After Equifax Hack, Calls For Big Changes In Credit Reporting Industry

This past spring, David Mifflin looked at his credit report online and saw that something wasn't right.

There were inquiries from Chase Bank about an application for a credit card that someone was trying to open in his name. Mifflin, who lives in San Antonio, says he called the bank and was told the identity thieves "had my Social Security number."

He set up fraud alerts with the three major credit reporting companies. But he says the fraudulent attempts to open credit cards continued "multiple times a week, multiple times a day."

The Equifax security breach — the largest known theft of Social Security numbers in history — has lawmakers, prosecutors and identity theft victims like Mifflin angry with the company. The revelations have put a spotlight on the industry, raising some important and deeper questions and sparking calls for tough new rules to reshape the credit reporting landscape.

Mifflin soon found himself talking to collectors about debts he didn't recognize. He kept seeing inquiries to open credit cards on his credit report and would call the bank to say "don't issue those cards, it's fraud." He says he would wake up in the middle of the night worried and angry.

Even to discover any of this, Mifflin says he'd had to sign up for a service with the credit reporting firm Experian, paying $26 a month. He says that was frustrating too, to have to pay some $300 a year "just to get my information that they're collecting."

"That's my information; I should have access to that at any time for free," he says.

Mifflin put a freeze on his credit report with the credit bureaus. That apparently stopped anybody from opening new accounts. But he had to pay more money for that.

Then the Equifax hack came to light, involving stolen Social Security numbers and other records of more than 145 million Americans. "My anger level really, really kicked up after that," Mifflin says. He doesn't know whether he was a victim of that hack. The Equifax website told him his information may have been stolen.

All this got Mifflin asking questions that many lawmakers are now asking too:

• How can these credit reporting firms collect our information, and sell it for a profit, without asking our permission?
• Why do they have the right to charge us to see our own credit report regularly, or to freeze it, especially when they aren't doing a good enough job of protecting our information from hackers?

"It's incredible power that they have and they hold us just short of hostage," Mifflin says. "I'd like to see some major reform."

So would a growing number of lawmakers and regulators. Maura Healey of Massachusetts is one of more than 30 state attorneys general investigating Equifax. She was the first to file a lawsuit against the company in the aftermath of the massive hack.

"I find this incredibly irresponsible and outrageous," she says. "The company and its executives need to pay and reforms need to be brought to this industry."

Healey is working with Massachusetts lawmakers on new legislation to require better security. It would also block any company from buying consumers' credit reports or scores without their permission.

"For far too long these companies have been out there collecting our personal data," Healey says. "We never gave them permission to collect it, let alone to sell it to other entities."

In Congress, Rep. Patrick McHenry, R-N.C., introduced a bill that would force the credit reporting firms to get federal cybersecurity reviews and to stop using Social Security numbers to identify people.

"You could develop technology very easily that would allow people to go to an app on their phone to put a credit freeze on and off free of charge," Republican Sen. John Kennedy of Louisiana told an industry spokesman at a Senate Banking Committee hearing Tuesday. "That ought to be a minimum."

A bill introduced by Sen. Elizabeth Warren, D-Mass., would require free credit freezes. And several proposals in Congress would also give Americans more access to their credit reports free of charge.

Beyond the Equifax hack's effect on individuals, Sen. Jeanne Shaheen, D-N.H., is concerned about the impact on small businesses. She says small-business owners "are often using their personal credit to get credit to operate their businesses so it's also their livelihood that's at stake."

Shaheen wants to see legislation that requires the industry to give small-business owners, and Americans in general, unfettered access to view the information on their credit report. "They ought to be able to access it whenever they need it without paying," she says.

Chris Hoofnagle, a cybersecurity expert at Berkeley Law school, says all of these measures are necessary steps toward fundamentally changing the credit system. Currently, he says, "every second of your existence someone can come along and pretend to be you, get your consumer report, and get a new credit card or an auto loan in your name."

Hoofnagle says your credit report should be frozen by default and then you could unfreeze it to, say, buy a car.

Andrew Smith, representing the Consumer Data Industry Association at the hearing, said the industry already faces enough regulation and that the credit bureaus play an important role in the economy by helping consumers get access to credit.