More than 500,000 Mainers’ personal information may have been accessed in the massive Equifax breach last week, but Maine’s superintendent of consumer credit protection says not to panic, even if you find out you’ve been breached.
Will Lund says there’s a common belief that if someone opens up accounts or runs up debts in your name, you’re responsible for paying for them:
“As a general matter that’s not true, as long as we react with reasonable promptness when we discover that someone has done this, then the accounts can go away, or must go away,” he says.
In the days since Equifax announced the breach, Lund says the department has gotten hundreds of calls from Mainers who say they haven’t been able to freeze their credit with Equifax or even get through to the company. He says those complaints have now spread to all three of the major credit reporting agencies as they deal with a high volume of calls from around the country; and that the bureau is also getting calls from people wanting action against the agencies.
“There will be plenty of action by plenty of different government entities, state and federal, as well as private litigation. Our focus here at the Bureau of Consumer Credit Protection right now is to try to deal with consumer issues primarily, and explain what’s going on, and try to assist Maine consumers in understanding the breach and what they can do about it,” he says.
Lund also commented on reports that going to the Equifax site and checking whether you’d been affected would result in not being able to sue the company later. That had been true, but isn’t now.
“Very quickly on Thursday night and Friday, Equifax backed away from that. At first they inserted an opt-out and then within hours the clauses disappeared completely. So the current terms of use for the credit monitoring product do not contain a waiver of class action,” he says.
Lund says, thanks to Maine’s strong consumer protection laws, people can freeze and unfreeze their credit at will for free.
Lund’s full comments to Maine Things Considered host Nora Flaherty appear below, edited for clarity.
Flaherty: What has been going on in your office with respect to Equifax?
Lund: We were notified together with the attorney general’s office in Maine on Thursday I believe of last week. And since then we have received literally hundreds of calls from Maine consumers with questions about what the breach means, with questions about what steps they should take to protect the content of their credit reports.
Flaherty: It’s my understanding with the other two credit reporting agencies freezing credit has not really been a problem but that people have been having a lot of problems with Equifax.
Lund: The problem with jammed phone lines and websites has spread now to TransUnion and Experian. My presumption would be that they didn’t know to ramp up their assistance, their personnel, to deal with the millions of folks who may be attempting to freeze their credit reports not only with Equifax but also with Experian and TransUnion. So we are hearing from consumers that it is difficult for consumers to get through to any of the big three right now.
Flaherty: I have heard reports of people saying that Equifax said we just can’t freeze your credit right now.
Lund: It is a complaint that we have heard. We’re dealing with a 140 million across the country, and I think although Maine’s law is more advantageous than most in that freezing and unfreezing credit files for Maine consumers can be done without charge. That’s very unusual among the states. But I think careful consumers in all states may be freezing their credit reports with Equifax and-or with all three companies. And so the phone lines and the websites really were not designed to deal with that volume.
Flaherty: So you feel like this is just a volume problem, this isn’t something more sinister?
Lund: I don’t think it’s anything sinister. We’ve dealt with hundreds of calls here and we don’t have a sophisticated system. But our folks are basically hanging up the phone and then the phone is ringing again. If that’s multiplied into the millions it would take quite a system to handle that volume. Consumers have told us that they have finally gotten through by logging on late in the evening or early in the morning. So I think maybe it is load based, and I’m not making excuses for the systems but especially for Experian and TransUnion, if they did not know about the breach by Equifax in advance, then they would not have known to ramp up their capacity as they’ve now had to do.
Flaherty: Has there been any communication from the credit reporting agencies about what their plans are at this point? How people should handle this?
Lund: Because Maine is the only state to regulate credit reporting agencies directly, we have established for many years informal communications in order to solve consumers’ problems. We have continued that level of communication in order to resolve issues as they have arisen. For example, with one of the three agencies Maine consumers were being told they had to submit some sort of police report in order to freeze their files. That’s not true. And so we have resolved that at this point. So our level of communications with Equifax has continued primarily focused on resolving problems as they arise. My office has also participated in three or four multistate or state and national regulatory conference calls in order to share information and to share approaches. There will be plenty of action by plenty of different government entities, state and federal, that we will see and as well as private litigation. Our focus here at the Bureau of Consumer Credit Protection right now is to try to deal with consumer issues primarily and to answer questions, explain what’s going on and try to assist Maine consumers in understanding the breach and what they can do about it.
Flaherty: How many Mainers were affected by this breach, and what sorts of experiences are people having?
Lund: It looks as though more than half of all Maine consumers, residents are potentially affected by the breach. Our numbers as reported by Equifax exceed 500,000 consumers here in Maine for their information possibly having been exposed. Apparently there was a vulnerability in some software that allowed access that not much is known about right now. About 10 or 15 percent of the callers are simply concerned and want to know what they should know. Twenty or 25 percent have decided that they do want to freeze their credit report information utilizing Maine’s law, and they either are requesting information on how to do that from us or they are expressing concerns about not being able to do that. Five or 10 percent are just justifiably outraged and want to know how could this happen, what can we in the state of Maine do to prevent something like this happening in the future.
Flaherty: There has been the story in the media quite a lot of people going to Equifax, and then in return for checking whether they had been affected by the breach, basically having to click a box that said they could not participate in a future class action suit. Can you clarify what actually is happening with that?
Lund: The original terms of use for the Equifax credit monitoring product did have a clause that related both to mandatory arbitration for dispute resolution and also a waiver of class action availability. Very quickly on Thursday night and Friday, in a two-step process, Equifax backed away from that. At first they inserted an opt out and then within hours the clauses disappeared completely. So the current version of the terms of use for the credit monitoring product do not contain a mandatory arbitration clause, they do not contain a waiver of class action. This product had been sold by Equifax for a period of time prior to this as a service, and that contract and the mandatory arbitration clause and the waiver clause were a part of that. It may have been that Equifax itself was surprised to be studying and reading its own Terms of Use. They certainly underestimated the immediate and negative feedback both from consumers and from law enforcement around the around the country, regulators around the country, and they very quickly saw the appropriate course of action, and that was to to remove that clause.
Flaherty: So it is safe then for people who fear they may have been affected by this breach, which is pretty much everybody, to go to Equifax’s site and use their tool to check if they have been affected by the breach? And it is OK for them to sign up for this free credit monitoring so long as they’re aware that they’ll be charged after a year?
Lund: I don’t know if anybody can say whether anything is safe. I can’t vouch for products or services being offered by Equifax. The initial screen that allows consumers to check whether Equifax believes that their information has been compromised is not a necessary step to go to any other steps. In other words, Equifax has made the credit monitoring service available to all consumers whether or not they show as a yes or no on that initial screen. Some consumers are reluctant to put any information whatsoever into the initial screen and some are likewise reluctant to sign up for a service with a company that they feel has already demonstrated an inability to hold their information in confidence. Many folks have taken advantage of that program and are going to make a decision about continuing it at the end of the first year. Others have simply gone straight to the ability they have under Maine law, which is separate and independent from anything that any of the credit reporting agencies may offer. And that is the ability to freeze their file and then obtain personal identification numbers or PINs that allow them to unfreeze their file if they want to apply for a specific type of credit.
Flaherty: What is the best course for people to protect themselves at this point?
Lund: As a general matter we would encourage people to continue to be vigilant in terms of reviewing credit accounts. If they receive a call from a debt collector, for example, they shouldn’t simply ignore the call, they should take that as a signal. They should review their credit reports. We can still all review our credit reports with all the agencies without charge — annualcreditreport.com is the official website that allows us to do that. For those who want to take the next step, and especially those of us who are at an age where they are unlikely to be making a quick or instant credit decision on the spur of the moment, we are encouraging folks who are concerned to implement a freeze on their credit reports with all three agencies. That does have to be done one at a time with each of the big three. The phone lines and the websites are backed up right now, but we encourage folks to continue to keep trying until that is accomplished, if they decide to go that route. Folks need to also not panic. There is a widespread misperception that if somebody opens accounts in our name and runs up debts or makes purchases, that those will be our responsibility to repay, and as a general matter that’s not true as long as we act with reasonable promptness when we discover that someone has done this. Then the accounts can go away or must go away. Part of what we do here at the Bureau of Consumer Credit Protection is to assist consumers who get any pushback in that regard, either in terms of dealing with debt collectors, or in dealing with creditors, or in dealing with inaccuracies on their credit reports. So the bottom line is if we are reasonably vigilant and if we notify parties if we see an error, or if we see an unauthorized charge or an unauthorized account, that the legal burden then shifts to the creditor, or the debt collector or the credit reporting agencies to prove that they are right and that we are wrong. In other words, the account or the debt goes away unless it is proven by the creditor subsequently. And so consumers shouldn’t panic about the circumstance. There have been laws in place for 40 years or more to protect us from the effects of identity theft. And as long as they monitor things in a reasonable manner and take reasonable steps if they discover unauthorized charges or accounts, then those are not their responsibility.
This story was originally published Sept. 13, 2017 at 3:25 p.m. ET.
