
Senate Bill Would Make Credit Freezes Free - el_duderino
https://www.bankinfosecurity.com/senate-bill-would-make-credit-freezes-free-a-10706
======
karmelapple
I recently had to unfreeze my credit, but I was traveling so I did not have
the PIN that they gave to me when I froze my credit.

Experian was fairly difficult to do, and required I prove things in a pretty
non-trivial way. It involved sending a fax, which was annoying, but not
exactly horrible.

Equifax, the company that got hacked, let me unfreeze it discouragingly
easily. They asked me some questions on the phone that I figure were likely
available in the leaked data, with only one or two questions needing a little
more access.

The two questions that needed more access were frightening to me, though. They
asked me to confirm an up-to-the-minute balance on either my bank accounts or
the cost of a few things I purchased very recently (I forget which it was).
Either way, why do they have that data? Why does the company that got hacked
have that? I certainly never gave them permissions to have it, and I would
like to revoke their permission to have this information.

~~~
CWuestefeld
_Equifax, the company that got hacked, let me unfreeze it discouragingly
easily_

My wife and I just went through this due to a recent identity theft incident.
Our experience in setting up a freeze with Equifax was the opposite of ours.
My wife (and she's the financial manager of the house!) actually got refused
by their online tool, and we had to call up and go through it all again with a
human.

~~~
pzxc
The fact that you had difficulty freezing your credit, and the person your
replied to found it discouragingly easy to UN-freeze their credit, does not
bode well for Equifax in either case.

------
exhilaration
In comparison, here's what it cost me in September to place a credit freeze in
a state that does not regulate its cost (Pennsylvania):

    
    
      TransUnion: $10
      Experian: $10.70
      Equifax: free (they made it free after they were hacked - until June 30th)
      Innovis: free (always free as far as I can tell)
    

And it worked really, really well. I had to apply for a corporate Amex at work
soon afterwards. I was rejected because my credit was frozen and was asked to
call. I temporarily unfroze my credit while on the phone (on Equifax, because
it was free) and Amex ran my credit right then and approved me.

Having that kind of control was amazing. If I need to allow a credit check, I
can do a 24 hour or 7 day unfreeze. It's such a minor inconvenience for
completely blocking credit thieves.

~~~
rixrax
This may sound controversial, but politicians should also limit credit
reporting agencies to finite, fixed number of players. Like two or maximum
three.

Sometime after Equifax hack, I froze our credit on TransUnion, Experian and
Equifax. But wasn't aware that e.g. Innovis exists.

So ok, I will now go there to put a freeze in place. But now that I realized
there maybe other CRAs, DDG tells me I should maybe do something about FICO[1]
and PRBC[2] too.

Or of course we could do the smart thing, and tell our elected representatives
to work towards abolishing/repealing whole CRA industry. I'd wager that what
ever rises from those ashes, could not possibly be the horror CRA industry is
today.

[1] [https://en.wikipedia.org/wiki/FICO](https://en.wikipedia.org/wiki/FICO)
[2] [https://en.wikipedia.org/wiki/PRBC](https://en.wikipedia.org/wiki/PRBC)

~~~
exhilaration
I hadn't heard of Innovis either until I read the New York Times article
encouraging everyone to freeze their credit:

 _Christina Bater, managing director at Barrett Asset Management in New York,
suggests freezing your file at the little-known company Innovis, too. Hey, why
not?_

[https://www.nytimes.com/2017/09/08/your-money/identity-
theft...](https://www.nytimes.com/2017/09/08/your-money/identity-
theft/equifaxs-instructions-are-confusing-heres-what-to-do-now.html)

~~~
toomuchtodo
Innovis Credit Freeze Online Link:
[https://www.innovis.com/securityFreeze/index](https://www.innovis.com/securityFreeze/index)

------
JauntTrooper
I’ve been trying to freeze my infant son’s credit and they’ve made it absurdly
and maliciously complicated.

In addition to mailing a physical letter requesting the freeze to each
organization, they require copies of his birth certificate AND social security
card AND my social security card AND my drivers license AND proof of address
(I.e. utility bill) AND a form from the Social Security Administration AND a
court order/power of attorney or notarized statement of an authority to act on
his behalf. And money of course.

That court order requirement is a doozy. I don’t even know how to get one of
those. So I haven’t pursued it further, which I’m sure was their intent.

And of course there’s the question about how wise it is to send these sloppy,
negligent organizations all this sensitive info. Hopefully they fix this
racket by the time he turns 18.

~~~
lancepioch
Why are you trying to freeze his credit? I don't think he'll even be in their
systems until he gets his first financial account, presumably years later.

~~~
JauntTrooper
That’s what makes his social security number an attractive target for identity
theft. He won’t check it for over a decade.

[https://www.npr.org/2017/10/18/556237149/to-protect-
children...](https://www.npr.org/2017/10/18/556237149/to-protect-children-
from-identity-theft-parents-must-be-proactive)

Quote from the article:

> A 2011 report on child identity theft from Carnegie Mellon University's
> CyLab found that of the participants surveyed, the rate of identity theft
> for children was 51 times higher than that of adults. Social Security
> numbers are of special interest because they can be associated with any name
> and birthdate, the report showed. They also offer thieves a clean financial
> canvas.

------
cheeseomlit
I'm a big free market guy, but the idea of a private entity profiting off of
collecting my personal financial information (and charging ME to have some
degree of control over it) is absolutely insane

~~~
rixrax
+1. If ever there was a place for a not-for-profit federal organization, this
is it. Edit: Like others have pointed out, it's just beyond believe what
information these CRAs hold on us.

------
odammit
After the leak last year I’ve spent a few hundred bucks freezing my wife and
my credit.

While the cost is annoying, the process is even more annoying.

The entire idea/industry needs to be changed. It’s absurd all Americans are
opted into this system.

How is credit reporting handled in other countries?

Edit: my wife’s credit. ;)

~~~
vanadium
Is your wife ok? ;)

But no, on a more serious note, the process should look more like:

1\. Institution asks for Credit pull

2\. Person gets alerted for approval of said request

3\. After pull, credit remains locked

~~~
odammit
Ha. I didn’t realize I did that. She’s cool ;)

~~~
mulmen
Cool but not frozen?

------
mnm1
Anything short of holding credit agencies, banks, and anyone who improperly
leaks data or acts on false data liable for their actions is an improper
solution here. Why should I have to freeze my credit, when it's the bank or
credit agency's fault that someone opened a fraudulent account and it should
be them and only them that pay to fix this up? This bill is a joke and only
serves to reinforce the notion that it's the consumers' fault that banks act
on fraudulent information.

It's not the consumer's fault that banks themselves commit fraud, so why do
the consumers then have to pay for the consequences? With shit laws like this
on the books, it's hard to get angry at people who rob banks: they're doing
what our legislators failed to do for them. I don't even see that as immoral
anymore, especially compared to current law that protects the thieves and
banks and throw the consumer under the bus.

------
Thriptic
While this is good, it's another instance of Congress slapping a bandaid on a
gunshot wound and calling the problem solved. We wouldn't need freezes if we
had an identity system which wasn't immutable (ssn). For once can we fix the
root cause of a problem rather than treating symptoms.

------
seorphates
Given that it feels like everyone and their brother's camel seems to have
access and input into our histories and the (just. holy shit.) levels of
information these firms have access to and records for regarding just about
everything we do with a dollar this is as good a start as any.

Data hoarding industries like these, those that really have too much sway over
individuals' well being and access to basic services, needs to be the second
most regulated thing on the planet. Or maybe third.

------
chiph
Why not make "frozen" credit the default?

~~~
asdsa5325
Or a better question: why are social security numbers used as a password but
yet stored by every financial institution you interact with?

If only we had some way to verify an identity while keeping important
information private- oh wait, we do, public-key cryptography.

~~~
vageli
They could even hash the number and it would STILL be more secure than storing
the raw string in plaintext.

------
CWuestefeld
I just went through this stuff after an identity theft incident. While locking
my Equifax file, I learned something surprising:

 _Locking your Equifax credit report prevents access by potential creditors
and lenders, but there are exceptions. ... Companies that wish to make pre-
approved offers of credit or insurance to you ...

Equifax maintains consumers’ credit reports and provides information to
certain customers, including credit card companies and lenders, so that they
may offer pre-approved offers to consumers as permitted by law. Consumers that
prefer not to receive such offers should visit www.optoutprescreen.com, or
call toll free at 888-5-OPT OUT (or 888-567-8688)._

So I'd really encourage everyone to do that opt out thing, too.

~~~
r00fus
Read a different thread here - an Equifax "lock" isn't the same as a credit
freeze.

~~~
JoshuaEN
Just to be clear, a credit freeze does not stop prescreened credit offers
either [0].

[0] [https://www.consumer.ftc.gov/articles/0497-credit-freeze-
faq...](https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs#offers)

------
cwperkins
This could not come fast enough, I cannot fathom how this is not already
mandatory as Credit Freeze is the best tool a consumer has to fight against
identity theft. I should be able to unfreeze when I know I am going to take
out a line of credit and freeze when I know I will not take out a line of
credit. The fact that there are private entities out there charging me to do
this is insanity.

~~~
r00fus
Default to frozen by default would be the proper fix.

A credit freeze is analogous to "deleting" a hypothetical mandatory FB account
(we all know they don't actually delete your data but at least you aren't
publicly visible).

------
hyperbole
credit freeze fees and fees related to identity protection are an extortion/a
shakedown plain and simple. Companies like Equifax sell your data then charge
you a fee to block access to that which they sell, if you don't your opening
yourself up to identity theft from behavior that they themselves have caused.

------
bogomipz
I didn't see this mentioned in the article but the issue is not just the fees
but the fact that a "credit freeze" only last for 90 days which means you need
to reapply the freeze every 3 months. This is a game of attrition and over
time consumers are less and less likely to re-up their freeze.

~~~
ChrisAntaki
You might be thinking of a "fraud alert", which is different than a "credit
freeze" => [https://www.consumer.ftc.gov/blog/2017/09/fraud-alert-or-
cre...](https://www.consumer.ftc.gov/blog/2017/09/fraud-alert-or-credit-
freeze-which-right-you)

~~~
bogomipz
Yes you are right. I conflated the two. That said given the the whole system
is known to be compromised one should be able to put a fraud alert on their
credit file for longer than 90 days. Or maybe even a permanent fraud alert.

It seems like they could be complimentary since a creditor needs to call you
to get approval before extending credit in your name. With both of these even
if your credit was unlocked the credit issuer would still be required to get
your verbal approval.

------
mrguyorama
This should be a requirement in order to align Credit companies interests with
the interests of their "users". If they get defrauded often enough that the
administration costs of freezing and unfreezing become problematic, they will
likely finally try to stop getting hacked.

------
jacob019
It's been free in Indiana for at least a decade. I was surprised to learn that
friends in other states have to pay for what should be a right.

------
maxxxxx
This gives me hope but I wouldn't be surprised if they labelled it as
"burdensome regulation".

~~~
s73v3r_
Good. You know what? I want that entire industry to be hugely burdened.

------
throwaway84742
How about also making them the _default_ state of one’s credit history?

------
paulcnichols
Yes.

