Note: This column was originally published on Sept. 16th, so time references are from that date. I continued to update this column nearly daily through 9/25. I have published a new column with the most up-to-date information on 9/29 and in the paper on 9/30. All updates from 9/29 forward will be on the newest column. You can read that here.

What a week it’s been since news broke last week that Equifax — one of the three major credit reporting agencies that hold our most sensitive information — was hacked.

When 143 million people or more try to go online or call to place credit freezes, you can imagine what happened.

Some reported no problems. But plenty across the country have run into issues, either not being able to get through online or via phone or being told they have to mail their documents to place the freeze.

All three credit bureaus have said their online and phone systems have been overwhelmed. Keep trying. If you do have to use mail, send document copies via some sort of certified mail.

To add to the mess, Equifax media relations isn’t answering questions or only limited ones, so that’s been leaving journalists to resort to watching Equifax’s website or Twitter feed for dribs of updates. Update 9/25: Equifax last week was finally better about answering media email questions, though I had to send several responses back and forth to get the specifics clarified for the questions I was asking. I will keep trying.

I have been updating my column from last Saturday’s paper nearly daily with new information. I will round up the most important things here. You can re-read last week’s column and a second one with tips at https://tinyurl.com/ycd6dksj. (The original column is still helpful for some basics that I didn't get to here - all future updates will be on this column)

You can find out if you were part of the breach at https://www.equifaxsecurity2017.com.

I can’t make this any clearer: Freeze your credit reports. Whether you were included in this Equifax data breach, breaches are so prevalent now that everyone should have a freeze. Spouses also have individual credit files, so you must freeze individually.

A freeze does not affect your current credit or accounts. A freeze blocks everyone, including you, from gaining new credit until you “lift” or “thaw” it with a special PIN number. I have had a freeze for years. It is not hard. I can go online or call and within minutes lift my credit, if I need to open an account.

You wouldn’t think to have a house with no locks. A credit freeze is locking your financial house. You hold the keys.

The free credit monitoring service, TrustedID, that Equifax is offering for one year is fine. But using my same analogy, that service will tell you that someone has just robbed your house or tried to rob your house. If your doors are locked, you have more protection. The free product is also only for one year; a freeze is permanent until you lift it.

It’s also important to lock all of your doors, so get a credit freeze for yourself and your spouse at all three major credit bureaus, Equifax, Experian and TransUnion.

I have received several inquiries about a fourth, lesser-known bureau called Innovis. When I asked Eva Velasquez, the CEO of the Identity Theft Resource Center about Innovis, here’s what she said: “There are many, many specialty credit reporting agencies, too many for consumers to manage independently. We focus on the big three because of how they are integrated into our financial system thus most transactions will be funneled through them.”

I went ahead and did a freeze at Innovis. It was easy and I was not charged. But I also won’t know that the freeze took place until I receive confirmation in the mail after it verifies my identity. Again, to be clear, at this point, Equifax is waiving the $5 fee (and refunding consumers who paid already), but Experian and TransUnion will still charge you $5. There are advocates trying to push for Equifax to pay consumers back for those other fees, but until that happens, you will still be charged $5 per freeze at the other two.

Update 9/19: The Identity Theft Resource Center has started an online petition to try to convince the CEOs of the credit bureaus to make all credit freezes free. You can see more information and information on what to do after a breach at: https://www.idtheftcenter.org/equifaxdatabreach

Credit freeze contacts

Update 9/19: All of the bureaus are reporting experiencing overwhelmed online and phone systems. Keep trying; people have said they have been able to get through after it not working. Try online first and then do phone, which is an automated system (and sometimes hanging up on people). If you’re calling, try at odd hours. If you do have to resort to mailing documents, make copies of your driver’s license, your Social Security number and a utility bill showing your address and mail via certified mail or registered mail.

•?Equifax: 800-685-1111, Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348-5788 or https://www.equifax.com/CreditReportAssistance (Update 9/25: See below for more information about the Equifax Credit Lock and how that is different from the Credit Freeze. I would still do the Credit Freeze.)

•?Experian: 888-397-3742, Experian Security Freeze, P.O. Box 9554, Allen, TX 75013 or https://www.experian.com/freeze/center.html

•?TransUnion: 888-909-8872, TransUnion, P.O. Box 2000, Chester, PA 19016 or https://www.transunion.com/securityfreeze (Update 9/18: TransUnion is offering its own version of a credit freeze, called TrueIdentity and says its free. I’m not completely sure what it is and personally feel more comfortable doing a straight credit freeze, even if it would cost me $5.)

•?Innovis: 800-540-2505 or https://www.innovis.com/personal/securityFreeze

Other notes

•?Free TrustedID product from Equifax and delays in signing up: Many people, including myself, are unsure whether enrollment in the free TrustedID product went through since we were supposed to get a confirmation email to complete the loop. I’m still waiting and I have looked in my spam. I can only chalk it up to Equifax falling behind. The most important thing to me is that you get a credit freeze. If the free product comes through, that’s a bonus. Sen. Sherrod Brown, D-Ohio, also is drafting federal legislation to try to force Equifax to offer this product for 10 years instead of one and to make credit freezes at all bureaus more affordable (I vote that they should be free. Costs vary according to state; in Ohio it is $5 each.)

Update 9/22: I did finally get my email confirmation for the TrustedID product, but only after I re-enrolled after several days of not receiving an email. After several back and forth emails asking for, and not receiving the answers to my questions, I have finally gotten clarification on the difference between placing your own credit freeze with Equifax (free because Equifax is waiving it) and the free Credit Lock that is being offered within Equifax's free TrustedID program it is offering everyone. I will paste the answer about the difference between the two after this section. To me, it sounds like they are similar, but Equifax's credit lock within its TrustedID program must have some extra connections to Equifax and I'd just feel more comfortable placing the credit freeze since I know exactly what that is and there's no second-guessing.

Credit Freeze vs. Equifax Credit Lock? Also, I asked whether I could opt-out of the Equifax Credit Lock within the TrustedID program if I had a credit freeze because I want my credit freeze intact. I also just received that answer and will paste it below.

So bottom line -- I still recommend the Equifax Credit Freeze (use the URLs above or the phone number) and not the Credit Lock. The Credit Freeze would also be permanent until you lift it, while the  Credit Lock I would assume expires after your free year.

Here's Equifax's explanation of the differences:

We recommend that consumers choose the option that best suits their credit activity.

Security Freeze: A security freeze prevents new creditors from accessing a consumer’s credit report unless they lift or remove the freeze, either temporarily or permanently. The nationwide consumer reporting agencies may charge consumers for placing or removing freezes depending on state law. A consumer will need to contact each nationwide consumer reporting agency to place or remove a security freeze.

 

File Lock: An Equifax credit file lock is similar to a security freeze and allows consumers to lock access to their Equifax credit report. Lenders cannot access their Equifax credit file to open new accounts unless they unlock their file. However, when consumers lock their Equifax credit file, it does not lock their credit file at the other two nationwide consumer reporting agencies. The lock feature is available within the complimentary TrustedID Premier product Equifax is making available to U.S. consumers.”

And here's Equifax's explanation about whether I must have the Credit Lock within the TrustedID product since I want to keep the Credit Freeze.

“If a consumer decides to place a security freeze on their Equifax credit report, they can still use all the features in TrustedID Premier with the exception of the Lock/Unlock feature.  A security freeze will not allow the consumer to lock or unlock their Equifax credit report through TrustedID Premier until the security freeze is lifted.”

•?Equifax is waiving its $5 fee and will automatically refund anyone who paid for a freeze since Sept. 7. The other two bureaus are competitors, so they don’t have to waive their fees for Equifax’s mistake. Ohio Attorney General Mike DeWine on Friday joined 31 others across the country in urging Equifax to offer reimbursements for placing freezes with other bureaus, in addition to other requests for better service after the breach.

• The controversial arbitration clause:?Last week, consumer advocates raised concerns about a forced arbitration clause for its TrustedID product. Equifax removed that clause from the fine print.

•?Minor children and the hack: My 14-year-old is supposedly affected by this breach, though children are not supposed to have credit files. When I tried to sign him up for TrustedID, it said he had to be 18. I have also discovered that Ohio law only allows parents to place a credit freeze until the child turns 16, at which time the freeze automatically rolls off. (Last week, I erroneously said Ohio didn’t have this law). But in trying to set an online freeze for my 17-year-old, I couldn’t because she’s not 18. So it seems there is a black hole for 16- and 17-year-olds. I have alerted both Brown and DeWine to see if there might be a fix. Both said they’re looking into it. In the meantime, I will send via certified mail all of the documents to try to freeze credit for both children. I’m hopeful they will work, but have a feeling it will take a long time to process and I wonder if one will be rejected.

A DeWine spokesman suggested that Ohio law may allow for 16- and 17-year-olds to count as “adults” and suggested that I include written permission in my paperwork from my child to me to place the freeze. Yeah, sounds absurd to me, but I’ll do it to try to avoid a rejection.

This all just makes me feel stronger that as a consumer advocate and parent, I encourage Brown and DeWine and others to close this loophole and make an already-hard process for parents to place credit freezes for children by mail to include all children under 18 — or even better, online.

• 9/18 update: Here are links to information about placing minor child credit freezes and what documentation you need to mail in (remember, mail copies and some type of certified or registered mail):

• Equifax: https://www.freeze.equifax.com/Freeze/jsp/SFF_FrzMinorChild.jsp

• Experian: http://www.experian.com/fraud/form-minor-child.html

• TransUnion: https://www.transunion.com/fraud-victim-resource/child-identity-theft (updated 9/29: This link will allow a parent to input some information online to get an email verification saying whether there is a credit file in existence for the child.)

• Innovis: https://www.innovis.com/personal/lc_minorsProtected (Update 9/21: The mailing address to mail minor credit freeze requests is not online. Here is the address I received directly from Innovis: Innovis Consumer Assistance, P.O. Box 26, Pittsburgh, PA 15230-0026. Also, according to an Innovis spokesman, Innovis will allow a parent to place a credit freeze for a minor under 18, regardless of state law.

• Update 9/21:

* PIN number problems: Many consumers are reporting that when placing an Equifax credit freeze online or by phone, they have either missed the PIN number assigned to them, or it didn't show up. There seems to be conflicting information about what to do next. Some readers report that when they call, they've been told a PIN number will be mailed to them. Equifax on its website and via a spokeswoman are saying they are not mailing PIN numbers to anyone who placed a freeze online and that information is on the screen or a phone number is displayed. However, the Equifax spokesperson would not provide me with the phone number (I'm still asking and don't have an answer as of 9/22, despite multiple requests for clarification). Anyone who placed the freeze over the phone or via U.S. mail will get the digit mailed to them. I'm still pushing for clarification.

Update 9/22: If you placed a credit freeze online and did not get your PIN or if you called and didn't write it down quick enough, here is the number to call to request a new PIN, according to an Equifax spokeswoman (listen to all of the prompts so you can ask for an agent. I tried and it said there are longer than usual hold times, so you may have to wait awhile.):

If a consumer wishes to receive a new PIN, they must call (866) 349-5191 to speak to a live agent; provide identity verification information; and receive a replacement PIN

Update 9/25:

*Credit Freeze for college grads? I received a question from a recent college graduate asking whether a credit freeze would affect his ability to rent an apartment or get a job. That's a good question and a good point.  He also wondered if he should do a Fraud Alert.

Here's what I told him: Good question to bring up. Credit freezes do ice out everyone - so that includes anyone you don't give permission to and could impact a rental search or a job search. So that's something to weigh, but it'd also be really bad if as you are trying to establish yourself after college someone steals your identity.
My best advice would be probably to do the freeze, but you can usually track down which bureau you'd need to lift when you ask the potential employer or rental agency or car dealer which bureau they use to check credit. Most will know and then you can pay the $5 to lift that particular one, or if they don't know, then blanket temporarily lift with all 3 for a period of time (though that's like leaving your house unlocked). I know neither option sounds great but the protection rules feel like they've changed just because the hacks have gotten more prevalent.
Here's a little fact sheet from the FTC and it does say the same. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs
P.S. Fraud alerts are worthless, in my opinion. They're 90-word statements on your credit report, but that means you're relying on the potential creditor to look at the 90 words to say "oh, I should be careful to see if this is really the person." Realistically, they're not going to do that - they want to sell the car, etc. That's why the freeze is the way to go - you hold the keys.

*Some more information from Equifax about TrustedID and the delay in getting confirmation emails and next steps:

I received two emails from Equifax to my personal email after I signed up originally for the TrustedID and never got a confirmation email and then another with the confirmation email after I went online and signed up again. Here's the information:

#1: (Email about not getting the email):

We recognize you may not have received your activation email for TrustedID Premier. We apologize for the delay and assure you we are working diligently to send your activation email as quickly as possible.

To help you know what to expect moving forward, we have included a description of the TrustedID Premier activation process below, which explains the steps you should take once you receive your activation email.

What to expect next: You will receive an email from "Trusted ID Customer Service" [no-reply@trustedid.com] which will clearly state "Your Activation Email is Here." Please be sure to check your junk or spam folders in case the email was filtered to those mailboxes.

When the email arrives, you will be asked to answer some questions about yourself to verify your identity so that you can complete your enrollment in TrustedID Premier. During the initial enrollment process, if you provided us with a valid mobile number that we can confirm, you may be given an option to validate your identity through a PIN or passcode that will be sent to your mobile phone.

Once you have gone through the process of verifying your identity, you will be able to create a unique password so you can quickly and easily log in to TrustedID Premier to begin your credit monitoring service, and lock and unlock your Equifax Credit File.

We appreciate your patience, and please know we are doing everything we can to make the experience faster and more convenient for everyone.

#2: (Confirmation email I finally received from Equifax). Be careful of phishing or fake emails. This one came from a TrustedID and the link went to a TrustedID website and asked for further verification:

It is time to take the final steps in enrolling in your free product, TrustedID Premier, by verifying your identity. To do this, you’ll need to answer some questions about yourself. Successfully completing this step will conclude your enrollment process and activate your product.

(Then it gave me the verification link)

This link will remain active throughout the enrollment period, which expires on Monday, November 20, 2017.

If you did not request this email or if you have any questions, please contact us
at 877-742-1415.

*Social Security worries: I had mentioned in an earlier email that if you place a credit freeze, you will have to lift your freeze in order to establish an account with MySocialSecurity. A reader has also questioned whether hackers can create their own accounts in your name before you do. I don't know all of the details of what you need besides your Social Security number to establish your online account and I am checking and will update. Eva Velasquez, CEO of the ID Theft Resource Center said it could be a good idea for people to proactively establish their MySocialSecurity account so they're in control. But does that mean a 20 year old should establish one now when they won't need it for years? (Or maybe they could use it to periodically check up on their Social Security earnings). There is also an option to freeze or block access to your Social Security. I am trying to check more into this -- it is possible by doing so, you would also lock yourself out of your own account. I will post updates as I get them.

 

 

Betty Lin-Fisher can be reached at 330-996-3724 or blinfisher@thebeaconjournal.com. Follow her @blinfisherABJ on Twitter or www.facebook.com/BettyLinFisherABJ and see all her stories at www.ohio.com/betty