In May of this year, the city of Akron, Ohio suffered a hack into their servers that housed personally identifying information of many of its tax payers. City officials did the right thing and sent out breach notification letters to those affected. The ITRC assisted in the communication with these individuals and informed callers of the process they could undertake to minimize their risk of becoming a victim of identity theft as well as some of the options they had. We must emphasize the word “options” because while there is a mostly uniform process for data breach response activities, there are some choices that consumers can make about their individual situation.
One of those choices is the level of caution they are going to exercise in relation to their personal circumstances. Individuals who receive a data breach notification letter are not automatically victims of identity theft. There is, however, a strong correlation between data breaches and identity theft. According to a recent Javelin study, one in four data breach notification letter recipients eventually becomes a victim of identity fraud. However individuals that are not yet victims of identity fraud will not necessarily face the same level of complexity in responding to the issue.
Two of the strongest tools in the arsenal are the Fraud Alert and the Credit Freeze. Below is the explanation of what each action will accomplish, the pros and cons of each, and why timing is also key.
Fraud Alert: is intended to highlight a potential for fraud on a specific report for credit issuers.
- The Upside: The alert should prompt credit issuers to authenticate and verify the applicant’s identity, in substantially meaningful ways, prior to issuing new credit. Thus protecting you, the actual consumer, from having someone who has gained access to your information from opening new lines of credit by using that information. Placing a fraud alert does not affect your credit score. You will be offered a free credit report (if you are a potential victim of identity theft) that will not count against the one free report from each CRA that you are entitled to every year by law.
- The Downside: Creditors do not always heed the alert and therefore it’s not 100% reliable. Not all credit issuers run credit checks (cell phone providers, utilities and cable companies can be examples), and it can slow down the application process when you seek to open new lines of credit.
Credit Freeze: is intended to stop a credit issuer from viewing your credit report for the purposes of establishing/opening new lines of credit. A pin number is issued that essentially makes your credit report (and score) unviewable by anyone. The PIN must be used to thaw your credit.
- The Upside: This is the strongest tool in the arsenal which basically stops credit issuers from issuing new accounts. It allows companies you already have a relationship with to still view your credit report (but only for credit-worthiness). Most states will provide this service free of charge to victims of identity theft. There is a process in place that allows consumers to temporarily “thaw” the freeze if they need to open a new line of credit. The freeze can then be reinstated once the new credit is obtained.
- The Downside: It affects your ability to obtain instant and new lines of credit. The thawing process does not always go smoothly (based upon our feedback from actual callers into the ITRC call center) and it can take longer than anticipated. You now must remember another PIN number, but it’s critical that you don’t lose or forget it, or have it fall into the wrong hands. If it falls into the wrong hands, it could be used to commit identity theft. If you forget it, the process to have a new one issued is extremely tedious, slow and not every state will allow it. It is not free to everyone, only victims of identity theft. Consumers that want to place a freeze that are not victims of identity theft will generally have to pay a fee that is different from state to state.
If someone is not yet a victim of identity theft they can take one of the above steps to help minimize their risk. Individuals must make certain that they understand the difference between these options and how they will affect them.
When the ITRC is providing assistance to recipients of data breach notification letters, we frequently have consumers asking us which one they should choose. They often state: “Just tell me what to do and I’ll do it.” Unfortunately, it’s not that simple in this case and it really is a decision ultimately left up to the individual. We try to provide consumers with enough information about each process so they can make an informed decision. We caution people to understand that if they freeze their credit before they themselves have checked it for fraudulent activity, then won’t be able to check it until they unfreeze it.
Are you a younger person, in the process of buying a home, or establishing new lines of credit? A freeze is going to make the process more tedious and in the case of purchasing a home, could delay the process. The fraud alert may be the better, less intrusive option for you.
Do you own your home, are not planning to move or refinance, and you have an established credit profile that you are not looking to build on a regular basis? A credit freeze might be the better alternative.
The first wave of panicked callers from Akron has now subsided. The second wave of callers has started. Some have discovered they are actual victims, while others are still struggling a bit to understand the complexity of the situation. One caller couldn’t remember his PIN and asked for assistance, thinking that we had issued it to him. That last example illustrates the point:
It’s crucial to understand the difference between these actions if you are a victim of identity theft trying to stop the progress of a thief, or if you a consumer trying to minimize your risk. Make sure you understand how the process will affect you in the future.