Equifax, the credit reporting agency which admitted on Thursday it had lost massive amounts of information for 143 million Americans including social security numbers, is not making it easy to understand what the people it screwed over should do.
On Friday, Equifax began directing customers to its Trusted ID premier service, saying it would provide one year of free credit monitoring. But multiple users have reported widespread confusion about how the service works—or whether Equifax is even able to reliably inform users if they were affected. And Trusted ID comes with some big catches.
Several Twitter users posted that putting bogus information into Trusted ID still returns recommendations to sign up, and that Equifax appeared to be pushing people into agreeing to the service’s terms.
Some users were concerned those terms required them to waive their rights to a lawsuit and instead agree to arbitration. TechCrunch clarified Equifax says Trusted ID’s terms will not apply to any lawsuits related to the “cybersecurity incident,” but also noted “Equifax may change these terms or interpret them differently.”
There’s also the fact using Trusted ID might eventually require giving them money. Per CNBC, Equifax will begin charging customers after a year of using the service “unless they cancel by calling the company.”
“That’s just not right,” Zieve added. “They shouldn’t be making money off the hack..”
There do remain a few good options. Unfortunately, protecting identities in the wake of the attack will require people to shell out money to somebody, as well as some painstaking security measures.
While the Times recommended signing up for some sort of fraud-protection service, it also wrote users could put permanent freezes on their credit card files. A permanent freeze prevents bureaus like Equifax, Experian and TransUnion from releasing credit reports to any company the user isn’t already signed up with, though the process would cost additional fees ranging from $3-10 per account per bureau. It also interferes with legitimate requests for account information, and as the Times noted, dealing with those legitimate requests may carry an additional fee.
The process isn’t exactly user-friendly, but does provide good security. According to the Washington Post, no one will be able to get credit reports from frozen accounts “except ... existing lenders, or their debt collectors,” as well as “government agencies carrying out a search warrant or subpoena, and yourself, if you’re trying to access the free credit report that is entitled to you once per year per credit bureau.”
Another option, MarketWatch noted, may be for users to sign up for additional fraud protection from a service like Lifelock or EZ Shield. Those services generally run at least $10 a month, but do offer automated monitoring, help canceling and replacing cards and licenses, and assistance countering identity theft attempts.