Equifax customer information leak

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills
User avatar
BigFoot48
Posts: 2531
Joined: Tue Feb 20, 2007 10:47 am
Location: Arizona

Re: Equifax customer information leak

Post by BigFoot48 » Fri Sep 08, 2017 11:16 am

I'm glad my Schwab accounts, including checking, are behind a fob.

Here's a step-by-step on freezing credit that looks informative: https://krebsonsecurity.com/2015/06/how ... ty-freeze/
Retired | Two-time in top-10 in Bogleheads S&P500 contest; 12-time loser

User avatar
rob
Posts: 2896
Joined: Mon Feb 19, 2007 6:49 pm
Location: Here

Re: Equifax customer information leak

Post by rob » Fri Sep 08, 2017 11:18 am

Mudpuppy wrote:
Fri Sep 08, 2017 11:05 am
It's better to get a PIN from the IRS as soon as you have a legitimate cause to request one. This breach would be a legitimate cause. I should have done that after the Anthem breach and saved myself the trouble. Here's the IRS site: https://www.irs.gov/identity-theft-frau ... ection-pin
How is that an option here?
You may choose to get an IP PIN only if:

You received an IRS letter inviting you to 'opt-in' to get an IP PIN, or
You filed your federal tax return last year with an address in Florida, Georgia or the District of Columbia
| Rob | Its a dangerous business going out your front door. - J.R.R.Tolkien

Mudpuppy
Posts: 5649
Joined: Sat Aug 27, 2011 2:26 am
Location: Sunny California

Re: Equifax customer information leak

Post by Mudpuppy » Fri Sep 08, 2017 11:21 am

And I should caution that one aspect of my job is to think of the worst possible consequences of a breach and what we can do about it (cybersecurity risk assessment). So my scenarios above play into that part of my training. I don't think financial gains was the motivation behind this breach though. Usually, breaches of this scale are for cyber-espionage, not cyber-crime. In cases of cyber-espionage, the hacking group might eventually sell off pieces on the dark-web for profit, but not often. They don't need the money. They need the information.

Think of it this way, the hackers now have detailed financial dossiers on most adults in America, including those working in highly classified jobs. If it's the same as the group that did the Anthem and OPM hack, they also have detailed medical and background information dossiers. It makes it a whole lot easier to do a targeted social engineering attack on specific people with this information. It could also enable other "influencing" methods, depending on what sort of skeletons are discovered in the dossiers.

If you work in such a field, you should be concerned. The average Jane Doe or Joe Smith is probably not going to see much of a fallout, unless I'm wrong and this was a criminal ring instead of a cyber-espionage ring.

Lynette
Posts: 1569
Joined: Sun Jul 27, 2014 9:47 am

Re: Equifax customer information leak

Post by Lynette » Fri Sep 08, 2017 11:22 am

I think that they are supposed to be sending letters to those impacted. I have had my accounts frozen for years. For now, I'm not doing anything.

Mudpuppy
Posts: 5649
Joined: Sat Aug 27, 2011 2:26 am
Location: Sunny California

Re: Equifax customer information leak

Post by Mudpuppy » Fri Sep 08, 2017 11:23 am

rob wrote:
Fri Sep 08, 2017 11:18 am
Mudpuppy wrote:
Fri Sep 08, 2017 11:05 am
It's better to get a PIN from the IRS as soon as you have a legitimate cause to request one. This breach would be a legitimate cause. I should have done that after the Anthem breach and saved myself the trouble. Here's the IRS site: https://www.irs.gov/identity-theft-frau ... ection-pin
How is that an option here?
You may choose to get an IP PIN only if:

You received an IRS letter inviting you to 'opt-in' to get an IP PIN, or
You filed your federal tax return last year with an address in Florida, Georgia or the District of Columbia
I didn't notice that they've restricted things now. It used to have a third bullet point for having your SS Number compromised in a major breach.

User avatar
samsoes
Posts: 594
Joined: Tue Mar 05, 2013 9:12 am

Re: Equifax customer information leak

Post by samsoes » Fri Sep 08, 2017 11:23 am

In addition to freezing credit reports, I suggest that Chex Systems reports be frozen as well. This would thwart attempts to open a bank account in one's name and ssn. Such a fraudulent account could be used to launder drug money, etc.
"Happiness Is Not My Companion" - Gen. Gouverneur K. Warren. (Avatar is the statue of Gen. Warren at Little Round Top @ Gettysburg National Military Park.)

User avatar
Uncle Pennybags
Posts: 1836
Joined: Tue Oct 28, 2014 2:05 am

Re: Equifax customer information leak

Post by Uncle Pennybags » Fri Sep 08, 2017 11:36 am

They got me, I've been hacked and nobody goes to jail.

User avatar
flamesabers
Posts: 1674
Joined: Fri Mar 03, 2017 12:05 pm
Location: Rochester, MN

Re: Equifax customer information leak

Post by flamesabers » Fri Sep 08, 2017 11:47 am

samsoes wrote:
Fri Sep 08, 2017 11:23 am
In addition to freezing credit reports, I suggest that Chex Systems reports be frozen as well. This would thwart attempts to open a bank account in one's name and ssn. Such a fraudulent account could be used to launder drug money, etc.
Is there a fee for freezing your Chex Systems file? When I go to the page to do the freeze, there is no mention of fees.

ved
Posts: 681
Joined: Sat Jan 18, 2014 6:56 pm

Re: Equifax says info stolen. What's my best course of action?

Post by ved » Fri Sep 08, 2017 11:53 am

^^^ Yes.

As I said, it may be innocuous (july 29 was a saturday when the breach was identified, and Aug 2 was a wednesday when these execs executed their orders). But the optics is bad for the company.

Eureka
Posts: 1108
Joined: Thu Apr 05, 2007 10:24 pm
Location: Illinois

Re: Equifax customer information leak

Post by Eureka » Fri Sep 08, 2017 11:53 am

More on the arbitration clause in TrustedIDPremier agreement. A class-action suit has already been filed.
http://www.marketwatch.com/story/why-so ... 2017-09-08

lazydavid
Posts: 1358
Joined: Wed Apr 06, 2016 1:37 pm

Re: Equifax customer information leak

Post by lazydavid » Fri Sep 08, 2017 12:07 pm

Grt2bOutdoors wrote:
Fri Sep 08, 2017 11:04 am
The one's that do use these physical devices like RSA want $25 for them, of course you the customer will have to pay for it.
You don't to have a token mailed to you to do TOTP (Time-based One Time Passcode) using a physical device that you possess. There is an open standard used by many organization which transmits a seed to an authentication app on your phone/tablet (I use Google Authenticator, but there are literally dozens of them) one time, by generating a QR code that you then take a picture of. That is the one and only time second factor data is sent from the organization to you. Your device then generates a predetermined series of keys every 30 seconds, just like an RSA token. When you are prompted for a 2nd factor, you just type in the 6 digit number from the app, and voila! You're in. I'm not aware of any services that charge for this, because there are no variable costs.

This process is immune from the SMS-hijacking attacks that have been in the news the past 18 months or so.
Last edited by lazydavid on Fri Sep 08, 2017 12:09 pm, edited 1 time in total.

User avatar
oneleaf
Posts: 2320
Joined: Mon Feb 19, 2007 5:48 pm

Re: Equifax customer information leak

Post by oneleaf » Fri Sep 08, 2017 12:08 pm

Just froze my wife and I's credit reports at Equifax and Transunion online. Tried to do it at Experian but both me and my wife could not do it and they requested that we do it by mail (after going through the form and entering credit card number for the $10, it tells me they can't do it, which was super annoying).

User avatar
triceratop
Moderator
Posts: 4356
Joined: Tue Aug 04, 2015 8:20 pm
Location: la la land

Re: Equifax customer information leak

Post by triceratop » Fri Sep 08, 2017 12:12 pm

Eureka wrote:
Fri Sep 08, 2017 11:53 am
More on the arbitration clause in TrustedIDPremier agreement. A class-action suit has already been filed.
http://www.marketwatch.com/story/why-so ... 2017-09-08
I find that to be a shoddily written article, though the comments by Lisa Gilbert are useful.

1) the Terms referenced in one of the tweets embedded in the article are the Equifax Terms, not the TrustedID Terms (@wyatt_privilege links to the correct terms).

2) The CFPB arbitration rules apparently only apply to companies like banks and credit card issuers, not a company like Equifax (see page 3-4 of the final rule and remember Equifax's role in the industry).

3) Also note: the Equifax terms (as opposed to the TrustedID terms) include a carve-out exemption for FCRA. The TrustedID terms do not include this exemption. The article does not mention this.

It's still an open question whether the TrustedID terms prohibit one from suing the parent company.
"To play the stock market is to play musical chairs under the chord progression of a bid-ask spread."

chevca
Posts: 1064
Joined: Wed Jul 26, 2017 11:22 am

Re: Equifax customer information leak

Post by chevca » Fri Sep 08, 2017 12:13 pm

Meh, it's about the 5th time in the past decade my personal information may have been compromised by some hacker group. Nothing new here.

It's very unlikely any of us are "safe" in this day and age. Our info is all out there somewhere and hackers are seeking it constantly.

Eureka
Posts: 1108
Joined: Thu Apr 05, 2007 10:24 pm
Location: Illinois

Re: Equifax customer information leak

Post by Eureka » Fri Sep 08, 2017 12:20 pm

triceratop wrote:
Fri Sep 08, 2017 12:12 pm
Eureka wrote:
Fri Sep 08, 2017 11:53 am
More on the arbitration clause in TrustedIDPremier agreement. A class-action suit has already been filed.
http://www.marketwatch.com/story/why-so ... 2017-09-08
I find that to be a shoddily written article, though the comments by Lisa Gilbert are useful.

1) the Terms referenced in one of the tweets embedded in the article are the Equifax Terms, not the TrustedID Terms (@wyatt_privilege links to the correct terms).

2) The CFPB arbitration rules apparently only apply to companies like banks and credit card issuers, not a company like Equifax (see page 3-4 of the final rule and remember Equifax's role in the industry).

3) Also note: the Equifax terms (as opposed to the TrustedID terms) include a carve-out exemption for FCRA. The TrustedID terms do not include this exemption. The article does not mention this.

It's still an open question whether the TrustedID terms prohibit one from suing the parent company.
It creates more confusion for sure. I get the feeling hasty action might not be the best move, though. And the idea that a subsidiary of a company that just suffered a massive data breach can protect anyone from anything would be funny if it weren't so ludicrous.

User avatar
jabberwockOG
Posts: 1151
Joined: Thu May 28, 2015 7:23 am

Re: Equifax customer information leak

Post by jabberwockOG » Fri Sep 08, 2017 12:24 pm

Credit card fraud is clearly a risk but it is hardly the biggest concern with this data hack. Based on the level and detail on the personal and financial information that was stolen there is a serious real risk of your bank accounts being hacked and funds stolen. One way this is done by the thief calling into your bank saying they have forgotten their password and security questions. The bank's customer service folks are trained to then ask questions regarding other personal and financial details/info of exactly the type that the thief has acquired through the Equifax hack.

I suggest everyone carefully and regularly monitor their online accounts at least on a monthly basis to guard against fraud. If you get any emails in the future notifying you of any changes in account status or distributions get on the phone immediately to verify and confirm nothing has gone wrong.
Last edited by jabberwockOG on Fri Sep 08, 2017 12:26 pm, edited 1 time in total.

User avatar
nisiprius
Advisory Board
Posts: 34939
Joined: Thu Jul 26, 2007 9:33 am
Location: The terrestrial, globular, planetary hunk of matter, flattened at the poles, is my abode.--O. Henry

Re: Equifax customer information leak

Post by nisiprius » Fri Sep 08, 2017 12:26 pm

Rupert wrote:
Fri Sep 08, 2017 9:27 am
KlangFool wrote:
Fri Sep 08, 2017 9:18 am
Folks,

Both I and my wife are affected. So, any recommendation as to what I should do?

A) Credit freeze?

B) Sign up for credit monitoring?

Thanks.

KlangFool
Freeze your credit. Everyone should just do that and be done with it. Signing up for credit monitoring is like putting a bandaid on a gunshot wound at this point. This is also a great time to contact your elected representatives and ask for legislation preventing the credit bureaus from charging you to freeze/unfreeze your credit files.
Well, yeah--actually my credit is already frozen, and for long enough that I just discovered I can't find the PIN for my Experian account--but how does that stop someone from committing identity theft given that they have most or all of the information used to verify identity?
Annual income twenty pounds, annual expenditure nineteen nineteen and six, result happiness; Annual income twenty pounds, annual expenditure twenty pounds ought and six, result misery.

Rupert
Posts: 2892
Joined: Fri Aug 17, 2012 12:01 pm

Re: Equifax customer information leak

Post by Rupert » Fri Sep 08, 2017 12:30 pm

nisiprius wrote:
Fri Sep 08, 2017 12:26 pm
Rupert wrote:
Fri Sep 08, 2017 9:27 am
KlangFool wrote:
Fri Sep 08, 2017 9:18 am
Folks,

Both I and my wife are affected. So, any recommendation as to what I should do?

A) Credit freeze?

B) Sign up for credit monitoring?

Thanks.

KlangFool
Freeze your credit. Everyone should just do that and be done with it. Signing up for credit monitoring is like putting a bandaid on a gunshot wound at this point. This is also a great time to contact your elected representatives and ask for legislation preventing the credit bureaus from charging you to freeze/unfreeze your credit files.
Well, yeah--actually my credit is already frozen, and for long enough that I just discovered I can't find the PIN for my Experian account--but how does that stop someone from committing identity theft given that they have most or all of the information used to verify identity?
It provides some margin of protection as most creditors check credit before opening new accounts. They should see your credit is frozen and not open the account. But you're right that it doesn't 100% protect you. Not all creditors check credit history before opening new accounts. There was post here on Bogleheads not too long about this. It actually happened to someone here. There's nothing you can do about that but deal with it when it happens.
Last edited by Rupert on Fri Sep 08, 2017 12:36 pm, edited 1 time in total.

User avatar
samsoes
Posts: 594
Joined: Tue Mar 05, 2013 9:12 am

Re: Equifax customer information leak

Post by samsoes » Fri Sep 08, 2017 12:32 pm

flamesabers wrote:
Fri Sep 08, 2017 11:47 am
samsoes wrote:
Fri Sep 08, 2017 11:23 am
In addition to freezing credit reports, I suggest that Chex Systems reports be frozen as well. This would thwart attempts to open a bank account in one's name and ssn. Such a fraudulent account could be used to launder drug money, etc.
Is there a fee for freezing your Chex Systems file? When I go to the page to do the freeze, there is no mention of fees.
No fee to place the freeze as I recall. They mail a PIN to use for unfreezing and there might be a $10 fee to unfreeze (similar procedure as the credit agencies).
"Happiness Is Not My Companion" - Gen. Gouverneur K. Warren. (Avatar is the statue of Gen. Warren at Little Round Top @ Gettysburg National Military Park.)

User avatar
jabberwockOG
Posts: 1151
Joined: Thu May 28, 2015 7:23 am

Re: Equifax says info stolen. What's my best course of action?

Post by jabberwockOG » Fri Sep 08, 2017 12:43 pm

dmcmahon wrote:
Fri Sep 08, 2017 10:06 am
My worries go beyond credit though. Freezing credit reporting is straightforward. But if they have your name, address, data of birth, SSN, and DL#, I don't see how any of your bank and brokerage accounts are secure. This is exactly the information you have to give on the phone to transact business. A determined crook could go as far as forging a DL with their own picture on it, then going in person to some branch of your bank in another town and cleaning out your account. Am I just being paranoid?

Worst of all, those pieces of info are either impossible to change, or extremely difficult to change. I don't even know if you can get a new DL# without a big hassle, unless you move to another state. In the other breaches you could change your password or take some other action to restore the security of your account. Here, not so much.
100% agree - this goes way beyond credit card fraud -

Credit card fraud is clearly a risk but it is hardly the biggest concern with this data hack. Based on the level and detail on the personal and financial information that was stolen there is a serious real risk of your bank accounts being hacked and funds stolen. One way this is done by the thief calling into your bank saying they have forgotten their password and security questions. The bank's customer service folks are trained to then ask questions regarding other personal and financial details/info of exactly the type that the thief has acquired through the Equifax hack.

I suggest everyone carefully and regularly monitor their online accounts at least on a monthly basis to guard against fraud. If you get any emails in the future notifying you of any changes in account status or distributions get on the phone immediately to verify and confirm nothing has gone wrong.

User avatar
Artsdoctor
Posts: 3105
Joined: Thu Jun 28, 2012 3:09 pm
Location: Los Angeles, CA

Re: Equifax says info stolen. What's my best course of action?

Post by Artsdoctor » Fri Sep 08, 2017 12:57 pm

Credit freeze and monitoring. I'm not sure there's anything else to do. If you enroll in their monitoring, it's good for a year but this could be a multi-year vulnerability.

We've had a credit freeze in effect for about 5 years, and have rarely regretted it.

Whakamole
Posts: 515
Joined: Wed Jan 13, 2016 9:59 pm

Re: Equifax customer information leak

Post by Whakamole » Fri Sep 08, 2017 1:00 pm

There has been some suspicious activity on the options front too - someone bought puts at $135 a few weeks ago: https://www.cnbc.com/2017/09/08/suspect ... rofit.html

fittan
Posts: 91
Joined: Wed Mar 30, 2016 1:58 pm

Re: Equifax says info stolen. What's my best course of action?

Post by fittan » Fri Sep 08, 2017 1:06 pm

I just reviewed my credit report using https://www.annualcreditreport.com (you get 1 free report a year). Made sure everything is clean and then put a freeze at all 3 agencies. It cost $5 each.

After you put the freeze, do remember to save your PIN as you'll need it to unlock. I would also save the receipts. Hopefully we can get reimbursement from Equifax down the road.

mhalley
Posts: 5408
Joined: Tue Nov 20, 2007 6:02 am

Re: Equifax says info stolen. What's my best course of action?

Post by mhalley » Fri Sep 08, 2017 1:57 pm

You don't need monitoring if your credit is frozen. If you want it anyway, sign up for credit karma.
Just wanted to give my experience on my credit freeze attempts today.
Equifax: unsuccessfull online for me and wife. Need to send info by snailmail.
Experian: successfull online for me, not wife. No phone option. ? Online option with uploaded documents that I need to try.
TransUnion: unsuccessful online for me, done over phone. Successful online for wife.

User avatar
DaftInvestor
Posts: 3545
Joined: Wed Feb 19, 2014 10:11 am

Re: Equifax says info stolen. What's my best course of action?

Post by DaftInvestor » Fri Sep 08, 2017 2:12 pm

mhalley wrote:
Fri Sep 08, 2017 1:57 pm
You don't need monitoring if your credit is frozen. If you want it anyway, sign up for credit karma.
Just wanted to give my experience on my credit freeze attempts today.
Equifax: unsuccessfull online for me and wife. Need to send info by snailmail.
Experian: successfull online for me, not wife. No phone option. ? Online option with uploaded documents that I need to try.
TransUnion: unsuccessful online for me, done over phone. Successful online for wife.
Just as another data point I was able to freeze all 4 (the three you list plus Innovis) for both me and my wife online this morning. I think total time to complete all 8 freezes was around 15-20 minutes.
I was done churning credit-cards for a while anyway :)

btenny
Posts: 4336
Joined: Sun Oct 07, 2007 6:47 pm

Re: Equifax says info stolen. What's my best course of action?

Post by btenny » Fri Sep 08, 2017 2:15 pm

I am worried about this stuff but don't see any significant or change in risk to my $$ accounts. Please tell me if I am wrong. All my on line account use special user names and passwords that are different than my SSN number and my name. So how can the Equifax thieves use the data they got to hack my financial accounts? I have my credit frozen and use hard to guess passwords.

Please advise. Good Luck.

User avatar
DaftInvestor
Posts: 3545
Joined: Wed Feb 19, 2014 10:11 am

Re: Equifax says info stolen. What's my best course of action?

Post by DaftInvestor » Fri Sep 08, 2017 2:22 pm

btenny wrote:
Fri Sep 08, 2017 2:15 pm
I am worried about this stuff but don't see any significant or change in risk to my $$ accounts. Please tell me if I am wrong. All my on line account use special user names and passwords that are different than my SSN number and my name. So how can the Equifax thieves use the data they got to hack my financial accounts? I have my credit frozen and use hard to guess passwords.

Please advise. Good Luck.
Someone could call a bank/brokerage and pretend to be you for instance. If you call and say you forgot your username and password as well as your security questions (maybe the criminal pretending to be you says they lost a piece of paper where they wrote the info down) in order to verify your identity they will ask for your SSN, DOB, Address, and so on - all of this was stolen so the thieves have it.

They can also file a fake tax return in your name - trying to get money - could open new bank accounts that link to your current accounts - etc.

User avatar
mrc
Posts: 1057
Joined: Sun Jan 10, 2016 6:39 am
Location: right here

Re: Equifax says info stolen. What's my best course of action?

Post by mrc » Fri Sep 08, 2017 2:26 pm

When OPM was hacked, we looked into subscribing to the "free monitoring." But all that does is tell you that the horse is out of the barn. Maybe not even that. If you freeze your reports, they can't monitor completely. We have a basic service that tells us a sex offender moved into our area, but nothing else. Freezing and watching your accounts seems to be the best option. And don't agree to any monitoring that requires you to sign away your rights.

The one thing thieves shouldn't have access to is my snail mailbox. If you receive any "Welcome ..." letters, be aware. We'll have to check over the financial junk mail more carefully now to be sure it isn't a new account or PIN notice.

GRRR. Of all the companies to get hacked ...
A great challenge of life: Knowing enough to think you're doing it right, but not enough to know you're doing it wrong. — Neil deGrasse Tyson | 457th place in 2017 Boglehead Contest!

samtex
Posts: 222
Joined: Thu Feb 04, 2010 1:07 am

Re: Equifax says info stolen. What's my best course of action?

Post by samtex » Fri Sep 08, 2017 2:28 pm

Is there a difference in "freezing" your credit report and having a "Fraud Alert" placed on it? Many years ago (10+) someone opened up a bank card in my name and charged about 1200.00 in Europe. I called the card company and got it straightened out pretty easily and then contacted one of the credit bureaus. They placed a "Fraud Alert" on my account. It says that if anyone request my credit report, they will also receive a copy of the alert and warning them to take precautionary measures to verify the identity of the applicant. They also contacted the other two credit reporting agencies so they would do the same. It says the "initial" alert was for 90 days but it has been automatically renewing every 90 days for many years.

To me, this sounds like a step below freezing the account, since creditors can still evidently access my report but it has a warning on it. Certainly not as secure but a creditor would have to admit they were deficient by not verifying the identity. I suppose it would be best to initiate a total freeze.

Samtex

MutualEdge
Posts: 44
Joined: Sun May 28, 2017 6:46 pm

Re: Equifax says info stolen. What's my best course of action?

Post by MutualEdge » Fri Sep 08, 2017 2:31 pm

deleted
Last edited by MutualEdge on Fri Sep 08, 2017 2:36 pm, edited 1 time in total.

JeepDaze
Posts: 103
Joined: Sat Mar 26, 2016 9:19 am

Re: Equifax says info stolen. What's my best course of action?

Post by JeepDaze » Fri Sep 08, 2017 2:33 pm

DaftInvestor wrote:
Fri Sep 08, 2017 2:22 pm
btenny wrote:
Fri Sep 08, 2017 2:15 pm
I am worried about this stuff but don't see any significant or change in risk to my $$ accounts. Please tell me if I am wrong. All my on line account use special user names and passwords that are different than my SSN number and my name. So how can the Equifax thieves use the data they got to hack my financial accounts? I have my credit frozen and use hard to guess passwords.

Please advise. Good Luck.
Someone could call a bank/brokerage and pretend to be you for instance. If you call and say you forgot your username and password as well as your security questions (maybe the criminal pretending to be you says they lost a piece of paper where they wrote the info down) in order to verify your identity they will ask for your SSN, DOB, Address, and so on - all of this was stolen so the thieves have it.

They can also file a fake tax return in your name - trying to get money - could open new bank accounts that link to your current accounts - etc.
I called my bank earlier and asked them this exact question. "What's to stop a criminal from calling you and wiping my account clean?". Her response was that the bank would ask a series of secret questions to further verify my identity. Such as, "what was the total amount of the most recent 3 ATM transactions", "what was the amount of the last credit card charge", etc. Seemed like they crooks would need even more info in order to clean out your bank accounts.

Slacker
Posts: 482
Joined: Thu May 26, 2016 8:40 am

Re: Equifax says info stolen. What's my best course of action?

Post by Slacker » Fri Sep 08, 2017 2:43 pm

Rupert wrote:
Fri Sep 08, 2017 10:18 am
dmcmahon wrote:
Fri Sep 08, 2017 10:06 am
My worries go beyond credit though. Freezing credit reporting is straightforward. But if they have your name, address, data of birth, SSN, and DL#, I don't see how any of your bank and brokerage accounts are secure. This is exactly the information you have to give on the phone to transact business. A determined crook could go as far as forging a DL with their own picture on it, then going in person to some branch of your bank in another town and cleaning out your account. Am I just being paranoid?

Worst of all, those pieces of info are either impossible to change, or extremely difficult to change. I don't even know if you can get a new DL# without a big hassle, unless you move to another state. In the other breaches you could change your password or take some other action to restore the security of your account. Here, not so much.
A little bit paranoid. While it's not impossible that your hypothetical scenario could happen, that would be much more work than the average criminal who buys stolen identity information on the internet is willing to do. They tend to commit much easier, less labor-intensive crimes, such as using your info to buy cellphones and opening new credit card accounts in your name, etc.
Here is what was recently done on one of my credit cards this pasts weekend:

Attempted to purchase printers at two different office goods retailers
Paid for thousands of dollars in text messages
Paid for VOIP services
Paid for several hundred in email messaging services.

I had all charges reversed immediately and the credit card number changed.

alphabeta01
Posts: 12
Joined: Tue Oct 18, 2016 10:07 am

Re: Equifax says info stolen. What's my best course of action?

Post by alphabeta01 » Fri Sep 08, 2017 2:45 pm

When I checked last night, the website showed that my information is not compromised. When I checked again an hour ago, its saying information is compromised. Did this happen to anyone else too?

User avatar
greg24
Posts: 2965
Joined: Tue Feb 20, 2007 10:34 am

Re: Equifax says info stolen. What's my best course of action?

Post by greg24 » Fri Sep 08, 2017 2:49 pm

One of the three major reporting agencies allows the personal data of basically half the country to be attained by hackers.

They offer free credit monitoring in response.

This is like Inception or something.

alex11
Posts: 64
Joined: Wed Jul 28, 2010 5:25 pm

Re: Equifax says info stolen. What's my best course of action?

Post by alex11 » Fri Sep 08, 2017 2:51 pm

The spouse and I both show up as "may" be affected.
So, if I want to fully freeze my credit I must do so with all 3 Credit Bureaus and are the $5-$10 fees just a one time fee?

btenny
Posts: 4336
Joined: Sun Oct 07, 2007 6:47 pm

Re: Equifax says info stolen. What's my best course of action?

Post by btenny » Fri Sep 08, 2017 3:11 pm

I ask this question two years ago when I had my data stolen in another breach. The bank said they ask extra questions about recent bank transactions and credit card transactions. So I had to go look up what I charged recently and what I thought my bank balance was. Then after I told them this data they reset my old password to a long complex random number/code. This new reset password was only sent to my email address and it was only good for a half hour. They would not give it out over the phone. I had to go use that revised password and my account user name to log onto my account and change the password to one I selected. So the process was complex and I needed more data than just my name and SSN#. So it is harder than it used to be to reset passwords and change addresses and so forth. The banks are using our phone numbers and email addresses as links to us to check we are really the people asking for the revisions. So I think things are still secure sorta...

But these hacks and and leaks are making it much more difficult to stay secure.

Good Luck.

F150HD
Posts: 1292
Joined: Fri Sep 18, 2015 7:49 pm

Re: Equifax says info stolen. What's my best course of action?

Post by F150HD » Fri Sep 08, 2017 3:27 pm

remomnyc wrote:
Fri Sep 08, 2017 8:18 am
Equifax is offering free identity theft protection and credit monitoring.
How is a company that can't even protect themselves going to protect "you"?

http://www.equifax.com/all-products/

...and charge people on top of that?

User avatar
DaftInvestor
Posts: 3545
Joined: Wed Feb 19, 2014 10:11 am

Re: Equifax customer information leak

Post by DaftInvestor » Fri Sep 08, 2017 3:27 pm

Eureka wrote:
Fri Sep 08, 2017 11:53 am
More on the arbitration clause in TrustedIDPremier agreement. A class-action suit has already been filed.
http://www.marketwatch.com/story/why-so ... 2017-09-08
And now they have changed the wording in the clause - you can write to them if you want out of it:
https://www.washingtonpost.com/news/the ... 5ed37cdd04
Here's how the opt-out provision reads:

In order to exclude Yourself from the arbitration provision, You must notify Equifax in writing within 30 days of the date that You first accept this Agreement on the Site (for Products purchased from Equifax on the Site). …

[You] must include Your name, address, and Equifax User ID, as well as a clear statement that You do not wish to resolve disputes with Equifax through arbitration.

This language helps address some of the concerns, but it requires consumers to remember to write to Equifax.

Daisy Dog
Posts: 113
Joined: Sat Mar 03, 2007 3:33 pm

Re: Equifax says info stolen. What's my best course of action?

Post by Daisy Dog » Fri Sep 08, 2017 3:47 pm

Hi Sunny,

This is Daisy Dog. Sorry I'm writing about this security breach instead of writing about something fun! But I can't find where on the website to access the information on whether I was a victim. I'm trying to call them but have been on hold for over a half hour so far.

Thanks!

Daisy

ved
Posts: 681
Joined: Sat Jan 18, 2014 6:56 pm

Re: Equifax says info stolen. What's my best course of action?

Post by ved » Fri Sep 08, 2017 3:48 pm

alphabeta01 wrote:
Fri Sep 08, 2017 2:45 pm
When I checked last night, the website showed that my information is not compromised. When I checked again an hour ago, its saying information is compromised. Did this happen to anyone else too?
Yep - last night it said something like- Thank you for checking.
Now, it says info may be compromised.

sixtyforty
Posts: 179
Joined: Tue Nov 25, 2014 12:22 pm

Re: Equifax customer information leak

Post by sixtyforty » Fri Sep 08, 2017 3:51 pm

Good thread. As always great info from the Bogleheads.

Froze my and my wife's credit this morning from the big three. Free for the first time in CO. $10 to unfreeze or thereafter. At this point, I'm probably not going to sign up for the Equifax Trusted ID service.
"Simplicity is the ultimate sophistication" - Leonardo Da Vinci

ved
Posts: 681
Joined: Sat Jan 18, 2014 6:56 pm

Re: Equifax says info stolen. What's my best course of action?

Post by ved » Fri Sep 08, 2017 3:58 pm

Daisy Dog wrote:
Fri Sep 08, 2017 3:47 pm
Hi Sunny,

This is Daisy Dog. Sorry I'm writing about this security breach instead of writing about something fun! But I can't find where on the website to access the information on whether I was a victim. I'm trying to call them but have been on hold for over a half hour so far.

Thanks!

Daisy
Go here - https://www.equifaxsecurity2017.com/potential-impact/. Enter your last name, and last 6 digits of your SocialSecurity number

You can also get there by going to www.equifax.com

User avatar
LadyGeek
Site Admin
Posts: 43053
Joined: Sat Dec 20, 2008 5:34 pm
Location: Philadelphia
Contact:

Re: Equifax customer information leak

Post by LadyGeek » Fri Sep 08, 2017 4:01 pm

I moved Sunny Sarkar's thread into here. Let's use this single thread to discuss issues with Equifax.
To some, the glass is half full. To others, the glass is half empty. To an engineer, it's twice the size it needs to be.

Daisy Dog
Posts: 113
Joined: Sat Mar 03, 2007 3:33 pm

Re: Equifax customer information leak

Post by Daisy Dog » Fri Sep 08, 2017 4:07 pm

Sunny,

Sorry I bothered you. My telephone call revealed I'm in the victim pool. (sad face.)

Daisy Dog

User avatar
Uncle Pennybags
Posts: 1836
Joined: Tue Oct 28, 2014 2:05 am

Re: Equifax customer information leak

Post by Uncle Pennybags » Fri Sep 08, 2017 4:10 pm

How many people in the US have credit record? Subtract those under 18 and those under the radar I would guess 143 million. The same number that was hacked. The entire country was hacked and nobody goes to jail.

User avatar
catdude
Posts: 1449
Joined: Mon Jul 16, 2007 8:11 pm
Location: Central Oregon

Re: Equifax customer information leak

Post by catdude » Fri Sep 08, 2017 4:16 pm

I too just froze my credit at all three bureaus. It's something I'd meant to do for awhile but procrastination got in the way. The Equifax hack got me moving... It took roughly 20 minutes online to do the freezes, and each one cost 10 bucks (the cost is set by state law, right?). Glad I finally got it done...
catdude | | "I yield to the gentleman for a few feeble remarks." (Congressman Thaddeus Stevens)

User avatar
Pajamas
Posts: 3658
Joined: Sun Jun 03, 2012 6:32 pm

Re: Equifax says info stolen. What's my best course of action?

Post by Pajamas » Fri Sep 08, 2017 4:23 pm

ved wrote:
Fri Sep 08, 2017 9:30 am
Executives / officers of publicly traded companies have to disclose their share purchases/sale plans to SEC in advance. So, if this was part of their scheduled transactions, it may not be nefarious. Though, they should have seen how bad the optics would be and cancelled those transactions (if they are allowed to do it).
New York Times had this paragraph that specifically said the shares were not planned in advance:
Potentially adding to criticism of the company, three senior executives, including the company’s chief financial officer, John Gamble, sold shares worth almost $1.8 million in the days after the breach was discovered. The shares were not part of a sale planned in advance, Bloomberg reported.
https://www.nytimes.com/2017/09/07/busi ... ttack.html

F150HD
Posts: 1292
Joined: Fri Sep 18, 2015 7:49 pm

Re: Equifax says info stolen. What's my best course of action?

Post by F150HD » Fri Sep 08, 2017 4:23 pm

Geez, be wary of enrolling in Equifaxes 'solution' to this issue:

If your data had been stolen, Equifax offered one free year of the company’s credit monitoring service known as “TrustedID Premier.” But some fine print also included on the website may mean that consumers who agree would be giving up the right to sue over many types of damages claims related to the massive penetration of its database.

https://www.bloomberg.com/news/articles ... itter-tech

wth? this happened in JULY?

The unprecedented security breach, which occurred in July but was disclosed by the company on Thursday, is among the largest in U.S. history, affecting 143 million people.

Edit: sorry of this was already mentioned and I missed it.
Last edited by F150HD on Fri Sep 08, 2017 4:58 pm, edited 3 times in total.

mnaspbh
Posts: 204
Joined: Fri Sep 09, 2011 12:26 pm

Re: Equifax says info stolen. What's my best course of action?

Post by mnaspbh » Fri Sep 08, 2017 4:30 pm

dmcmahon wrote:
Fri Sep 08, 2017 10:06 am
My worries go beyond credit though. Freezing credit reporting is straightforward. But if they have your name, address, data of birth, SSN, and DL#, I don't see how any of your bank and brokerage accounts are secure. This is exactly the information you have to give on the phone to transact business. A determined crook could go as far as forging a DL with their own picture on it, then going in person to some branch of your bank in another town and cleaning out your account. Am I just being paranoid?

Worst of all, those pieces of info are either impossible to change, or extremely difficult to change. I don't even know if you can get a new DL# without a big hassle, unless you move to another state. In the other breaches you could change your password or take some other action to restore the security of your account. Here, not so much.
In theory, a bank would ask for additional information before letting someone walk in, flash a driver's license, and clean out an account. Some people have reported being asked about past transactions, which wouldn't have been in the data that Equifax let get stolen. Most US financial institutions should have policies in place to protect against that kind of fraud, as well.

I'm more worried about terrorists and criminals using this information to create fake IDs that will pass the "Know Your Customer" verification processes, then using them to set up accounts that belong to "me" that are used for criminal activities. The information that was stolen is an absolute gold mine for criminals or terrorists who want to set up fake bitcoin-trading accounts that they use to launder money internationally, for example. Getting flagged as having funded ISIS, or having laundered international drug- or human-smuggling profits is not my idea of a fun time.

bubbly
Posts: 67
Joined: Tue Jun 16, 2015 4:21 pm

Re: Equifax customer information leak

Post by bubbly » Fri Sep 08, 2017 4:32 pm

Uncle Pennybags wrote:
Fri Sep 08, 2017 4:10 pm
How many people in the US have credit record? Subtract those under 18 and those under the radar I would guess 143 million. The same number that was hacked. The entire country was hacked and nobody goes to jail.
The 2010 Census recorded 308 million people total in the US

Under 18 represented 74 million.

So at the very least, 143 of 234 million people were affected, 61%, and that's not including the under the radar pool... The numbers are mind boggling...

https://www.census.gov/prod/cen2010/bri ... 0br-03.pdf

Locked