This post is reposted (almost) verbatim. Parts of it have been sanitized since it was written by a law student in typical college student vernacular. Despite the sometimes-crude language, the information appears to be solid and practical.
Original post is at: LPT: How To Respond To The Equifax Breach, Secure Your Identity, and Recover Potential Losses submitted September 12, 2017 by (anonymous law student).
Update: The original post appears to have been removed as of September 17, 2017 so this may be the only place where it still exists.
I am making this because I see a lot of younger or more inexperienced or just unknowledgeable comments and questions about this breach. If you don’t know if you’ve been affected, or it affects you, or what the effects in question even are that’s okay! Especially for you younger folks, teen adults, people that haven’t worked with credit or law a lot you aren’t expected to magically know everything. Since I’m seeing advice scattered everywhere I thought I would consolidate it the best I can.
Equifax, one of the three major credit reporting agencies in the United States, was breached and over 140,000,000 people had their entire credit histories stolen. Credit history includes your Social Security Number, past addresses, all previously held accounts, all inquired accounts, any bankruptcies within the last seven years, and more.
How do I know if I was affected?
Are you an American adult that has ever held or inquired about a credit card, loan, car, bank account, cell phone account, electric service, water service, internet service, a security clearance, most jobs, most schools, most apartment complexes, or renting a house? Congratulations! You’re affected! I’m seeing a lot of “Well, if you ever did X…” Or “If you ever signed anything with this fine print…”
Nope. If you’ve ever applied for anything financial related in the United States then Equifax has been spying on you. Not like Big Brother, but Equifax, TransUnion, and Experian spy on you via financial history which every lender and creditor in the nation sends to them.
When did I consent to this?
You didn’t. Shame, but that’s the reality. It was likely hidden in the fine print of the first checking account you tried to open or when you inquired about buying a car but let’s be honest – it isn’t consensual regardless. You have no choice because it is pretty much impossible to actually live so off the grid you’ve never had any credit history. If someone used the same leverage to pressure you into giving them sex instead of your SSN it would be considered rape. Will this hold up in court? Almost definitely not. So you’re stuck with the rest of us.
How is this different than other breaches?
A lot of people brought up the US Office of Personnel Management Breach, or Target, or Yahoo, or PlayStation Network. This one is not very similar to those at all. The closest you’re getting in past examples is OPM. Here’s why: Target, Yahoo, and PSN don’t keep track of SSNs. They don’t keep track of every bill you’ve ever paid. They don’t keep track of everything you’ve ever thought about buying through financing or credit card. Target, Yahoo, and PSN’s biggest damages were your Debit or Credit Information being compromised. Big deal; cancel the card and get a new one. With Equifax, we can’t do that. You can theoretically request a new SSN but that request is not likely to be answered, especially on this scale. OPM was the only one similar to this, but that only affected government employees and it was stolen most likely by the Chinese Government. Fortunately for us, probably to spy on us rather than ruin our lives.
So what happens now that my information has been stolen?
Well now you get to play the anti-lottery. 140,000,000+ people, virtually every adult in the United States, has been entered into a lottery of epic proportions. Only in this case you don’t want to win. What does this mean for you? Well, it means if you have luck as bad as or worse than mine you ought to be concerned. Is the chance of you being the unlucky loser likely? Nope. But you sure as hell don’t want to be.
What happens if I lose this lottery?
Then you get to spend literally years fighting to prove to everyone that you are the real you and not the identity thief. During this fight you will not likely be eligible to do anything that requires credit – no cars, no house, no loans, maybe even no utilities or home rentals. If you’re like me and don’t have family to fall back on for a few years in this scenario then you should be the utmost concerned because this will make your life a living hell for 3-4 years.
How can I improve my chances?
This is where we get to your actual LifeProTip. Here are the processes you should undertake immediately if it applies to you.
1) Get a copy of your credit report today.
Regardless of freeze, alert, or regular credit monitoring get your current credit report to keep on file so you can identify anything new that shouldn’t be there in the future.
Forget CreditKarma, Forget FreeCreditReport, Forget all that nonsense, you want the real stuff.
REEE HAIL CORPORATE PLUGGING THEIR SITE REEEE
No. The Federal Government of the United States requires each of those three credit agencies give you a free copy of your credit report every year and this is the only authorized site to actually collect on that. Usually I’d suggest not getting them all at once but if you can’t afford to keep paying for all this crap then go ahead and pull all three at once. Again, if you’re like me and move around a lot the website may not like you very much. Jump through its stupid hoops to get it mailed if you have to. The credit agencies have to honor your request. Document this stuff well.
2) Freeze your credit. Right. Now.
Call the three credit agencies (yes, the same bogus enterprise that allowed this to happen) and put a freeze on your credit. What does this do? Well, it freezes your credit. Nobody, including yourself, can inquire into your credit for any reason until this freeze is unfrozen.
Does this cost money?
Yes. Experian is free, Equifax charges $5-$10, TransUnion charges $15-20.
(As of September 12, 2017, Equifax is waiving credit-freeze fees until November 21, 2017 and will refund those fees to anyone who tried to freeze their credit after the data breach was announced. Also, a bill is being introduced that will allow people to freeze their credit for free but has not yet been passed as of September 15, 2017.)
Does unfreezing cost money? Isn’t this a pain in the butt?
Yes, but only slightly. It will cost about $30 to unfreeze all three when you need to finance something but here’s the bright side: $30 and a few minutes on the phone with an automated system is a hell of a lot easier than the hell that will be your identity being stolen. And besides, if you can’t afford the $30 and a day of preparation before financing something – you probably shouldn’t be financing anything anyway. And I’ll tell you a little later how to get it back.
Does this affect my credit score?
Nope. Your credit will go on as usual, but nothing new can be added or inquired during the freeze. You will still be able to use your credit card.
Here are the phone numbers to initiate a credit freeze
- TransUnion: 1-888-909-8872
- Equifax: 1-800-349-9960
- Experian: 1 888 397 3742
You must call all three!
You can do this online, but Equifax’s site has been crashing nonstop since the breach was announced and the system doesn’t like people like me that move around a lot. I’d suggest using the phone. It is an automated system so don’t worry about interacting with a person.
What is to stop the credit thief from lifting my freeze?
A long PIN that will be supplied to you when you freeze it. This is pretty much it so make damned sure not to lose that. If there is another breach like this while you have the freeze, unfreeze it ASAP, then freeze it again to get a new PIN. Yes, this costs money. It costs less than having your identity stolen. And you might be able to get it back.
TransUnion allows you to set your own PIN, Experian will send it in the mail, Equifax will set it for you and give it to you over the phone after your freeze is initiated. IMPORTANT! Do not hang up until you have it written down! You can make it replay the message over and over. Listen to the automated prompts.
3) Initiate a Fraud Alert If you don’t do a credit freeze, at least do this.
You are a victim of identity theft now. Contact your local police station, tell them you need to file the report to initiate the appropriate processes. They may not know what you’re talking about but they will do it if you explain.
This normally costs money but you’re a victim now. This is why you need the police report/Identity Theft Report. This makes it free. This requires that anyone who wants to run your credit is going to have to jump through extra hoops to verify your identity. This may be a pain for you, but sure as hell a lot less pain than fighting through identity theft for four years.
4) Opt out of prescreened offers of credit while you’re at it.
This incident is probably gonna inspire you to get off the grid a bit more. You tired of junk mail? Well here’s how you reduce a ton of it:
Call the number or click the link I embedded into it. Either way will work. This will remain for five years at a time but if you return the signed Permanent Opt-Out Election Form to each credit bureau it will remain forever.
P.O. Box 919
Allen, TX 75013
Name Removal Option
P.O. Box 505
P.O. Box 740123
Atlanta, GA 30374-0123
Innovis Consumer Assistance
P.O. Box 495
Pittsburgh, PA 15230-0495
Alright. Done. Now how do I get some of this money back? What is our legal recourse? How do we punish Equifax?
I want you to do something right now while you’re angry. I want you to type up a clear, polite, but strongly worded email. Prepare it as if you’re sending it to the President himself.
Will this get my money back?
No. Not yet. But let’s get started on that.
Your legal recourse comes down to small claims court, personal formal suit, or class action.
For all of these cases DO NOT ENROLL IN EQUIFAX’S “IDENTITY PROTECTION”. Forget that crap. We don’t trust these people anymore, remember? Besides, if you enroll in Equifax’s “Identity Protection”, those sneaky SOB’s have in small writing that you promise not to sue them for the data theft that was their fault!
So here’s the pros and cons of each other recourse:
This is the most likely in which you actually get anything back. Your limitations will vary by State and County. Some jurisdictions allow you to sue for up to $25,000 in small claims. Most limit it much lower at like $3,500. The amount you choose is totally up to you but we’ll get to coming up with a number in a moment.
- Most likely to actually get you paid
- Do not need a lawyer
- Less formal court process
- Ironically, this will likely do the most damage to Equifax if enough people do it.
- Equifax will probably not even send a lawyer to deal with it if they get served with enough of them.
- Difficult process for some
- Still costs court fees
- Actually getting the judgement and collecting the judgement are two totally different things
- There is no discovery process in small claims.
This will get you the biggest personal payout – if you win. Keep in mind you’ll be going up against a $17B company so even when fighting many lawsuits they will likely have more firepower than you in almost any case. The good news for us little guys in this case is some very wealthy people would have also gotten their info stolen so if we’re lucky some other big guns will be taking them to court personally, but I wouldn’t count on it.
- Biggest possible personal payout
- There is a discovery process
- Will cost Equifax even if they win
- Collecting on these judgements is going to be way simpler since you have a lawyer
- Less personally intense for you
- Most expensive option
- Requires a lawyer (going without one would be suicide)
- You will need a cyber security expert
- You will need a financial sector expert
- You will need to be able to prove that Equifax could have done more
This one is already in the works. It will likely cost Equifax somewhere in the $100M range, the lawyers will collect 40% of it, and the few millions of us that apply to be part of the class will get a few bucks out of it. Equifax is already preparing to pay out for this and it won’t even phase them if this is the worst thing that happens.
- Super easy. All you need to do is send the lawyers your info. They will probably set up a website in a few months for all of us to do that.
- Much easier to win. Hell at this point I’d say its guaranteed to win.
- You get a few dollars.
- You will only get a few dollars
- This won’t even phase Equifax as a company.
- You lose your ability to sue them as an individual if you sign on as a member of the Class.
Which is right for me?
Do you have proof that your information compromised by Equifax will lead you to emotional duress? Well, you could argue that simply being compromised does. But ask yourself how well you can back that up. If you feel like you can’t – Small Claims or Class Action. If you can, talk to a lawyer about a formal suit.
Do you want to put any effort into this whatsoever? If not – Class Action. The others will require work.
Do you feel comfortable enough with this case that you can win against a multi-billion dollar company? If so – Small Claims or Formal Suit
Visit the online forum www.reddit.com/r/legaladvice or talk to a lawyer about your options. I am not a lawyer; I’m just a prospective law student with an interest in the law. I am not qualified to tell you how to go about your case. I can only give you a general idea. Do not take legal advice from anyone who is not a lawyer.
So how much should I sue for?
Ultimately this comes down to your Small Claims limit and how much damage you can prove was done. If your identity is stolen as a result of this, or any time after it, I would personally sue for the amount of all loans taken in my name, the fees I’ve paid on credit freezing and unfreezing, any tax returns I’ve lost (see next steps), lawyer fees, and a suitable amount for emotional duress.
By my rough estimation that means if I actually had loans taken out in my name as a result of this I’d be suing probably for $75,000 or so. Consult with a lawyer. Again, I am not a lawyer (yet). I’m just a guy that is telling you how to get started.
File your tax return as soon as possible from here on out. With your credit frozen and a fraud alert in place your biggest risk of direct impact is going to come from a fraudulent tax return. Unfortunately, the powers that be at the IRS don’t bother to confirm identity on tax filings except for a SSN. If somebody files with your SSN you will not be able to file. You will have to dispute it. I have seen people have to go through this battle before and it is very long. Hound your employers to get your W-2 ASAP.
If your identity is stolen and used this way TurboTax keeps a webpage (https://turbotax.intuit.com/tax-tools/tax-tips/General-Tax-Tips/Identity-Theft–What-to-Do-if-Someone-Has-Already-Filed-Taxes-Using-Your-Social-Security-Number/INF23035.html) to make fighting this battle a little easier.
The IRS will never contact you by phone or email to verify your identity! However, if you contact them they will be willing to verify over the phone. If you get a call from anyone claiming to be the IRS for this purpose hang up, look up the IRS number, and call them instead.
Is there any part of my identity that is secure?
Our birth certificates and passports are about all we’ve got left right now.
If you only have one copy of your birth certificate look up your County of Birth’s rules on requesting a new one. This will probably cost about $20 as well. The birth certificate is one of the end-all-be-all points of our identity. Keep them in locked and fire proof boxes. Worst case scenario for you is having your identity stolen and then having a fire take these documents. Make sure both can’t happen at the same time at least.
Since it relies on birth certificates I highly suggest reading further on Passports.
If you don’t have one look into getting a Passport. This will prevent one from being made in your name with your birth certificate in the future, may help you prove your identity if necessary, and you can also travel to Europe, Canada, and Mexico without a visa in most cases. Win-win-win.
Passports use various methods for confirming your identity but the lynchpin is your birth certificate. You’ll have to send a 2″x2″ photo and a certified original copy of your birth certificate off the State Department to get your Passport. The photo can be done at a UPS Store or CVS or similar places and costs like $5. The Passport fee itself is closer to $100.
The State Department will send back your birth certificate when they are done with it but I would suggest having more than one original on hand. Photocopies are not good enough for either case.