In the days since the credit reporting firm Equifax disclosed the breach of 143 million consumers' private financial data, howls of outrage have only grown louder.
Dozens of potential class-action lawsuits have been filed, Congress has revved up hearings on the breach and two legislators have promised bills targeting the credit reporting industry. For its part, Equifax is offering consumers a free credit freeze and one year of credit monitoring to compensate for a breach that permanently increases their risk of identity theft.
But people whose Social Security number or credit card information has been exposed can't wait for reforms or depend on a limited monitoring service. Even those not affected by the breach should proceed as if they were: It's just one of 313 hacking or unintentional disclosures this year as tracked by the Privacy Rights Clearinghouse.
Assume thieves have your information. Your chance to limit their ability to use it depends not on Equifax or Congress, but on what you do.
Don’t rely on a system that has already failed
Credit reporting firms collect data on how you've repaid debts you've incurred. They make money by selling that information to creditors, which use it to see if they want to do business with you. The data they collect include birth dates, addresses, driver's license numbers and Social Security numbers — the skeleton keys to your financial life.
You can't avoid the three major credit reporting firms — Equifax, Experian and TransUnion — if you use credit cards or have loans. Nor do you get a say in how the firms will protect your data or what the remedies will be if your information is compromised.
"We are the commodity, not the customer," attorney Chi Chi Wu of the National Consumer Law Center said. "We can't decide, 'Oh, I don't want to deal with Equifax, so just send my data to the other credit bureaus.' We don't get to decide which credit bureaus we want to deal with."
Even taking the available steps now to protect your credit records is no guarantee.
"You should cross your fingers that the bureau system that was unable to protect your information in the past will do so in the future via that bureau's freeze, lock, monitoring or ID theft protection programs," said Barry Paperno, who blogs at Speaking of Credit.
What to do after the Equifax wake-up call
There's no substitute for your own vigilance in checking your financial statements and credit records and acting immediately to limit the damage. Assume that your information is out there and that a criminal can get it.
Watch your credit card accounts for suspicious charges
Even if this breach didn't compromise your data, identity thieves are always at work.
Don't wait for your monthly statement to arrive; fraudulent charges may pile up before you notice. Check your accounts online frequently or set an alert to notify you whenever a charge above a set amount is made. You can challenge fraudulent credit charges, but your best protection from liability depends on alerting your issuer in a timely fashion.
Monitor your credit scores and reports
You also need to watch for signs that someone has opened new accounts using your data. Regularly check your credit scores for unexplained movements and your credit reports for accounts you don't recognize.
You can do this yourself; many personal finance websites and some credit card issuers offer free scores and credit report information you can access anytime. Look for one that sends alerts when new accounts are opened, when your score changes and so on.
Decide how to secure your credit data
A credit freeze offers the best firewall against your data being misused because it restricts access to your records. It can cost as much as $10 per credit reporting firm, and you also have to pay to lift the freeze later if you want to apply for new credit.
Although Equifax is covering the cost of credit freezes and monitoring of its own records, it's not doing the same for freezes and monitoring through the other major credit reporting firms, TransUnion and Experian.
Fraud alerts offer less protection, merely flagging lenders and card issuers that credit applications should receive extra scrutiny. In most cases, a lender will contact you to verify a credit application. The service is free, but most alerts last only 90 days unless you renew them.
All three credit reporting firms have some sort of "credit lock" service, and they may offer these as an alternative when you try to freeze your credit. It's easier to lift a lock when you want to apply for credit, but locks don't block access as thoroughly as a freeze. Your data can be accessed by businesses that want to screen you for promotional offers, for instance. And the lock services at all three credit reporting firms require you to waive your right to participate in a class-action lawsuit and use arbitration instead.
Cost of a lock varies, from free to more than $20 a month.