Equifax Data Breach

Check back for updates as more information is available.

The Federal Trade Commission (FTC) has opened an investigation into the Equifax data breach disclosed in September 2017.

American Federal works hard to help you protect your personal and business information.

This website post is intended to help you consider your options to monitor your credit and to guard against identify theft.

The Equifax Data Breach

What is Equifax and what does it do?

Equifax is a credit bureau, not a bank.
Equifax is one of three major credit reporting agencies in the United States. It handles the data of 820 million consumers and more than 91 million businesses worldwide. It is headquartered in Atlanta, Georgia.
Credit reporting bureaus are subject to the consumer data privacy rules under the Gramm-Leach-Bliley Act. The FTC enforces these rules for nonbank companies.

What is a Credit Bureau?

A credit bureau is a company that collects and maintains information relating to the credit of individuals and makes it available to lenders, creditors and consumers in the form of a credit report. While there are dozens of credit bureaus across the United States, most consumers are familiar with the three major credit reporting agencies: Equifax, Experian and TransUnion.

What is a Credit Report?

A credit report provides detailed information on how an individual has used credit in the past, including how much debt an individual has and whether or not the individual has paid his or her bills on time.
A credit report includes personal information, including name, any aliases or misspellings reported by creditors, birth date, Social Security number, current and past home addresses, phone numbers and current and past employers. Public records are reported, including court judgments, bankruptcies and tax liens, and recent inquiries of who has asked to view an individual’s credit report and when.
Each of the three credit bureaus may have different information about an individual. Creditors are not required to report information and may not furnish data at all, and, if they do, it may only be to one or two of the credit bureaus.

Who can check a Credit Report?

The Fair Credit Reporting Act limits who can view an individual’s credit report and for what reasons.
Individuals are entitled to review the information on their own credit reports.
When a consumer applies for credit, including credit cards, auto loans and mortgage loans, lenders check an individual’s credit report to make decisions about whether or not to grant credit to the individual. Lenders must have permission to check an individual’s credit report for an application on new credit.
Landlords, insurers and employers also may request to review an individual’s credit report. All must have an individual’s permission to check a credit report.

How did hackers get Equifax information?

On September 7, Equifax announced that the records of approximately 143 million Americans were breached sometime between May and July of this year, reportedly affecting 44 percent of the U.S. population.
While Equifax and law enforcement authorities continue to investigate the data breach, Equifax confirmed that attackers entered its system in mid-May through a web-application vulnerability that had a patch available in March.
The records contained names, birth dates, addresses, Social Security numbers and some driver’s license numbers. At this time, it appears hackers did not gain access to full credit reports.
In addition to the personal information accessed, some 209,000 credit card numbers and dispute documents with personal identifying information for about 182,000 people were reportedly obtained.
On September 18, Equifax further acknowledged that it faced a security issue earlier this year that is separate from the breach that has dominated headlines in the recent weeks. Equifax said the first event involved a payroll-related service, which came to light during tax season.

Was my information stolen?

Today, we do not know. However, given the magnitude of the data breach, if you have a credit report, there is a good chance it was hacked by cyber criminals in the Equifax incident.
Do not wait for a written communication from Equifax. Assume your credit report information has been compromised, or may be in the future, and take steps to protect yourself.

Should I close my accounts and open new ones?

The largest risk posed by the Equifax data breach is the threat of identity theft.
Equifax has indicated that debit cards were not exposed – therefore, criminals are unlikely to have the ability to withdraw funds from a checking account.
Current accounts are probably at less risk than new loans or lines of credit being fraudulently opened in an individual’s name with stolen personal information.
It can be difficult for customers to prove they did not open a new credit card and refuse to pay charges on a bill. Credit monitoring services and good practices to safeguard your personal information can help prevent identity theft.

What is Equifax doing to correct the data breach?

Equifax has directed consumers to visit its dedicated website at https://www.equifaxsecurity2017.com/ to determine whether their information was compromised and to enroll in Equifax’s free credit monitoring program, TrustedID Premier. The website also provides specific details of the data breach incident which is under investigation by the Federal Bureau of Investigation (FBI) and the Federal Trade Commission (FTC).
Equifax also set up a dedicated call center — Equifax Response Line — to answer consumers’ questions; however, consumers report long wait times due to high call volumes. Dial 1-866-447-7559.
Equifax is offering free credit file monitoring and identity theft protection to all U.S. consumers for one year following the data breach, regardless of whether a consumer was impacted.
Consumers do not need to provide credit card information to enroll.
Equifax announced September 27 that it will offer a free lifetime service that will let its customers freeze and unfreeze their Equifax credit files. The new service is expected to be ready by January 31, 2018.

[peekaboo title=”Options to Protect Your Credit” display=”hide” style=”big”]

A consumer does not need to choose a single option. Choose the options that best suit your credit activity. There are benefits and implications with each option, and in some cases a cost.

Enroll in Equifax Services

Equifax is offering one year of free credit monitoring and other services, whether or not your information was exposed. You can sign up at https://www.equifaxsecurity2017.com/. Scroll to the bottom of the page and click on “Potential Impact,” enter some requested personal information and the site will tell you if you have been affected. Use a secure network (not public Wi-Fi) when you submit sensitive data over the Internet.
If you have an account with Equifax, change the password for it immediately. It is always a good idea to change a password after a data breach. When doing so, be certain it is a “strong” password (a combination of capital and lower case letters, numbers and symbols), and not used on any other site. While in the account settings changing your password, enable two-factor authentication, if you have not already.

Monitor your Credit Report

Order a free copy of your credit report from any of the three credit bureaus — Equifax, Experian and TransUnion — at www.annualcreditreport.com. Unfamiliar accounts or activity could indicate identity theft.
You are entitled to one free report from each of the credit bureaus one time each year. Monitor your credit report for suspicious activity throughout the year by spreading out your credit reports. Request a credit report every four months from a different credit bureau and continue to do so. Theft of personal information will continue to be an ongoing threat for consumers.
Credit monitoring services do not prevent an individual’s identity from being stolen. A credit bureau will alert an individual if someone tries to obtain credit with the individual’s information. Essentially, it gives the individual a “heads up” right away so the individual can take action to remedy before it gets worse.
Identity theft protection services, which also are offered by Equifax, will help an individual through the process of correcting any fraud, but again will not prevent it from happening.
Monitor the credit of children. In theory, children under 18 should not have a credit report because they are not considered consumers for purposes of credit reporting. However, studies have found that children have had information accessed in an unauthorized manner. If you find a report for a child on file with a credit bureau, investigate it and the possibility of fraud using the child’s information.

Read the Fine Print

There was some initial controversy about signing up for the free credit monitoring and the identity protection services offered from Equifax. Customers may be skeptical about taking Equifax up on its offer.
If you enroll in free crediting monitoring, be sure to read the fine print for any service you sign up for, no matter what the service is doing.
In the Equifax case, there was initially some detail that required those who chose to use the service — TrustedID Premier — to pay for the service automatically once the free term expired. However, that clause has since been removed from Equifax’s Terms of Service with respect to this breach. Individuals can sign up and take advantage for free; however, still read the Terms of Service thoroughly and do not expect this to completely protect against identity theft.
If you are still hearing that signing up for the credit monitoring service will exempt you from any class action lawsuit that may arise, that has changed, too. Equifax has removed that language from its Terms and Conditions, so you can now take advantage of the service without worry.

Consider a Credit Freeze

Equifax has agreed to waive all credit freeze fees for the next 30 days for people who want to freeze their Equifax credit files.
Equifax announced September 27 that it will offer a free lifetime service that will let its customers freeze and unfreeze their Equifax credit files. The new service is expected to be ready by January 31, 2018.
A credit freeze, also known as a security freeze, will prevent credit from being taken out in your name. It blocks any attempt to access credit and the credit bureaus will alert you if someone tries.
A credit freeze is recommended for those who have had their Social Security numbers stolen and who are not applying for credit in the near term. That is because a freeze will do just that: freeze access to your credit so no one can access your report, unless you remove the freeze, either temporarily or permanently.
If a time occurs where you will need to provide access to your credit for some reason, a credit freeze can be lifted and then reapplied, if needed.
After receiving a freeze request, a credit bureau will send a confirmation containing a unique PIN (personal identification number). It is important to remember the PIN and not lose the PIN. Keep the PIN in a secure place. You will need the PIN, if you choose to lift the credit freeze.
An important detail about taking advantage of any credit monitoring service is that if there already is a freeze on your credit, the credit monitoring service will not work. This is because the credit bureau will need to access your credit report in order to monitor activity. However, do not unfreeze your account just to sign up for a service. If the third party cannot access your file because it is frozen, then the credit freeze is doing what it is intended to do.
Before you place a credit freeze on your accounts, consider your personal situation. Renting an apartment, getting quick credit in an emergency, taking advantage of a one-time offer, or even getting a cell phone or insurance, all require quick access to your credit report, which is restricted during a freeze.
Freezing your credit files has no impact on your existing lines of credit, such as credit cards. You can continue to use them as you regularly would, even when your credit is frozen.
Check the fine print to learn how much lead time is needed to unfreeze a credit report. You would need to contact each credit bureau to place or remove a credit freeze.
A credit bureau may charge consumers for placing and or removing a credit freeze, depending on state law.
Equifax has agreed to waive all credit freeze fees for the next 30 days for people who want to freeze their Equifax credit files.

Consider a Fraud Alert

A fraud alert is a notification on your credit report that warns creditors that you may be a victim of identity theft. If you expect to apply for credit soon or think you might need quick credit in an emergency, it may be better to place a fraud alert on your files, rather than a credit freeze.
A fraud alert is a red flag for creditors considering extending you credit. Fraud alerts are free and still allow third parties access to your credit reports; however, if a fraud alert is on your credit report, a creditor will be encouraged to take steps to verify your identity before extending you credit, such as contacting you by phone.
Once a fraud alert is placed with a credit bureau, it is automatically placed with the other two major credit bureaus.
A fraud alert greater than 90 days requires a consumer to file a police report. However, your local police department may only take a police report if an account has been opened or your credit report was accessed by an unauthorized party. Simply being one of the 143 million affected by the Equifax data breach does not mean you can file a police report.

Evaluate Additional Protection

Keeping an eye on your credit is a healthy financial habit. You may want to consider an identity theft protection service to help you maintain control of your personal and private information through credit monitoring and alerts. Most of these services charge a monthly fee.
A number of products enable consumers to react and protect their information from evolving technological threats so they can stay on top of their credit. A variety of features monitor data points to quickly spot suspicious activity and help detect fraud, such as new accounts you did not open, fraudulent applications for various credit and non-credit related services, or hard inquiries into your credit made without your permission. If something shows up that looks untoward, the service takes steps to notify a subscriber and puts an end to whatever should not be on the consumer’s various accounts, or in the individual’s name.

[/peekaboo]

[peekaboo title=”Beware of Scams Related to the Equifax Breach” display=”hide” style=”big”]

Watch for scams related to the Equifax data breach. Do not trust emails or text messages that appear to come from Equifax regarding the breach. Attackers are likely to take advantage of the situation and send phishing emails.

Criminals are using a simple phone scam to fool consumers into handing over their personal information. Do not give personal or financial information, unless you initiated the call and it is to a phone number you know is correct. Do not trust caller ID. Scammers can spoof their numbers so it looks like they are calling from a particular company, even when they are not. If you get a robocall, hang up. Do not press 1 to speak to a live operator or any other key on the number pad to take your number off the list. If you respond by pressing any number, it will likely lead to more robocalls.

Watch for phony websites claiming to have “inside” information about the Equifax breach and websites that claim they can give you more information about the breach for a fee.

[/peekaboo]

[peekaboo title=”Guard Your Social Security Benefits and Medicare Card Number” display=”hide” style=”big”]

If you are receiving Social Security benefits, make certain your payments continue to arrive as scheduled. If you see a benefits payment missing, report it immediately. Retain all documentation you receive from the Social Security Administration so that if you do end up needing to prove that you are who you claim to be, you will have the paperwork in place.

If you are not yet collecting benefits, it also is important to be hyper vigilant. If you are not regularly receiving income from Social Security, you have less of an indication that something is amiss than someone who clearly does receive a benefits payment. On the other hand, if someone attempts to file for benefits on your behalf, and you have records dating back to an earlier period than that, you may have an easier time convincing the Social Security Administration that you have been victimized.

Retirees who are enrolled in Medicare should remember that it will not be until 2018 that Medicare will start replacing Social Security numbers as the identifying number on Medicare cards. Retirees enrolled in Medicare should guard the privacy of their Medicare cards as much as possible. Because the Medicare number is the same number as a Social Security number, retirees should be mindful of someone attempting to access the retiree’s Medicare benefits. On the list of organizations asking for the Social Security number who do not really need it are medical providers. While they often routinely ask for it as an identified, they do not need it. Retirees should ask if they can provide other identification.

[/peekaboo]

[peekaboo title=”File Your Taxes Early” display=”hide” style=”big”]

The Federal Trade Commission (TFC) warns consumers to file taxes as soon as they have the tax information they need — before a scammer can. However, filing your taxes early, does not require a taxpayer to pay any balance owned before April 15^th. Tax identity theft happens when someone uses a Social Security number to get a tax refund or a job. Respond right away to letters from the Internal Revenue Service (IRS). Do not provide information or account numbers in response to calls, emails or texts.

[/peekaboo]

[peekaboo title=”What is American Federal Bank Doing to Help?” display=”hide” style=”big”]

At American Federal, we take the security of our customers’ personal information seriously. We use a combination of safeguards to protect your information, including employee training, privacy policies, security standards and encryption systems.
American Federal uses a fraud detection service to monitor customers’ ATM and debit card transactions for potential fraud 24/7 by detecting purchases outside a customer’s normal spending pattern.
In the event of a fraudulent transaction, consumers are protected against losses. When a customer timely reports an authorized transaction, the bank will cover the loss and take measures to protect a consumer’s account.
We will continue to keep clients updated on the Equifax data breach and provide assistance to customers. If a client is unable to reach Equifax by phone or does not have a computer, an American Federal Banker will walk a client through the Equifax website at the bank.
Contact your local American Federal Banker, if you suspect fraudulent transactions on your accounts.

Expect Knowledge-Based Questions

Customers should be prepared for more “out-of-wallet” questions when they call or email their bank or other businesses. An individual with unauthorized customer information can pose a problem for the customer and the business.

Out-of-wallet questions, sometimes referred to as knowledge-based authentication, are considered a higher level of identity verification to help verify customers are who they say they are. Out-of-wallet questions are different from the more commonly-known challenge questions of “what’s your mother’s maiden name” or “name of your favorite sports team.” Instead, the questions are speciifc to the customer’s actual accounts or activity, such as “Can you tell me the amount of your last deposit?”

[/peekaboo]

[peekaboo title=”How to Freeze, Unfreeze Your Credit” display=”hide” style=”big”]

After a major data breach, some consumers consider freezing their credit reports. If you do not need access to your credit report right away, you may want to consider a credit freeze.

Social Security numbers cannot be replaced like a credit card number. Credit cards can be replaced and in your hands quickly; however, your Social Security number is with you for life. It can take years and can be costly to clean up your credit if your Social Security number is compromised. And, it can happen more than once in your life time.

Freezing your credit is an option to prevent new accounts from being opened with your Social Security number; however, it does not protect existing bank accounts or credit cards. This is where credit monitoring services can be helpful. Credit monitoring keeps an eye on your personal information and current accounts and alerts you to new activity.

What is a Credit Freeze?

A credit freeze, sometimes called a security freeze, will prevent anyone from viewing your credit file and reports on opening credit in your name. When you apply for a credit card, a loan or even rent an apartment, you are evaluated based on your credit file. The freeze prevents the credit information from being released from the three major credit bureaus.

Requesting a Freeze

Contact each of the three major credit bureaus independently to request a credit freeze. Visit their websites to request a credit freeze or contact them by phone at the numbers listed on their websites. Some states allow the credit bureaus to charge a fee for a credit freeze.
In the wake of its data breach, Equifax announced September 27 that it will offer its customers a free lifetime service that will let customers freeze and unfreeze their Equifax credit files. The service is expected to be ready January 31, 2018.

Information You Will Need

To place a credit freeze, the credit bureaus will ask for information, such as:

Your name
Your Social Security number
Your date of birth
Your current address
Your former address
A payment card, in some cases
A PIN that you choose to lift or reapply a freeze

Freezing and Unfreezing your Credit File

You can still get access to your file after a freeze is put in place. You must contact the bureaus to do so. Check with each credit bureau to determine the lead time that is needed to temporarily unfreeze and refreeze a credit file and if there is a fee associated with doing so. Be aware: this process may delay an approval for credit. Each credit bureau has three days to lift your freeze once they receive your request.

How Long Does a Credit Freeze Last?

A freeze will remain on your credit report until you lift it at each credit bureau you request a freeze.

Can a Hacker Unfreeze my Credit Report File?

No one can freeze or unfreeze your credit report file, unless the individual also has your PIN associated with the credit freeze. Do not lose your PIN. Store your PIN in a secure place.
Remember that credit monitoring and identity theft recovery services do not prevent fraud. They will alert you if someone tries to access your credit, if something looks amiss, or assist you to repair your identity in the case of identity theft. These services will not monitor your payment card purchases. You must monitor your charges separately.
Due to the demand for credit freezes, a credit bureau might ask that a request for a credit freeze be sent through the USPS mail.

How do I contact the three major credit bureaus to Freeze or Unfreeze my Credit Report file?

Equifax

https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp
800-349-9960

Experian

https://www.experian.com/freeze/center.html
888-397-3742

TransUnion

https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp
888-909-8872

[/peekaboo]

[peekaboo title=”Protect Yourself from Identity Theft” display=”hide” style=”big”]

Monitor Accounts Often. Monitoring accounts for unauthorized transactions is critically important. It is no longer enough to wait for your monthly credit card or bank statement to look for suspicious activity. Make it a habit to review your statements carefully and frequently. Even a small charge can be a danger sign. Thieves sometimes will take a small amount from an account and then return to take more, if the small debit goes unnoticed.
Use Online and Mobile Banking. For added protection, sign up for online access to your accounts and check them regularly, even daily, if you can.
- With American Federal Online Banking, a customer can set up account alerts, review recent transactions and more, all from a computer or mobile device with Internet access. The American Federal Mobile Banking App gives customers access to account information on the go from a smartphone or tablet. With text alerts, customers receive information about an account quickly through a text message on a mobile device. Customers can customize settings to be alerted about recent transactions and account balances.
Do Not Ignore Bills from People you do not know. A bill on an account you do not recognize may be an indication that someone else has opened an account in your name. Contact your creditor to find out.
Monitor your Phone Bills (landline and cellular) to find any unauthorized “cramming” charges for phony services and purchase. As cell phones increasingly become mobile payment devices, fraudulent charges are showing up there, too.
Opt Out. Identity thieves like to intercept offers of new credit and insurance sent through postal mail. It is a good idea to opt out of pre-approved credit offers. If you decide that you do not want to receive prescreened offers of credit and insurance, you can opt out of receiving offers for five years or opt out of receiving them permanently. To opt out for five years, call toll free 1-888-567-8688 or visit optoutprescreen.com. The phone number and website are operated by the major consumer reporting companies. To opt out permanently, you can begin the process online at optoutprescreen.com. To complete your request, you must return the signed Permanent Opt-Out Election form, which will be provided after you initiate your online request.
Create an ID Theft File. Because identity theft is now a fact of life, set up a folder for certain documents and data, and keep it in a secure place. Keep photocopies of the contents of your wallet – the front and back of your driver’s license, credit cards, and insurance and membership ID cards, in case they are stolen. Include credit reports, credit-freeze documents and passwords, copies of annual privacy notices, security-breach notices, and potential ID-theft evidence, such as mail to your address in someone else’s name.
Secure your Devices. If you access the Internet on your computer, install a firewall, regularly update and patch anti-virus, anti-spyware and anti-phishing software. Use complex passwords and do not share them. Make sure your smartphone, iPad and other mobile devices and portable flash drives containing personal data have security applications and encryption in case they are lost or stolen.
Respond Rapidly. If you suspect you have been a victim of identity theft, act quickly. Immediately contact your bank and creditors to report unauthorized charges or debits, close any compromised accounts, and step up your account monitoring. File a report with local law enforcement authorities and the FTC.

[/peekaboo]

Resources

How do I contact the three major credit bureaus to Freeze or Unfreeze my Credit Report file?

Equifax

https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp
800-349-9960

Experian

https://www.experian.com/freeze/center.html
888-397-3742

TransUnion

https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp
888-909-8872

Where can I get more information about the Equifax breach?

You can learn more directly from Equifax at https://www.equifaxsecurity2017.com/.
You can also learn more by visiting the Federal Trade Commission’s web page on the breach at https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do.
To learn more about how to protect yourself after a breach, visit https://www.identitytheft.gov/Info-Lost-or-Stolen.

News