Editor’s note: Wired for Safety is a weekly column on cybersecurity and other tech issues. Duane Dunston is an assistant professor of Cybersecurity and Networking at Champlain College. He received his BS and MS from Pfeiffer College. From 2001 to 2011 worked in cybersecurity for NOAA. He is a first-year doctoral student at Northeastern University where he is pursuing a doctorate. His other activities include “You Have A Voice,” a project to develop an electronic screening assessment to identify human trafficking victims.
[T]he Equifax breach is a big deal. Based on the U.S. Census estimates in 2016, there are more than 323 million people living in the U.S. According to Equifax, approximately 143 million people are affected, including some people in Canada and the U.K.
What information was compromised (that means information that was exposed to the unauthorized people involved)? Names, Social Security numbers, addresses, birth dates, some people’s driver’s license number, and some credit card information.
If this scares you, it should. That’s the same information you provide to open an account for a line of credit, make purchases, or it is used to uniquely identify “you” when calling about your utility account, bank account, or retirement account. A photo ID only proves you are the person standing in front of the person that is checking it. The information contained on that ID can be anyone.
Sometimes, when you create accounts, you have to create secret questions and answers. If you have used any of the information above for your secret question and answer, you should change it. You should monitor your utility, retirement and other financial accounts for unusual activity. Create alerts with those institutions, if available, when attempts are made to modify your information.
Remember this, it is not always about “you” the individual person, it is the information that uniquely identifies you that is of value with this compromise.
No one physically assaulted me, broke into my house and stole personal information, or stole information from my mailbox with this compromise.
They stole information that uniquely identifies me — Patrick Duane Dunston — that Equifax collects and creates products out of.
That has value to an identity thief because they can create accounts with my information and it is linked to me — Patrick Duane Dunston. They probably care less who “I” am.
They could potentially call my retirement organization and withdraw funds — well attempt. I get alerts when any information about my account changes from that organization. They could call my bank and attempt to transfer funds — the perpetrators have the information banks use to authenticate they are talking to “me.”
Check with your utility and financial institutions about alerts that can be created to monitor your account for unusual activity. Some organizations ask you to create a secret phrase before they provide support. That would be helpful right about now for utility and financial organizations.
Here are additional steps you can take to protect yourself from fraudsters:
1. What should you do?
Contact your bank to see if they can provide you a copy of your credit report. You’re entitled to one copy per year at no cost. You can also visit www.annualcreditreport.com which is the official website to retrieve a copy of your free annual credit report. Review it to be sure everything looks normal.
2. Should you type in your last name and last six digits at the Equifax site?
That is up to you to decide. I did and my info was possibly impacted. I will sign up for service tomorrow (the date the site provided me).
3. Equifax is going to offer one-year of free credit monitoring. What does that mean?
If a new credit-based account is opened or an organization views your credit report, you will receive an alert — if you set it up for alerts — or you can log in to the Equifax site periodically to check on your credit report.
4. Credit freeze
You can call each of the three major credit card companies to put a credit freeze on your credit report account. Those three are Transunion, Equifax and Experian. This will prevent organizations from querying the three major credit card companies in order to determine your credit eligibility. Any reputable organization does that before creating new credit-based accounts for consumers.
Note the weasel word “reputable.” If an organization is not reputable, they can create an account using your personal information still. It won’t show up on your credit report, but the account will still exist in your name.
If you need to “thaw” your credit report so that an organization can query your credit report, you’ll have to contact the three agencies to “thaw” the account temporarily. After it is “thawed,” the legit organization can then query your credit report. Be sure to ask them to freeze the account after X number of days.
The three major credit card companies have services you could purchase for a monthly or yearly fee where you can do many of these tasks via their website. Equifax, for example, does offer this as a part of the free credit monitoring service.
More information about a credit freeze is here.
5. Should you subscribe to a credit monitoring service like what TransUnion, Equifax, Experian or Lifelock offers?
Keep in mind, these services can alert and/or put freezes on your account. They essentially do what would take you a little longer to do on your own. Accordingly, it is up to you. Just know that they lure you in with basic services and then try to get you to purchase for more access.
5a. Check to see if your financial institution offers credit monitoring services for no charge.
6. Minimum, get your free credit report once a year AND REVIEW IT!
