Equifax is finally taking real steps to help consumers who are the victim of its catastrophic data breach: On Wednesday, the company’s interim CEO said the credit bureau will offer a free lifetime service that will let customers lock and unlock their files.
The proposed service, which Equifax says will be ready by January 31, is better than its initial response, which consisted of a broken breach-detection tool and an offer to freeze customers’ credit for one month. In the company’s words:
The service we are developing will let consumers easily lock and unlock access to their Equifax credit files. You will be able to do this at will. It will be reliable, safe and simple. Most significantly, the service will be offered free, for life.
If this new free “lock and unlock” service works as Equifax claims, it will be a vast improvement over the current credit freeze process. That process—which security experts are urging customers to implement—means no one can see your credit report, which makes it much harder for identity thieves to open a new account in your name.
While the current credit freeze system is helpful, it has two big drawbacks: First, it’s inconvenient because it typically requires phone calls and a PIN number to use, and it can also take time to lift the freeze—which can a nuisance if a lender or a landlord needs your credit report on short notice. Second, it’s not free. To freeze and unfreeze credit requests, consumers must pay a small fee not just to Equifax but two other credit bureaus, Experian and TransUnion.
Equifax’s latest offer, then, addresses the cost problem. It also seems to solve the inconvenience issue—if consumers can use the Internet to flip access to their credit on and off, putting in a freeze is no big deal.
So what’s not to like? Well, for one thing, it’s doubtful Equifax has the technical chops to pull this off and do it in a secure way. The company has already displayed staggering incompetence in letting hackers steal personal information from over 143 million people in the first place, and then providing a broken and insecure website for customers to see if they had been breached. It seems optimistic to believe Equifax can now build a “reliable, safe, and simple” by January.
Get Data Sheet, Coins2Day’s technology newsletter.
Likewise, as the personal finance columnist for the New York Timespoints out, Equifax has not explained some key details about its proposal. For instance, the company appears to be making a distinction between credit “locking” and “freezing.” What’s the difference? Skeptics of the credit bureau industry, who claim the companies use breaches as an opportunity to sell consumers’ dubious credit monitoring services, might fear the Equifax offer is part of a future business plan rather than a bona fide protection system. Likewise, the Times points out Equifax hasn’t said if it will make consumers waive their rights to sue as a condition of receiving access to the credit lock tool.
Finally, even if the Equifax proposal meets all of these objections, it will only serve a third of the problem—remember consumers must still pay to implement freezes at the two other credit bureaus. Why doesn’t Equifax, then, work with the other companies to create a single portal where consumers can control access to their credit?
Expecting such a solution is probably too optimistic. After all, Equifax and the others make money by selling access to your credit score to lenders and others. They don’t have an incentive to make credit freezes free and easy.
That’s why those hoping for a genuine fix may wish to hold out for a new law, like the one proposed by Sen. Elizabeth Warren (D-Mass.) And Brian Schatz (D-Hawaii), which would limit the power of the credit bureaus, and give consumers real control over their data.
The other alternative is to wait and trust Equifax will do the right thing. But we know how that turned out in the past.