Freezing your credit sounds scary, but I do generally recommend looking into it. I froze my credit awhile back now, long before the Equifax breach, just as a proactive measure. Better to do it _before_ your identity gets stolen.
Since the freeze I've opened up a few lines of credit (loans, credit cards, etc). It's not that painful. Most of the time you just find out which credit bureau(s) they're going to pull from beforehand, do a temp unfreeze, and then submit your application like normal. It takes a few extra minutes of your time, but is otherwise not a bother.
There have been a few instances where the companies I was working with were just ... incompetent and didn't know who they were going to pull their reports from. Yeah ... but in those cases I just submitted the application and waited for the rejection letters to roll in, which state which company reported a 0 credit score :P
Is it as easy as before? No. But how often do you open lines of credit or bank accounts? Not often. And I don't think doing those things should be easy anyway. The huge plus here is that you don't have to worry about identity theft like everyone else. I've seen too many friends and family go through identity theft now. It's horrific, stressful, time consuming, and seemingly endless.
And on the bright side, I think having your credit frozen is becoming more and more common, which means companies are getting more used to dealing with people who have them. So the process is becoming more streamlined over time.
Now the caveats. Yes, it cost me money. It may still cost money even with this new law; as a fellow comment points out you may still have to pay whenever you need to temporarily unfreeze your credit. And yes, it's a racket. In many ways it feels like a shakedown. But such is life. People cheat you out of your money every day. This wasn't a mountain I was willing to die on.
I froze my credit after the last breach. It then took me two extra painful weeks attempting to sign a lease when Experian's credit unlock did not work for me. The online form to unlock credit was inappropriately telling me my credit was unfrozen, which it was not, and my credit check was unable to run. I finally somehow found a similar but different credit unlock page with duplicate functionality that ended up working, but only after 5 unsuccessful attempts to unlock and the apartment rental company providing me the benefit of the doubt with five failed credit checks. This is too opaque and painful, and the companies in question are entirely at fault. Not sure what to do aside from raging into the void...
You could just do nothing. That's what I'm doing. I care very little if someone defrauds some bank using my identity to open credit cards. I won't be paying for it. It's the bank's problem, not mine. I'm under no obligation to expend effort to maintain their security and datasets.
The more you let this kind of thing be pushed into your lap, the more it will be.
That works as long as you don't need your credit for anything. This isn't limited to opening new lines of credit. Credit cards can be closed or have limits changed based on credit score. In most states, your car insurance rate can be based on your credit score; most policies renew every 6 months. In the event of a judgment against you for delinquent credit cards, your bank accounts can be levied.
You're correct that this isn't your problem, and eventually you'll get your money back. You're wrong with idea that you can be passive and not get screwed.
But arn't you more likely to be screwed, and have to request an investigation in the case of id theft, if you do nothing?
Freezing credit also may lead to people less likely to open up lines of credit as well. I got a credit card request for temp unfreeze, and I've never gotten around to it.
This article supports freezing: "A credit freeze is a helpful way to reduce the risk of having new credit accounts opened in your name." The article isn't against freezing; only says that you shouldn't stop there.
It's all a matter of reducing attack vectors. I can put a firewall on my network, but that doesn't mean I don't also need smart passwords.
Sure. It just starts to feel like it's pointless when no matter what you do the protection is so inadequate. Medical identity theft is among the most nightmarish to deal with because the identity thief's records are protected by HIPAA so it is difficult to even figure out what you're being charged for.
On the contrary, it works even better if you regularly use your credit report because you don't have to deal with the absolute pain in the ass of freezing and unfreezing it constantly. Time is money and that's a guaranteed loss of both.
The kind of identity theft involving use of a credit report (as opposed to a stolen bank instrument) is relatively rare. Most identity theft involves a stolen credit card and freezing one's credit report offers no benefit in that scenario.
I am absolutely not wrong, the vast majority of people take a passive approach and are fine.
I don't know why you're talking about "getting your money back," this kind of fraud doesn't involve any loss of money from anyone other than a bank. There is no way at all that I can put my own money at risk by not freezing my credit. No one is talking about totally ignoring fraud and allowing a default judgement to occur -- I am talking about not paying upfront fees to micromanage access to pull credit.
> I don't know why you're talking about "getting your money back," this kind of fraud doesn't involve any loss of money from anyone other than a bank.
Not correct. If someone opens a credit card (or anything else at that bank) in your name, and rings up a large balance, you can be sued and levied. It doesn't have to be the same bank; they can and will find your legit accounts in an effort to recover funds. I'm speaking from experience; the actual lawsuit was filed by a law firm that specializes in that type of collection. The protection you get from illegitimate accounts isn't automatic; you'll still have a degree of burden, depending on where you catch things.
Your credit score can be ruined by this and then when you need credit, such as a home or car loan, you are screwed. If you are lucky to be independently wealthy where you can pay for everything with cash, then no problem. But very few of us are in that situation.
Why? You really want to spend all your time fighting someone who gets a hold of your information? It is not a one or two times thing. Go talk to people who had their identities stolen. It is not fun and it can take years to fix everything. I know one person who is still having trouble after 15 years.
The vast majority of people will spend less time as this is a rare occurrence.
Freezing a credit report is not going to prevent someone from getting ahold of your information. It will prevent someone who already has your information from running your credit and opening new lines of credit -- which doesn't matter much. It is completely ineffective for the vast majority (90%+) of identity theft.
It will not protect you from someone stealing your cards or checks.
Yes, credit card theft is not a big deal and you don't really need any protection because the CC companies are pretty pro-active about it. That is not what we are talking about. Yes, real identity theft is rare but it does happen. With a few simple steps, you can protect yourself better in the rare case that it does. Can you completely protect yourself? No, but some protection is better than none.
On the contrary, credit card theft is one of the most common forms of identity theft.
As I said above, it is far, far less time and expense to follow up to actual fraud with a police report than it is to freeze-unfreeze your credit every time you want to pass a credit check.
> As I said above, it is far, far less time and expense to follow up to actual fraud with a police report than it is to freeze-unfreeze your credit every time you want to pass a credit check.
Unless you need monthly credit checks (very odd), I find that statement extremely hard to believe.
Would you care to elaborate? I'm finding your opinion rather odd myself.
The vast majority of people never freeze their credit and never have to expend any energy on the issue of credit security at all.
Most people have their credit run a few times a year, when they sign up for a new service, new credit product, raise a limit, buy a new vehicle, what have you.
I just tried to freeze my credit on Equifax. At the end of the process I received a “one time pdf” with a pin to unfreeze. The pdf was garbled and illegible but there was a number to call if you couldn’t view it. I called the number and was told their system is down and to call back later. This feels more painful than getting my identity stolen.
It only prevents identity theft used to open new lines of credit. Which seems to me like the least troublesome kind of identity theft. You can swear that you did not open that account, and it's up to the lender to prove that you did. Which they will not be able to do.
On the other hand if your identity is stolen and your current lines of credit or bank accounts get drained, it's much more difficult to deal with because the money's gone, or there are a bunch of transactions you need to contest individually.
I just did this and for Equifax and TransUnion, it was very easy, you just download the app and fill in some information. Experian looks like I will have to mail in a request with some documents.
FYI this was a credit _lock_, and not a credit freeze
> Unsurprisingly, the bureaus’ use of the term credit lock has confused many consumers; this was almost certainly by design. But here’s one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.
I'd recommend just actively monitoring your credit before going overboard and freezing it. There's a bunch of different free credit report apps that will send you push notifications the moment anything changes, and things like credit pulls show up almost instantly now. I get notified immediately if anything changes on my report via text, email, and push.
Better to freeze. Credit monitoring just gives you quicker notification that you've already entered a huge world of hurt. The fraudster has successfully struck, and now you have to go to work to undo the damage, which can be a years-long nightmare. ("Well, it shows here that you bought a truck and stopped paying. Not you, you say? Prove it! Oh, and until you do, don't expect to have good credit. Maybe never, actually.")
Credit monitoring just gives you quicker notification
Define "quicker."
I got the credit monitoring from Exerpan after its data breach.
Since then, I've had my credit run twice. Both times were initiated by me, so I know when it happened. Both times, I received a notification by e-mail SEVEN DAYS later, followed by a text message a day after that.
Seven days is plenty long enough to destroy someone's finances.
> Well, it shows here that you bought a truck and stopped paying. Not you, you say? Prove it!
Shouldn't the burden of proof be on them to show that you bought the truck? If their negligence actually prevented you from obtaining credit, shouldn't it be easy to get damages in small claims court?
Freezing it is relatively easy and you don't have to spend time monitoring. Monitoring also doesn't really prevent identify theft. In other words, better safe than sorry.
At the other extreme, YOLO is a stupid one. People buy insurance all the time. I bet you have some yourself. It seems odd to fight against such a simple thing as a credit freeze, and perhaps it is not as onerous to others as it appears to be to you.
The problem is, once something gets on your credit report, it can often be a hassle to get it off. And the onus is completely on you to do so. You end up playing phone tag, potentially for years, with the firm that opened the fraudulent account, as well as all the reporting agencies.
So personally I feel it better to prevent the whole thing to begin with.
Also I'm not familiar with those free credit monitoring apps, but it seems like in all likelihood a "free" credit monitoring app is going to sell your data...
The entire concept of "freezing" and "unfreezing" needs to go away. It should be inaccessible by default, except by a time-limited token generated by the person applying for credit.
I agree, but how should that person generate a token? A hardware device? What if they lose that device? Try and think of it from the perspective of someone who only uses their computer for facebook/banking/candy crush.
No computer needed: when you freeze your credit, the agency mails you a sheet of one-time-use codes. When you apply for credit, you give the bank or whoever one of the codes, and then cross it off of your sheet.
If you lose the paper, you have to go through a manual process to get a new one, the same as you would if you lost the PIN they give you now.
Yeah, this is what I was thinking. People are generally pretty good at keeping secret scraps of paper relatively secure. While a motivated attacker can still break into your house and the safe, they stand a better shot at running afoul of authorities while doing so.
The advantages of such a system would give us auditability and revocation, since each access would be tied to a token. Visiting $ISSUER to get a new sheet of codes for fraud would always revoke the previously issued ones. Consequently, from that point, each fraudulently used token could be tracked.
It would also reduce the value of a stolen sheet of one-time codes to an attacker, since they wouldn't know whether using one would trigger an immediate visit from the authorities.
Emphasis added. It stops the attackers that don't have this information, thus raising the bar. I'm not trying to invent a perfect system, just a better one that's practical to implement.
Right, but a lot of the times the information required for the manual process is also compromised. This just lowers the security level down to whatever the manual process is.
I think it raises the security to that of the manual process. Unless you're saying that right now the system of freezing and unfreezing is more secure than one-time codes would be?
You're right. I was thinking of it from the point of lowering it from a hypothetical hardware device to the manual process instead of raising it from the current system.
The problem is that we've optimized for convenience and friendliness. I've seen freaking F2P MMORPGs offering better login security procedures than major financial products.
Getting a loan is a significant decision. It's okay to have some circumstance and hassle around it, especially if it can actually provide some security benefits.
Personally, I'd love to see "each credit application must be submitted with a photo and a fingerprint" or even "you must go into some physical office to get verified." Yes, it would be a hassle to get that 90-days-same-as-cash washing machine promo, but if someone claimed identity theft, you've got a thick stack of records designed to make prosecuting the crime easy.
You're not wrong, but there really needs some public outreach & education to raise public confidence and utilization of these really simple, yet cryptographically important devices.
I've never gotten a notification from CreditKarma that a lender has checked my report but maybe I don't have it set up correctly. I was thinking more that the agencies would handle.
A bit tangential, but I highly recommend the book "Debt: The First 5,000 Years"[1]. While meandering at times, it is a really interesting comprehensive dive into debt and society.
I'm all for these companies burning to the ground (after the building has been emptied). I'm also all about a currency-less society.
But until we reduce scarcity to a point where that is possible, presumably lenders need some way to evaluate the "trustworthiness" of who they're lending to, yea? How should it be done? My first thought is an agency like the irs is set up to handle it.
Loans don't necessarily make things more affordable. If 'nobody' could pay 1+ million for a home in a major city then home prices would drop until people could afford them.
If anything credit agency's actively harm the middle class by allowing people to extract as much money from them as possible via higher prices.
Sure, business loans are very useful but they don't require credit agency's.
Prices can only drop so far, though. (Warning: completely hypothetical numbers inbound... they're just being used to illustrate the point, not for gauging real costs)
If a 2x4 costs $20 and you need 2000 of them to build a house, the house has to cost at least $40,000. And if pieces of siding cost $20 and you need 1000 of them, then that house has to cost $60,000. That's going to be hard to afford out of pocket. You can save the same amount of a mortgage payment every month, but you still need a place to live in the meantime so you're doubling your cost of living until you fork over the $60,000 in cash.
And you might say the cost of a 2x4 would come down too, but if a lumberjack is making $15/hr and makes one 2x4 every hour, then the cost of that 2x4 can only be $5 cheaper before that lumberjack is getting paid more than the value of his work. And you might say the lumberjack could get paid less, but at $15/hr he already needs to work 4,000 hours before he can afford to buy that $60,000 house (assuming no other expenses).
That's two years of savings before he can buy a house, with no money for food, no money for an apartment, no money for a car. If you cut his wages to make the house cheaper, now he has to work longer before he can buy a house. And since no one can afford the house anyway, he'll likely be laid off before he saves enough money because no one can buy the lumber because no one can buy the house built from it.
And of course, this is all ignoring that none of these businesses are making any money in this entire hypothetical situation. If we didn't have home loans, the cost of housing would go down, but it would still be completely unaffordable without a loan even if the builder was losing money.
Rather than paying less per hour or less for lumber people would end up with smaller homes. A 40k down payment on a 200,000$ house already pays for a significant structure. Not marble countertops, but perfectly livable if small.
Further, as the buyer would not have a mortgage they could upgrade from a ‘starter’ home. But, only if they actually felt the need and saved up even more cash.
>presumably lenders need some way to evaluate the "trustworthiness" of who they're lending to, yea?
Well, that's kind of, like, their whole job description. If you can't evaluate peoples' trustworthiness, you shouldn't be in the business of professionally loaning money!
Now lenders almost have a hybrid model -- they use the credit scoring to allow them to write the loan well over the recoverable value of the asset.
When I was buying my new house, I found a lender who was willing to write me an interest-only, 105% LTV loan for the new house while I simultaneously had a mortgage on the old property. The premium was only like 1.5%, and I re-financed in a few months after the house sold.
Wouldn't be necessary if we had a law that makes the banks liable for getting defrauded instead of the individual who's name, and other publicly available "secret" information, happens to be used to do it.
Let's take a look at what "Identity Theft" actually is.
You go to a bank, give them your property, with the agreement that they will keep it safe and only allow you to access it, in return they get to lend it out and make interest with it.
Then the bank just starts handing your property out to random people. They shrug and go, "Your identity has been stolen, it's your fault, best of luck getting it sorted out."
That's insane. The bank failed to uphold their end of the deal, they failed to keep your property safe and guarantee that only you could access it, they should have to pay to fix their mistake.
If financial institutions were responsible for erroneously dispensing money, establishing lines of credit, etc the incentives would align correctly and this problem would be solved. As long as they are allowed to push this responsibility onto the consumer we will have to keep dealing with a patchwork of locks, freezes, dark-web scans, vigilance in checking your credit report, and even if you do everything right, you will be to blame if a dedicated attacker tricks the bank. It's your fault, no matter how careful and diligent you are, that the bank made a mistake, they have no incentive to make this better.
Banks are liable. If a fraudster steals someone identity and setups a bunch of credit cards and/or loans, the bank eats the loss. This is protected in contract law because the bank doesn’t have a valid contract with the victim.
Are they held liable for the pain and suffering that ensues? Are they forced to fix the persons credit score? They need to be punished for it, not just eat the loss. They make up the loss by charging insane interest rates, late fees and service fees. There should be jail time and personal responsibility.
If you want pain and suffering. Have someone steal your identity when they get arrested.
I have had my identity stolen, I just disputed accounts on my credit report. It took me about an hour. The 3 credit cards companies and two cell companies lost about $25k total. If debt collectors call, tell them to prove the debt which they can't do so they go away.
For you to set up a SECOND FACTOR AUTHENTICATION where you would approve before some new credit account is reported. Maybe even for a credit check.
1. Apply for credit
2. They check your report
3. They make an offer
4. You review the offer
5. You endorse it
6. They submit to bureau
7. Bureau sends you a text
or to their app om your phone
with details of offer
You can endorse at step 6 by a cryptographic signature or at step 7 use Authy, text or the bureau’s app.
How hard is that??? Seriously!! We have Google Authenticator for bank accounts but not credit bureaus?
It would be strictly opt-in so those who care about identity theft CAN make sure to prevent it.
Would it be possible to require the use of an OpenPGP or other actual cryptographic identity that matches a whitelist of keys I or a government agency provides for anything more major than a typical shopping trip to the grocery store / Costco?
Phone numbers and cell phones are too easy to have redirected; so an actual cryptographic ID is required. That's why I want the government to sign off on personal IDs when /they/ confirm my ID at drivers/identification license updates.
When will people realize that the whole idea of a "credit score" is insanely bad - just lend to anyone under the same conditions, do personal checks on case by case basis etc. There are parts of the world that have all regular financial tools like mortgages and all without the credit score part. Keeping a "score" is just a means of discrimination and oppression.
Yeah, credit will become more expensive, as it should be! People should only lend money with verified collateral etc. And maybe it's not "fair" to lend anyone at the same rate, just as it's not "fair" to have "universal" health insurance. But you know what? F fairness! Nobody needs "fair", we need systems that work, and do so reliably and in easily understandable ways, making the word a place you would want to live in.
We can afford to de-optimize some aspects of the economy in order to get a better quality of life with low stress and all. Equality and anonymity is what everyone needs more of, not "fairness" and invasion of privacy (aka "transparency"), with the former usually used to justify the latter.
I don't think universal credit availability is analogous to universal health insurance, for specific reasons.
People who are against universal health insurance often, I think, imagine spending vast or unlimited amounts should they have a terminal illness. And therefore, they are afraid that society cannot afford to provide that to everyone.
I think that is not a real concern, because the possibilities for treatment are limited in practice sufficiently that universal health insurance is workable. Billionaires do not typically spend all their billions on trying to stave off death.
By contrast, universal availability of credit has no such inherent limit on demand. One person who would otherwise have poor credit could impoverish a nation, in principle, because borrowed money can be utilized for any desire. If we do put limits on the credit provided to people, then we have not changed the nature of it to make it universal and equal and something will be needed to discriminate, even if we don't call it a credit score.
So you think requiring someone to have verified collateral to take out a loan is less oppressive than allowing someone who doesn't have any collateral to use solely their reputation to borrow money very cheaply?
Your hypothetical system makes financial products only available to wealthy. That's pretty much the definition of oppressive. A system where more people have more access to more products is the fairer one.
Freeze cost is only one part. Not mentioned in this article are costs of temporary unfreeze. TransUnion used to/still does charge $10 for each unfreeze.
>"Placing a freeze should be fast and relatively easy, although you will have to sign up for separate ones at each of the three credit bureaus."
This is so broken. Freezing your credit at one should automatically freeze your credit at all of them. This functionality already exists for providing a 90 day lock on your profile. Making people jump through 3 sets of hoops to freeze and unfreeze their credit is a joke. I'm guessing this was law makers capitulating to the will of the industry instead of the consumer. Sadly no surprise there.
>"If the credit bureaus cannot sufficiently verify your identity based on the information you've provided, you may need to mail in copies of your driver's license, utility bills or other supporting documentation to validate your identity and execute a freeze."
What constitutes "sufficiently" can be arbitrarily obscure. Examples of this include. The number of a landline you had 20 years ago, the zip code of a company that bought a now defunct company you used to work for. Your only recourse is snail male and making photocopies of sensitive documents and mailing them to a P.O box somewhere. These same "verification" systems also randomly report failure during the process leaving the consumer with no choice but to snail male.
"We want to make it is as simple as possible to access that freeze, but we want to protect you at the same time," Experian's Griffin said. "We need to strike that balance."
This is nonsense and nobody believes this for a minute. This shady industry finally got called to account albeit in a quite limited way and they will do everything possible to make this as inefficient as possible. There may be a law on the books now that they can't charge but there is no law that says these systems need to be maintained, verified to be working or efficient.
I was able to freeze my credit w/ TransUnion and Experian easily this morning. However with Equifax I got a vague error stating that they could not process my request. After taking a look at the equivalent thread on /r/personalfinance I think someone may have preemptively frozen my account with my data that was exposed as apart of the hack. I guess I need to contact Equifax by phone now. A bit frustrating but locking down 2/3 isn't bad for 15 minutes of work.
They can, if the lender doesn't do a credit check, its just that most lenders won't loan to someone without first checking their credit file. Someone can run up medical debt in your name, since doctors don't do credit checks.
Can anybody explain what this is about and what a "credit report" is?
I've owned and used bank accounts and credit cards for my entire adult life, that is to say, several decades (in the EU) and I've never come across this concept.
I'll give you a quick summary version based on this though.
Business owners were looking for a way to tell if the person standing in front of them will likely pay them back. So Businesses go to companies like Equifax that try build credit reports on people and basically ask "can I trust john smith?". Essentially they're big time data brokers.
The thing is that when you created and owned accounts with banks and established credit cards, the whole time those banks were funneling your activities to companies like Equifax, who then build these credit reports against you. So even if you never interacted with them, your banks likely told them everything about you.
This kind of thing is something you only really find out about if you go looking for it.
If you have kids, you might want to freeze their credit too. I listen to "The Perfect Scam" podcast, and they said that thief now prefers to steal kid or teenager identities since they can milk their account longer.
The credit file exists as normal, it's just inaccessible by lenders (and insurance companies, cell phone companies, internet companies, etc.) for the duration of the freeze.
Freezing your credit sounds scary, but I do generally recommend looking into it. I froze my credit awhile back now, long before the Equifax breach, just as a proactive measure. Better to do it _before_ your identity gets stolen.
Since the freeze I've opened up a few lines of credit (loans, credit cards, etc). It's not that painful. Most of the time you just find out which credit bureau(s) they're going to pull from beforehand, do a temp unfreeze, and then submit your application like normal. It takes a few extra minutes of your time, but is otherwise not a bother.
There have been a few instances where the companies I was working with were just ... incompetent and didn't know who they were going to pull their reports from. Yeah ... but in those cases I just submitted the application and waited for the rejection letters to roll in, which state which company reported a 0 credit score :P
Is it as easy as before? No. But how often do you open lines of credit or bank accounts? Not often. And I don't think doing those things should be easy anyway. The huge plus here is that you don't have to worry about identity theft like everyone else. I've seen too many friends and family go through identity theft now. It's horrific, stressful, time consuming, and seemingly endless.
And on the bright side, I think having your credit frozen is becoming more and more common, which means companies are getting more used to dealing with people who have them. So the process is becoming more streamlined over time.
Now the caveats. Yes, it cost me money. It may still cost money even with this new law; as a fellow comment points out you may still have to pay whenever you need to temporarily unfreeze your credit. And yes, it's a racket. In many ways it feels like a shakedown. But such is life. People cheat you out of your money every day. This wasn't a mountain I was willing to die on.
I froze my credit after the last breach. It then took me two extra painful weeks attempting to sign a lease when Experian's credit unlock did not work for me. The online form to unlock credit was inappropriately telling me my credit was unfrozen, which it was not, and my credit check was unable to run. I finally somehow found a similar but different credit unlock page with duplicate functionality that ended up working, but only after 5 unsuccessful attempts to unlock and the apartment rental company providing me the benefit of the doubt with five failed credit checks. This is too opaque and painful, and the companies in question are entirely at fault. Not sure what to do aside from raging into the void...
You could just do nothing. That's what I'm doing. I care very little if someone defrauds some bank using my identity to open credit cards. I won't be paying for it. It's the bank's problem, not mine. I'm under no obligation to expend effort to maintain their security and datasets.
The more you let this kind of thing be pushed into your lap, the more it will be.
That works as long as you don't need your credit for anything. This isn't limited to opening new lines of credit. Credit cards can be closed or have limits changed based on credit score. In most states, your car insurance rate can be based on your credit score; most policies renew every 6 months. In the event of a judgment against you for delinquent credit cards, your bank accounts can be levied.
You're correct that this isn't your problem, and eventually you'll get your money back. You're wrong with idea that you can be passive and not get screwed.
Yeah, but you can be vigilant and still get screwed.
But arn't you more likely to be screwed, and have to request an investigation in the case of id theft, if you do nothing?
Freezing credit also may lead to people less likely to open up lines of credit as well. I got a credit card request for temp unfreeze, and I've never gotten around to it.
It could help, but there are still various forms of identity theft you're vulnerable to: https://www.forbes.com/sites/nickclements/2017/09/13/3-reaso...
This article supports freezing: "A credit freeze is a helpful way to reduce the risk of having new credit accounts opened in your name." The article isn't against freezing; only says that you shouldn't stop there.
It's all a matter of reducing attack vectors. I can put a firewall on my network, but that doesn't mean I don't also need smart passwords.
Sure. It just starts to feel like it's pointless when no matter what you do the protection is so inadequate. Medical identity theft is among the most nightmarish to deal with because the identity thief's records are protected by HIPAA so it is difficult to even figure out what you're being charged for.
I can be vigilant and get blindsided at an intersection, but I still look both ways before I cross the street.
On the contrary, it works even better if you regularly use your credit report because you don't have to deal with the absolute pain in the ass of freezing and unfreezing it constantly. Time is money and that's a guaranteed loss of both.
The kind of identity theft involving use of a credit report (as opposed to a stolen bank instrument) is relatively rare. Most identity theft involves a stolen credit card and freezing one's credit report offers no benefit in that scenario.
I am absolutely not wrong, the vast majority of people take a passive approach and are fine.
I don't know why you're talking about "getting your money back," this kind of fraud doesn't involve any loss of money from anyone other than a bank. There is no way at all that I can put my own money at risk by not freezing my credit. No one is talking about totally ignoring fraud and allowing a default judgement to occur -- I am talking about not paying upfront fees to micromanage access to pull credit.
It does not matter very much at all.
> I don't know why you're talking about "getting your money back," this kind of fraud doesn't involve any loss of money from anyone other than a bank.
Not correct. If someone opens a credit card (or anything else at that bank) in your name, and rings up a large balance, you can be sued and levied. It doesn't have to be the same bank; they can and will find your legit accounts in an effort to recover funds. I'm speaking from experience; the actual lawsuit was filed by a law firm that specializes in that type of collection. The protection you get from illegitimate accounts isn't automatic; you'll still have a degree of burden, depending on where you catch things.
As I said above "No one is talking about totally ignoring fraud and allowing a default judgement to occur"
You are discussing something entirely different, unrelated to the point I made above.
Your credit score can be ruined by this and then when you need credit, such as a home or car loan, you are screwed. If you are lucky to be independently wealthy where you can pay for everything with cash, then no problem. But very few of us are in that situation.
Just file disputes, it'll get removed. Disputes are free and with a police report in hand they will go through.
I'm suggesting you should not pay upfront to help curate this data, to pay to micromanage access to a credit report to protect other lenders.
Why? You really want to spend all your time fighting someone who gets a hold of your information? It is not a one or two times thing. Go talk to people who had their identities stolen. It is not fun and it can take years to fix everything. I know one person who is still having trouble after 15 years.
The vast majority of people will spend less time as this is a rare occurrence.
Freezing a credit report is not going to prevent someone from getting ahold of your information. It will prevent someone who already has your information from running your credit and opening new lines of credit -- which doesn't matter much. It is completely ineffective for the vast majority (90%+) of identity theft.
It will not protect you from someone stealing your cards or checks.
identity theft != credit card theft
Yes, credit card theft is not a big deal and you don't really need any protection because the CC companies are pretty pro-active about it. That is not what we are talking about. Yes, real identity theft is rare but it does happen. With a few simple steps, you can protect yourself better in the rare case that it does. Can you completely protect yourself? No, but some protection is better than none.
On the contrary, credit card theft is one of the most common forms of identity theft.
As I said above, it is far, far less time and expense to follow up to actual fraud with a police report than it is to freeze-unfreeze your credit every time you want to pass a credit check.
> As I said above, it is far, far less time and expense to follow up to actual fraud with a police report than it is to freeze-unfreeze your credit every time you want to pass a credit check.
Unless you need monthly credit checks (very odd), I find that statement extremely hard to believe.
Would you care to elaborate? I'm finding your opinion rather odd myself.
The vast majority of people never freeze their credit and never have to expend any energy on the issue of credit security at all.
Most people have their credit run a few times a year, when they sign up for a new service, new credit product, raise a limit, buy a new vehicle, what have you.
I just tried to freeze my credit on Equifax. At the end of the process I received a “one time pdf” with a pin to unfreeze. The pdf was garbled and illegible but there was a number to call if you couldn’t view it. I called the number and was told their system is down and to call back later. This feels more painful than getting my identity stolen.
Did you save the PDF? The PDF wasnt too hard to read for me. I saved it to my Drive account just in case and wrote down the PIN #.
No, I was on an iPhone and didn’t have the ability to that I know of.
It only prevents identity theft used to open new lines of credit. Which seems to me like the least troublesome kind of identity theft. You can swear that you did not open that account, and it's up to the lender to prove that you did. Which they will not be able to do.
On the other hand if your identity is stolen and your current lines of credit or bank accounts get drained, it's much more difficult to deal with because the money's gone, or there are a bunch of transactions you need to contest individually.
Do you have kids? If so - do you freeze theirs too? (I'm considering doing so myself)
It would not hurt to do so.
I just did this and for Equifax and TransUnion, it was very easy, you just download the app and fill in some information. Experian looks like I will have to mail in a request with some documents.
FYI this was a credit _lock_, and not a credit freeze
> Unsurprisingly, the bureaus’ use of the term credit lock has confused many consumers; this was almost certainly by design. But here’s one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.
https://krebsonsecurity.com/2018/09/credit-freezes-are-free-...
Plus Equifax and TransUnion reports are rarely used, during credit applications Experian gets pulled ~75% of the time (I churn credit cards).
I'd recommend just actively monitoring your credit before going overboard and freezing it. There's a bunch of different free credit report apps that will send you push notifications the moment anything changes, and things like credit pulls show up almost instantly now. I get notified immediately if anything changes on my report via text, email, and push.
Better to freeze. Credit monitoring just gives you quicker notification that you've already entered a huge world of hurt. The fraudster has successfully struck, and now you have to go to work to undo the damage, which can be a years-long nightmare. ("Well, it shows here that you bought a truck and stopped paying. Not you, you say? Prove it! Oh, and until you do, don't expect to have good credit. Maybe never, actually.")
Credit monitoring just gives you quicker notification
Define "quicker."
I got the credit monitoring from Exerpan after its data breach.
Since then, I've had my credit run twice. Both times were initiated by me, so I know when it happened. Both times, I received a notification by e-mail SEVEN DAYS later, followed by a text message a day after that.
Seven days is plenty long enough to destroy someone's finances.
> Well, it shows here that you bought a truck and stopped paying. Not you, you say? Prove it!
Shouldn't the burden of proof be on them to show that you bought the truck? If their negligence actually prevented you from obtaining credit, shouldn't it be easy to get damages in small claims court?
Freezing it is relatively easy and you don't have to spend time monitoring. Monitoring also doesn't really prevent identify theft. In other words, better safe than sorry.
Monitoring is totally passive.
"better safe than sorry" is a stifling maxim to live by.
At the other extreme, YOLO is a stupid one. People buy insurance all the time. I bet you have some yourself. It seems odd to fight against such a simple thing as a credit freeze, and perhaps it is not as onerous to others as it appears to be to you.
I hope you are never sorry.
The problem is, once something gets on your credit report, it can often be a hassle to get it off. And the onus is completely on you to do so. You end up playing phone tag, potentially for years, with the firm that opened the fraudulent account, as well as all the reporting agencies.
So personally I feel it better to prevent the whole thing to begin with.
Also I'm not familiar with those free credit monitoring apps, but it seems like in all likelihood a "free" credit monitoring app is going to sell your data...
How is freezing your credit "going overboard?"
The entire concept of "freezing" and "unfreezing" needs to go away. It should be inaccessible by default, except by a time-limited token generated by the person applying for credit.
I agree, but how should that person generate a token? A hardware device? What if they lose that device? Try and think of it from the perspective of someone who only uses their computer for facebook/banking/candy crush.
No computer needed: when you freeze your credit, the agency mails you a sheet of one-time-use codes. When you apply for credit, you give the bank or whoever one of the codes, and then cross it off of your sheet.
If you lose the paper, you have to go through a manual process to get a new one, the same as you would if you lost the PIN they give you now.
Yeah, this is what I was thinking. People are generally pretty good at keeping secret scraps of paper relatively secure. While a motivated attacker can still break into your house and the safe, they stand a better shot at running afoul of authorities while doing so.
The advantages of such a system would give us auditability and revocation, since each access would be tied to a token. Visiting $ISSUER to get a new sheet of codes for fraud would always revoke the previously issued ones. Consequently, from that point, each fraudulently used token could be tracked.
It would also reduce the value of a stolen sheet of one-time codes to an attacker, since they wouldn't know whether using one would trigger an immediate visit from the authorities.
> If you lose the paper, you have to go through a manual process to get a new one, the same as you would if you lost the PIN they give you now.
If an attacker has your identity then he might have access to that unlocking process. Thus, how does this strategy changes anything?
> he might have access to that unlocking process.
Emphasis added. It stops the attackers that don't have this information, thus raising the bar. I'm not trying to invent a perfect system, just a better one that's practical to implement.
Right, but a lot of the times the information required for the manual process is also compromised. This just lowers the security level down to whatever the manual process is.
I think it raises the security to that of the manual process. Unless you're saying that right now the system of freezing and unfreezing is more secure than one-time codes would be?
You're right. I was thinking of it from the point of lowering it from a hypothetical hardware device to the manual process instead of raising it from the current system.
Ah, got it. But a hardware device would still need a manual fallback :)
The problem is that we've optimized for convenience and friendliness. I've seen freaking F2P MMORPGs offering better login security procedures than major financial products.
Getting a loan is a significant decision. It's okay to have some circumstance and hassle around it, especially if it can actually provide some security benefits.
Personally, I'd love to see "each credit application must be submitted with a photo and a fingerprint" or even "you must go into some physical office to get verified." Yes, it would be a hassle to get that 90-days-same-as-cash washing machine promo, but if someone claimed identity theft, you've got a thick stack of records designed to make prosecuting the crime easy.
You're not wrong, but there really needs some public outreach & education to raise public confidence and utilization of these really simple, yet cryptographically important devices.
A better place to start would be: accessible with notifications.
Like Credit Karma?
I've never gotten a notification from CreditKarma that a lender has checked my report but maybe I don't have it set up correctly. I was thinking more that the agencies would handle.
"This entire concept needs to go away, replaced by a solution that isn't invented yet"
And no, current 2FA doesn't count.
It should be supported by a citizen ID with cryptographic signature support (similar to what Estonia provides its citizens with).
https://e-estonia.com/solutions/e-identity/id-card/
I really like this approach.
The fact that this cost consumers money is such an obvious symptom of a larger problem.
In case anyone hasn't seen this twitter thread before: https://twitter.com/matthewstoller/status/906257077215133696
The history of credit companies like Equifax are extremely dystopian. We should be working to find replacements for such systems.
A bit tangential, but I highly recommend the book "Debt: The First 5,000 Years"[1]. While meandering at times, it is a really interesting comprehensive dive into debt and society.
[1] https://en.wikipedia.org/wiki/Debt:_The_First_5000_Years
We don't need replacements. We need to eliminate these companies.
I'm all for these companies burning to the ground (after the building has been emptied). I'm also all about a currency-less society.
But until we reduce scarcity to a point where that is possible, presumably lenders need some way to evaluate the "trustworthiness" of who they're lending to, yea? How should it be done? My first thought is an agency like the irs is set up to handle it.
Loans don't necessarily make things more affordable. If 'nobody' could pay 1+ million for a home in a major city then home prices would drop until people could afford them.
If anything credit agency's actively harm the middle class by allowing people to extract as much money from them as possible via higher prices.
Sure, business loans are very useful but they don't require credit agency's.
Prices can only drop so far, though. (Warning: completely hypothetical numbers inbound... they're just being used to illustrate the point, not for gauging real costs)
If a 2x4 costs $20 and you need 2000 of them to build a house, the house has to cost at least $40,000. And if pieces of siding cost $20 and you need 1000 of them, then that house has to cost $60,000. That's going to be hard to afford out of pocket. You can save the same amount of a mortgage payment every month, but you still need a place to live in the meantime so you're doubling your cost of living until you fork over the $60,000 in cash.
And you might say the cost of a 2x4 would come down too, but if a lumberjack is making $15/hr and makes one 2x4 every hour, then the cost of that 2x4 can only be $5 cheaper before that lumberjack is getting paid more than the value of his work. And you might say the lumberjack could get paid less, but at $15/hr he already needs to work 4,000 hours before he can afford to buy that $60,000 house (assuming no other expenses).
That's two years of savings before he can buy a house, with no money for food, no money for an apartment, no money for a car. If you cut his wages to make the house cheaper, now he has to work longer before he can buy a house. And since no one can afford the house anyway, he'll likely be laid off before he saves enough money because no one can buy the lumber because no one can buy the house built from it.
And of course, this is all ignoring that none of these businesses are making any money in this entire hypothetical situation. If we didn't have home loans, the cost of housing would go down, but it would still be completely unaffordable without a loan even if the builder was losing money.
Rather than paying less per hour or less for lumber people would end up with smaller homes. A 40k down payment on a 200,000$ house already pays for a significant structure. Not marble countertops, but perfectly livable if small.
Further, as the buyer would not have a mortgage they could upgrade from a ‘starter’ home. But, only if they actually felt the need and saved up even more cash.
>presumably lenders need some way to evaluate the "trustworthiness" of who they're lending to, yea?
Well, that's kind of, like, their whole job description. If you can't evaluate peoples' trustworthiness, you shouldn't be in the business of professionally loaning money!
> presumably lenders need some way to evaluate the "trustworthiness" of who they're lending to, yea? How should it be done?
The same way it's done in countries without these entities.
How is that?
The below article describes how it's done in Canada, the UK, and the EU.
https://www.cnbc.com/id/41498097
Historically lenders would lend over collateral, with your net assets being an indicator of your ability to pay them back.
Now lenders almost have a hybrid model -- they use the credit scoring to allow them to write the loan well over the recoverable value of the asset.
When I was buying my new house, I found a lender who was willing to write me an interest-only, 105% LTV loan for the new house while I simultaneously had a mortgage on the old property. The premium was only like 1.5%, and I re-financed in a few months after the house sold.
How would you propose lenders evaluate credit in such a situation?
Blockchain
/s?
Wouldn't be necessary if we had a law that makes the banks liable for getting defrauded instead of the individual who's name, and other publicly available "secret" information, happens to be used to do it.
Exactly.
Let's take a look at what "Identity Theft" actually is.
You go to a bank, give them your property, with the agreement that they will keep it safe and only allow you to access it, in return they get to lend it out and make interest with it.
Then the bank just starts handing your property out to random people. They shrug and go, "Your identity has been stolen, it's your fault, best of luck getting it sorted out."
That's insane. The bank failed to uphold their end of the deal, they failed to keep your property safe and guarantee that only you could access it, they should have to pay to fix their mistake.
If financial institutions were responsible for erroneously dispensing money, establishing lines of credit, etc the incentives would align correctly and this problem would be solved. As long as they are allowed to push this responsibility onto the consumer we will have to keep dealing with a patchwork of locks, freezes, dark-web scans, vigilance in checking your credit report, and even if you do everything right, you will be to blame if a dedicated attacker tricks the bank. It's your fault, no matter how careful and diligent you are, that the bank made a mistake, they have no incentive to make this better.
Banks are liable. If a fraudster steals someone identity and setups a bunch of credit cards and/or loans, the bank eats the loss. This is protected in contract law because the bank doesn’t have a valid contract with the victim.
Are they held liable for the pain and suffering that ensues? Are they forced to fix the persons credit score? They need to be punished for it, not just eat the loss. They make up the loss by charging insane interest rates, late fees and service fees. There should be jail time and personal responsibility.
If you want pain and suffering. Have someone steal your identity when they get arrested.
I have had my identity stolen, I just disputed accounts on my credit report. It took me about an hour. The 3 credit cards companies and two cell companies lost about $25k total. If debt collectors call, tell them to prove the debt which they can't do so they go away.
You know what they should pass a law to do?
For you to set up a SECOND FACTOR AUTHENTICATION where you would approve before some new credit account is reported. Maybe even for a credit check.
You can endorse at step 6 by a cryptographic signature or at step 7 use Authy, text or the bureau’s app.How hard is that??? Seriously!! We have Google Authenticator for bank accounts but not credit bureaus?
It would be strictly opt-in so those who care about identity theft CAN make sure to prevent it.
Would it be possible to require the use of an OpenPGP or other actual cryptographic identity that matches a whitelist of keys I or a government agency provides for anything more major than a typical shopping trip to the grocery store / Costco?
Phone numbers and cell phones are too easy to have redirected; so an actual cryptographic ID is required. That's why I want the government to sign off on personal IDs when /they/ confirm my ID at drivers/identification license updates.
When will people realize that the whole idea of a "credit score" is insanely bad - just lend to anyone under the same conditions, do personal checks on case by case basis etc. There are parts of the world that have all regular financial tools like mortgages and all without the credit score part. Keeping a "score" is just a means of discrimination and oppression.
Yeah, credit will become more expensive, as it should be! People should only lend money with verified collateral etc. And maybe it's not "fair" to lend anyone at the same rate, just as it's not "fair" to have "universal" health insurance. But you know what? F fairness! Nobody needs "fair", we need systems that work, and do so reliably and in easily understandable ways, making the word a place you would want to live in.
We can afford to de-optimize some aspects of the economy in order to get a better quality of life with low stress and all. Equality and anonymity is what everyone needs more of, not "fairness" and invasion of privacy (aka "transparency"), with the former usually used to justify the latter.
I don't think universal credit availability is analogous to universal health insurance, for specific reasons.
People who are against universal health insurance often, I think, imagine spending vast or unlimited amounts should they have a terminal illness. And therefore, they are afraid that society cannot afford to provide that to everyone.
I think that is not a real concern, because the possibilities for treatment are limited in practice sufficiently that universal health insurance is workable. Billionaires do not typically spend all their billions on trying to stave off death.
By contrast, universal availability of credit has no such inherent limit on demand. One person who would otherwise have poor credit could impoverish a nation, in principle, because borrowed money can be utilized for any desire. If we do put limits on the credit provided to people, then we have not changed the nature of it to make it universal and equal and something will be needed to discriminate, even if we don't call it a credit score.
So you think requiring someone to have verified collateral to take out a loan is less oppressive than allowing someone who doesn't have any collateral to use solely their reputation to borrow money very cheaply?
Your hypothetical system makes financial products only available to wealthy. That's pretty much the definition of oppressive. A system where more people have more access to more products is the fairer one.
Debt can be an important tool if used correctly.
And without collateral you clearly can't loan to everyone because this is what happens:
Borrow money at 1000% interest
Don't make any payments. What are they going to do? Sue me? I can't pay, I'm in debt. Hookers and blow for everyone.
Borrow more money at 1000% interest. They can't say no!!! Debt for everyone!!
Make Payments? Lol.
Borrow more money. Don't make payments.
Borrow more money. Don't make payments.
Continue on forever. It's a money spigot.
Nobody would be willing to lend to anyone in this situation without serious collateral and only at very high rates and limited to low risk loans.
Reinstituting debtors prison would be the only fix for this problem. And that's 10000 times more oppressive than credit scores.
Don't lend to people in debt? Congratulations, now you're back to credit scores!
If my credit card company can call and text me while I stand at the Point of Sale for an high risk approval, why then can these folks not do the same.
It should be the default behavior.
Now the challenging and arguable more difficult thing would be debt collection.
Edit: The short answer is because the consumers are not the customers.
Don't forget Innovis and CheckSystems. Great information here.
https://krebsonsecurity.com/2018/09/credit-freezes-are-free-...
There is also NCTUE
Freeze page - http://www.nctue.com/Consumers
Freeze cost is only one part. Not mentioned in this article are costs of temporary unfreeze. TransUnion used to/still does charge $10 for each unfreeze.
The article says unfreezes should also be free now.
>"Placing a freeze should be fast and relatively easy, although you will have to sign up for separate ones at each of the three credit bureaus."
This is so broken. Freezing your credit at one should automatically freeze your credit at all of them. This functionality already exists for providing a 90 day lock on your profile. Making people jump through 3 sets of hoops to freeze and unfreeze their credit is a joke. I'm guessing this was law makers capitulating to the will of the industry instead of the consumer. Sadly no surprise there.
>"If the credit bureaus cannot sufficiently verify your identity based on the information you've provided, you may need to mail in copies of your driver's license, utility bills or other supporting documentation to validate your identity and execute a freeze."
What constitutes "sufficiently" can be arbitrarily obscure. Examples of this include. The number of a landline you had 20 years ago, the zip code of a company that bought a now defunct company you used to work for. Your only recourse is snail male and making photocopies of sensitive documents and mailing them to a P.O box somewhere. These same "verification" systems also randomly report failure during the process leaving the consumer with no choice but to snail male.
"We want to make it is as simple as possible to access that freeze, but we want to protect you at the same time," Experian's Griffin said. "We need to strike that balance."
This is nonsense and nobody believes this for a minute. This shady industry finally got called to account albeit in a quite limited way and they will do everything possible to make this as inefficient as possible. There may be a law on the books now that they can't charge but there is no law that says these systems need to be maintained, verified to be working or efficient.
Too bad this wasn't in place about a year ago when I was freezing my credit because of Equifax and getting temporary thaws to apply for a mortgage.
I was able to freeze my credit w/ TransUnion and Experian easily this morning. However with Equifax I got a vague error stating that they could not process my request. After taking a look at the equivalent thread on /r/personalfinance I think someone may have preemptively frozen my account with my data that was exposed as apart of the hack. I guess I need to contact Equifax by phone now. A bit frustrating but locking down 2/3 isn't bad for 15 minutes of work.
Experian keeps asking me to pay for this feature. Where did you find it?
What is the benefit of freezing your credit?
Somebody pretending to be you can't borrow money in your name.
They can, if the lender doesn't do a credit check, its just that most lenders won't loan to someone without first checking their credit file. Someone can run up medical debt in your name, since doctors don't do credit checks.
Can anybody explain what this is about and what a "credit report" is?
I've owned and used bank accounts and credit cards for my entire adult life, that is to say, several decades (in the EU) and I've never come across this concept.
I might be getting your question wrong here but have a listen to this podcast: https://www.npr.org/sections/money/2017/10/06/556212654/epis...
I'll give you a quick summary version based on this though.
Business owners were looking for a way to tell if the person standing in front of them will likely pay them back. So Businesses go to companies like Equifax that try build credit reports on people and basically ask "can I trust john smith?". Essentially they're big time data brokers.
The thing is that when you created and owned accounts with banks and established credit cards, the whole time those banks were funneling your activities to companies like Equifax, who then build these credit reports against you. So even if you never interacted with them, your banks likely told them everything about you.
This kind of thing is something you only really find out about if you go looking for it.
Ohh... that's what Equifax does! I could never figure it out from the news articles. Thanks for the link, I'll listen to it.
You're right, I don't think I want to go looking into my own reports, until (if ever) I need to.
“Where ignorance is bliss, 'tis folly to be wise.”
If you have kids, you might want to freeze their credit too. I listen to "The Perfect Scam" podcast, and they said that thief now prefers to steal kid or teenager identities since they can milk their account longer.
Freezing my credit still allows it to improve based on my existing lines of credit, correct?
The credit file exists as normal, it's just inaccessible by lenders (and insurance companies, cell phone companies, internet companies, etc.) for the duration of the freeze.
I have mine frozen and my credit scores on Credit Karma are still visible and change monthly. Credit Karma lists Equifax and TransUnion scores.
Perfect. I suppose that I will go ahead and freeze mine as I don't foresee any need to apply for credit in the near future.