If you’re old enough to read this sentence, odds are better than even that your personal information — including your name, birthdate, Social Security number and financial data — was exposed to hackers who accessed the Equifax database this past summer. Adding insult to injury, you’ll now have to shuck out at least $10 in Massachusetts — double that in New Hampshire — to accomplish one of the most recommended steps you can take to protect yourself from fraud.
Andover state Sen. Barbara L’Italien is pushing a bill to force the major credit bureaus to drop that fee, which you face anytime you “freeze” or “thaw” your personal credit information, at least in Massachusetts. Sen. Elizabeth Warren has filed legislation to accomplish the same in every state. It’s a worthy idea that shouldn’t have to be inspired by a law or lawsuit.
It’s the least the credit bureaus can do for consumers whose data are essential to their business.
Equifax should lead the way, since its security breakdown put us in this position in the first place, and since its leaders knew about the vulnerability for months before disclosing it. Attorney General Maura Healey is suing the company to force it to shoulder the consequences of the data breach. Part of that accountability, she argues, involves paying for consumers to freeze their credit information.
But, really, why should it take a lawsuit? All three major credit bureaus — Equifax, TansUnion and Experian — should allow consumers, at no cost, to readily lock down their information as a way to stymie those who may be trying to open unauthorized accounts in their names, and later to unlock information when they’re making bona fide applications for credit cards or personal loans. Equifax, for the time being, has dropped its processing fee. Its peers should do the same.
Even though it will surely cost the credit bureaus in the short run — potentially millions of dollars — dropping the fee makes economic sense over the long term.
Their businesses, after all, depend upon the free flow of accurate information in service to valid transactions. A rush of bogus plastic and personal loans could be hugely damaging not just for consumers but for the banks and mortgage companies that issue them.
The one-time fee a consumer pays to freeze their credit information ranges from $3 to $10, depending upon the state. Maine, New Jersey, New York and four others require that consumers be allowed to do so for free. Savvy consumers should freeze their information with all three credit bureaus, according to financial advisers.
The combined value of freeze fees surely represents a big source of income to the credit bureaus, although in it’s still a fraction of their business. Last year Equifax reported more than $3.1 billion in sales and more than $2 billion in operating profits. Still, one must wonder if the purpose of these transactions is as much to discourage consumers from locking down information that Equifax and its peers then sell for big dollars to brokers and banks.
L'Italien’s bill also would clean up the process for Massachusetts consumers so one could lock down their information at all three bureaus with a single request. Her bill would mandate more free credit reports to consumers whose data have been compromised, and offer those consumers five years of identity theft protection. Her bill also would require any business that compiles the personal data of more than 1,000 residents of the Bay State to meet certain benchmarks for securing that information.
It’s sad to think a data disaster of this scale — more than 143 million Americans are said to be affected by the Equifax breach — is what was needed to prompt this hue and cry for credit bureaus to become more responsible with data. Perhaps we wouldn’t have noticed a series of smaller leaks that in aggregate could have been just as damaging.
“This is the mother of all breaches,” said L’Italien, chairwoman of the Legislature’s Joint Committee on Consumer Protection and Professional Licensure, at a press briefing this week. “The reporting agency should have been the keeper of the vault.”
As a corollary, reporting agencies should also recognize that consumer data ultimately belongs to the consumers, who should be given the keys to lock and unlock their information.
And they shouldn’t have to pay fees to do it.