wrote:
Thu Oct 25, 2018 12:49 pm
I have to use a PIN with my debit card at an ATM, but I can go inside the bank and withdraw cash without the PIN!
My bank asks for photo ID.
Right. They have multiple ways to verify your identity.

Exactly my point.

Post Reply