So the FTC announced the Equifax settlement yesterday and I spent about twenty minutes doing math I didn't want to do.
Quick recap for anyone who's blocked this whole saga out since 2017: Equifax let hackers walk off with the Social Security numbers, birthdates, and addresses of something like 147 million people, and now, almost two years later, there's a settlement. Up to $700 million total, which sounds enormous until you start reading the fine print, and I mean that literally, I read the fine print at 11pm last night instead of going to sleep like a normal person.
Here's the part everyone's texting each other about today. If you were affected (and you almost certainly were, go check eligibility.equifax.com if you haven't), you get a choice. Option one: free credit monitoring for four years, extendable to six. Option two: instead of the monitoring, you can take a cash payment of up to $125.
$125 sounds like a decent little consolation prize for having your identity theft risk permanently elevated through no fault of your own. Except the cash option isn't funded out of the $700 million headline number. It's funded out of a separate $31 million pool set aside specifically for people who decline the monitoring. Do the division: $31,000,000 divided by $125 is 248,000 people. There are 147 million eligible claimants. If even a couple million people click the cash option instead of the free monitoring, that $125 collapses into single digits, fast. I've seen people on Twitter already doing the same napkin math and landing on estimates as low as $5 or $6 per person once the pool actually gets divided up.
Nobody advertised it that way. The headlines yesterday all said "up to $125," which is technically true the way "up to 50% off" is technically true when exactly one item in the store is on sale. I don't think this is some grand conspiracy, I think it's just how these class action settlements always get structured, lawyers negotiate a number that sounds good in a press release and the actual math gets buried four pages into a claims administrator's FAQ. But it still annoys me, because the people most likely to take the cash option instead of the monitoring are probably the people who need the $125 more than they need four years of a service they'll forget exists by September.
My own plan, for what it's worth: I'm taking the credit monitoring. Not because I trust Equifax to run it competently (why would I, they're the reason we're here), but because I already pay for a monitoring service through my bank and free is free, and I'd rather not fight over a fiver.
Unrelated, sort of, but this has been a genuinely strange week to be paying attention to the news in general. Saturday was the 50th anniversary of Apollo 11, and I watched the CBS restored broadcast footage Sunday night instead of doing literally anything productive, which I don't regret even a little. And this morning I saw that India launched their Chandrayaan-2 mission toward the Moon, after scrubbing the original July 15th attempt over a fuel leak they caught with an hour and a bit to spare on the countdown clock. If it lands successfully later this year it'll be India's first attempted soft landing, and only the fourth country ever to pull one off. Feels like a weirdly fitting week for that news to land in, right on the anniversary.
Anyway. If you haven't checked whether your data was part of the Equifax breach, go do it, it takes about ninety seconds and it's worth knowing either way. And if you're doing the settlement math yourself: monitoring, not cash, unless you genuinely have no use for the monitoring and you're fine with a payout that could be a tenth of what the headline promised. I'll believe the actual per-person number when the claims administrator publishes it, and I'd bet real money it's nowhere near $125.