So Equifax dropped a real bomb on us this afternoon: a breach that reportedly touches something like 143 million people in this country, exposing Social Security numbers, birth dates, addresses, and in some cases driver's license numbers. The intrusion apparently happened between mid-May and July, and they're only telling us now, in early September. I found out from a text my sister sent me that just said "did you see this," no context, because that's apparently how we get breaking news now.
I'm not going to spend this whole post being outraged, mostly because outrage doesn't freeze your credit for you. I spent about ninety minutes tonight actually doing the thing everyone should be doing right now, so let me just walk through it while it's fresh, coffee gone cold next to the laptop, one kid yelling that he can't find his other shoe.
Freezing your credit is not the same as "credit monitoring"
Equifax is going to push you toward their own free monitoring product, and I'd be careful there. A freeze is different, and it's the thing that actually stops someone from opening a new account in your name, because it blocks lenders from pulling your file at all unless you unlock it first. Monitoring just tells you after the fact that something already happened. I want the door locked, not a very polite doorbell camera.
You have to do this at all four bureaus, not just Equifax
This is the part nobody tells you. There are four major consumer reporting agencies, not three like everyone assumes:
- Equifax
- Experian
- TransUnion
- Innovis (the quiet one nobody remembers exists until nights like tonight)
Freezing only Equifax because that's whose name is in the headline does basically nothing, since a thief can just apply for credit that gets checked against Experian instead. You have to call or go through each one separately. Each has its own site, its own hold music, its own slightly different process, and none of them talk to each other, obviously, because why would anything be convenient.
What it actually costs
Depending on your state, each bureau can charge a fee to freeze and another fee to lift it later, usually somewhere in the $5 to $10 range per bureau, though some states require it be free if you're already a confirmed identity theft victim. So budget maybe thirty or forty bucks total if you're not in one of the free states. Yes, we are all about to pay money because a company lost our data. I don't have a clever line for that, it's just genuinely how this works right now.
Keep the PIN or password each bureau gives you somewhere that isn't a sticky note on your monitor. You'll need it the next time you actually want a loan or a new credit card and have to temporarily thaw the freeze.
A small complaint
Equifax's own breach-check site tonight asked me to enter part of my Social Security number to find out if my Social Security number had been stolen, on a page that looked like it was thrown together over a long lunch. I'm not a security researcher, I just write a blog, but that did not inspire confidence. I typed it in anyway because what else are you going to do at 9pm on a Thursday, but I closed the tab feeling worse than when I opened it.
I did this exact routine two years ago after the Anthem breach, and it genuinely feels like we're just going to keep doing this every year or two indefinitely, a little ritual where a company loses a database and we all go call four bureaus and read our SSNs out loud to automated phone trees. Somewhere there's a version of this where the freeze is free and automatic and doesn't require forty dollars and a rolodex of PINs, but that's not the version we've got tonight.
If you haven't done this yet, don't put it off till the weekend. Go pull up all four sites, keep a notepad open for the confirmation numbers, and just grind through it one at a time. It's tedious but it's maybe an hour of your evening against months of cleanup if someone opens a card in your name in October.