Part of the huge Equifax data breach announcement on September 8 was the notification that the company had a website consumers could use to see if they were one of the victims. Notifications are a fairly standard legal requirement.
But there were some significant questions about the website that Equifax set up and implications of using it. Here are the problems that appeared and the fixes.
You didn’t learn if you were a victim
The biggest single reason to use the site was to see if your record was one of the 143 million that was taken — records that included Social Security numbers, birth dates, addresses, and even driver’s license numbers in some cases. Another 209,000 people lost credit card numbers as well.
But now there’s additional button at the bottom of the site called “Potential Impact.” Click on that, provide your last name and six digits of your Social Security number, and you find out whether you are one of the unlucky crowd.
If you signed up for the identify protection, you actually didn’t sign up
Getting a watch on your credit file, along with attempts to set up new credit in your name, is important if you were one of the many whose information was stolen. Having access to a year of free service is great. I know a number of people who thought they were signing up at the site.
However, when I tried this at the site, I received a date and a note to come back on that date to finish the process. In other words, if you’ve done this, you aren’t finished and, according to the site, you aren’t going to get a reminder. Be sure you head back.
There seemed to be an automatic restriction on your right to sue
As a number of sources pointed out, there was disturbing language in the site’s terms of use.
No Class or Representative Arbitrations. The arbitration will be conducted as an individual arbitration. Neither You nor We consent or agree to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with arbitration on a class or representative basis. No arbitration will be consolidated with any other arbitration proceeding without the consent of all parties. This arbitration provision applies to and includes any Claims made and remedies sought as part of any class action, private attorney general action, or other representative action. By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed.
In a case like this, especially given reports that Equifax may have relied on vulnerable software for the website application that it said was the door of entry for the criminals, a class action seems a distinct possibility.
Keeping people from joining a class action is a tool some companies use to undercut the possibility of such a lawsuit in advance. Individually, most people might not bring suit, meaning a much lower risk of facing legal action.
With the publicity, Equifax apparently thought differently and added this to the website:
In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident.
So, now you can get the services without giving up your rights.
However, the service may not be enough to protect you. New York Attorney General Eric Schneiderman’s office suggests also taking the additional following steps:
- Go to annualcreditreport.com and check your credit reports from Equifax, Experian, and TransUnion, the three major credit reporting agencies. Activity you don’t recognize could be a sign of illegal activity by someone else.
- A credit freeze might be a good step. That keeps anyone from opening a new credit account under your name, although it does make it inconvenient if you want to open a new account yourself. The step is a good one but doesn’t protect anything with your current accounts. To place a credit freeze, you need to go to Equifax, Experian, and TransUnion separately.
- Keep a careful look at your credit card and bank account statements for changes you don’t recognize.
- Pay close attention to your tax filings and any correspondence with the IRS because the Social Security number could allow someone to attempt tax fraud.