After Equifax Hack, Calls For Big Changes In Credit Reporting Industry

Oct 18, 2017
Originally published on October 20, 2017 12:29 pm

This past spring, David Mifflin looked at his credit report online and saw that something wasn't right.

There were inquiries from Chase Bank about an application for a credit card that someone was trying to open in his name. Mifflin, who lives in San Antonio, says he called the bank and was told the identity thieves "had my Social Security number."

He set up fraud alerts with the three major credit reporting companies. But he says the fraudulent attempts to open credit cards continued "multiple times a week, multiple times a day."

The Equifax security breach — the largest known theft of Social Security numbers in history — has lawmakers, prosecutors and identity theft victims like Mifflin angry with the company. The revelations have put a spotlight on the industry, raising some important and deeper questions and sparking calls for tough new rules to reshape the credit reporting landscape.

Mifflin soon found himself talking to collectors about debts he didn't recognize. He kept seeing inquiries to open credit cards on his credit report and would call the bank to say "don't issue those cards, it's fraud." He says he would wake up in the middle of the night worried and angry.

Even to discover any of this, Mifflin says he'd had to sign up for a service with the credit reporting firm Experian, paying $26 a month. He says that was frustrating too, to have to pay some $300 a year "just to get my information that they're collecting."

"That's my information; I should have access to that at any time for free," he says.

Mifflin put a freeze on his credit report with the credit bureaus. That apparently stopped anybody from opening new accounts. But he had to pay more money for that.

Then the Equifax hack came to light, involving stolen Social Security numbers and other records of more than 145 million Americans. "My anger level really, really kicked up after that," Mifflin says. He doesn't know whether he was a victim of that hack. The Equifax website told him his information may have been stolen.

All this got Mifflin asking questions that many lawmakers are now asking too:

  • How can these credit reporting firms collect our information, and sell it for a profit, without asking our permission?
  • Why do they have the right to charge us to see our own credit report regularly, or to freeze it, especially when they aren't doing a good enough job of protecting our information from hackers?

"It's incredible power that they have and they hold us just short of hostage," Mifflin says. "I'd like to see some major reform."

So would a growing number of lawmakers and regulators. Maura Healey of Massachusetts is one of more than 30 state attorneys general investigating Equifax. She was the first to file a lawsuit against the company in the aftermath of the massive hack.

"I find this incredibly irresponsible and outrageous," she says. "The company and its executives need to pay and reforms need to be brought to this industry."

Healey is working with Massachusetts lawmakers on new legislation to require better security. It would also block any company from buying consumers' credit reports or scores without their permission.

"For far too long these companies have been out there collecting our personal data," Healey says. "We never gave them permission to collect it, let alone to sell it to other entities."

In Congress, Rep. Patrick McHenry, R-N.C., introduced a bill that would force the credit reporting firms to get federal cybersecurity reviews and to stop using Social Security numbers to identify people.

"You could develop technology very easily that would allow people to go to an app on their phone to put a credit freeze on and off free of charge," Republican Sen. John Kennedy of Louisiana told an industry spokesman at a Senate Banking Committee hearing Tuesday. "That ought to be a minimum."

A bill introduced by Sen. Elizabeth Warren, D-Mass., would require free credit freezes. And several proposals in Congress would also give Americans more access to their credit reports free of charge.

Beyond the Equifax hack's effect on individuals, Sen. Jeanne Shaheen, D-N.H., is concerned about the impact on small businesses. She says small-business owners "are often using their personal credit to get credit to operate their businesses so it's also their livelihood that's at stake."

Shaheen wants to see legislation that requires the industry to give small-business owners, and Americans in general, unfettered access to view the information on their credit report. "They ought to be able to access it whenever they need it without paying," she says.

Chris Hoofnagle, a cybersecurity expert at Berkeley Law school, says all of these measures are necessary steps toward fundamentally changing the credit system. Currently, he says, "every second of your existence someone can come along and pretend to be you, get your consumer report, and get a new credit card or an auto loan in your name."

Hoofnagle says your credit report should be frozen by default and then you could unfreeze it to, say, buy a car.

Andrew Smith, representing the Consumer Data Industry Association at the hearing, said the industry already faces enough regulation and that the credit bureaus play an important role in the economy by helping consumers get access to credit.

Copyright 2017 NPR. To see more, visit http://www.npr.org/.

MARY LOUISE KELLY, HOST:

When more than 140 million people have their Social Security numbers stolen, you assume it's a moment that will lead to change. NPR's Chris Arnold has been looking into the credit reporting industry after the giant Equifax breach that was revealed last month. Chris says the hack is raising important questions about these agencies.

CHRIS ARNOLD, BYLINE: This past spring, David Mifflin looked at his credit report online and saw that something wasn't right. There were inquiries from Chase Bank regarding a credit card application, and it turned out that someone was trying to open a credit card in his name. Mifflin, who lives in San Antonio, Texas, called up the bank and found out that the identity thieves...

DAVID MIFFLIN: They had my Social Security number as well. And this was the first two attempts.

ARNOLD: Mifflin set up fraud alerts with the three credit reporting companies, but he says the bad guys still kept trying to open credit cards.

MIFFLIN: Multiple times a week, multiple times a day even, things were sent in.

ARNOLD: Soon Mifflin was in the thick of it, talking to debt collectors about debts that he didn't recognize. He had to keep calling the bank to say please don't issue those cards. It's fraud. He was sometimes waking up at 2:30 in the morning worried and angry. And even to discover any of this, he'd had to sign up for a service with the credit reporting firm Experian. He says he's been paying $26 a month. That's 300 bucks a year.

MIFFLIN: Yeah, just to get my information that they're collecting. That's my information that I should have access to that at any time for free.

ARNOLD: Mifflin put what's called a freeze on his credit report with the credit bureaus. That apparently stopped anybody from opening new accounts. But he had to pay more money for that. And then the Equifax hack came to light, more than 145 million Americans involved.

MIFFLIN: When I heard that, my anger level really, really kicked up.

ARNOLD: The Equifax website told Mifflin that his personal information might have been stolen, and he started asking questions that a lot of lawmakers are asking now too. How can these credit reporting firms collect our information and sell it for a profit without asking our permission? Why do they have the right to charge us to see our own credit report or to freeze it?

MIFFLIN: It's incredible power that they have, and they hold us just short of hostage, you know? I'd like to see some major reform.

ARNOLD: Maura Healey is the attorney general of Massachusetts, one of more than 30 AG's investigating Equifax and the first to file a lawsuit against the company.

MAURA HEALEY: I find this incredibly irresponsible and outrageous. The company and its executives need to pay, and reforms need to be brought to this industry.

ARNOLD: Healey and state legislators have crafted a bill to require better security. It would also block any company from buying our credit reports or scores without our permission.

HEALEY: They should get our consent first. This is our personal data. And for far too long, these companies have been out there collecting our personal data. We don't even realize it. We never gave them permission to collect it, let alone sell it to other entities.

ARNOLD: In Washington, a Republican bill would force the credit reporting firms to get federal cybersecurity reviews and to stop using Social Security numbers to identify people. At a Senate banking committee hearing yesterday, Republican John Kennedy told an industry spokesman...

(SOUNDBITE OF ARCHIVED RECORDING)

JOHN KENNEDY: You could develop technology very easily that would allow people to go to an app on their phone to put a credit freeze on and off free of charge. That ought to be a minimum.

ARNOLD: That sounded pretty close to a bill introduced by Democrat Elizabeth Warren that would require free credit freezes. Chris Hoofnagle is a cybersecurity expert at Berkeley Law School. He says we need to make a fundamental change in the way that credit exists in the U.S. financial system.

CHRIS HOOFNAGLE: Right now credit is in a liquid state, and it doesn't make a lot of sense. It means that every second of your existence someone can come along and pretend to be you, get your consumer report and get a new credit card or an auto loan in your name.

ARNOLD: Hoofnagle says the U.S. should shift to a frozen state. That is, your credit report is frozen by default, and if you want to unfreeze it to, say, buy a car, you can. For his part, the industry spokesman at the hearing said the industry already faces enough regulation and that the credit bureaus help consumers get access to credit. Chris Arnold, NPR News. Transcript provided by NPR, Copyright NPR.