When Equifax's recently retired chief executive, Richard F. Smith, appeared before a panel of the House Energy and Commerce Committee Tuesday, he held himself out as a changed man.
After decades of maintaining high walls between the credit data that his company collects and the citizens like you and me who simply want to know what it says and means, he claimed that he and his former company now want to put us in control. We should have the ability to lock any new creditor out of our credit files, he said, and the forthcoming service that makes it possible will be free forever.
Then, he threw down a gauntlet of sorts. "I would encourage TransUnion and Experian to do the same," he said, referring to Equifax's primary competitors. "It's time we change the paradigm and give the power back to the consumer to control who accesses his or her credit."
More from New York Times:
Measuring greenhouse gases in Alaska
The maximalists are coming
How Europe's last dictatorship became a tech hub
Experian's response came about six hours later: Go pound sand. "We are looking at broader solutions that can help consumers effectively and securely operate in the credit economy, but it shouldn't be done based on crisis-mode responses from Equifax," Michael Troncale, an Experian spokesman, said in an emailed statement.
This intramural spat that broke out late Tuesday is centered on what the best remedies are in the wake of the Equifax breach and what they should cost, if anything. Earlier this year, thieves pried loose as many as 145.5 million Social Security numbers, dates of birth and other personal information. Equifax's biggest peace offering so far has been what it refers to as a credit lock.
Credit locks work the same way as credit freezes, which have existed for more than a decade: In either case, you tell Equifax, Experian and TransUnion to flip a switch, after which no new creditor can see your credit report. Because companies won't open an account without checking up on you first, this has the effect of blocking thieves who try to impersonate you using stolen information to take out new loans in your name.
Locks and freezes only work, however, if you block access to your files at all three bureaus, which you have to do separately; if you only close off access to your Equifax file, someone might use information from the Equifax breach or some other data theft to open a credit card in your name at a bank that only checks an Experian report.
Freezes came into widespread existence only because of pressure from consumer advocates and state legislators, who eventually passed so many laws that the credit bureaus gave in and offered freezes nationwide about a decade ago. More recently, they've added credit locks, which accomplish the same thing but are not subject to state regulation.
Locks can differ in other ways as well. Equifax has confused consumers by discussing two different lock processes in the past month. You can turn the first on and off from a browser; it made this available along with the TrustedID Premier package of credit monitoring it offered free to every American after it announced its breach.
Last week, it announced that beginning Jan. 31, 2018, it would introduce a second way to lock, via a stand-alone mobile app that will lock and unlock someone's credit file. The service, it said, will be free for life.
There is a convenience angle here, too. Credit freezes require the use of a PIN, which you must supply to temporarily lift or permanently cancel a freeze. If you lose it, you won't be able to unfreeze your credit file instantly.
Canceling credit locks is supposed to be instant, too, which is crucial if you want to apply spontaneously for a credit card at a store counter or if you forget to unlock your file before going car shopping. But even Equifax's communications team seems confused on how quickly the process works. Its own website says, incorrectly, that unlocking can take 24 to 48 hours. I pointed this out to the company several days ago, and it admitted its error. But it still hasn't fixed the website.
TransUnion has a locking product as well, which it includes as part of a service called TrueIdentity. It is free, but you must submit to offers of credit from third parties in order to use it, which helps TransUnion make money. It also comes with mandatory arbitration and class-action lawsuit waivers. "The arbitration agreement helps us to provide TrueIdentity to consumers at no charge," said David Blumberg, a company spokesman, in a statement.
Before Mr. Smith's congressional testimony Tuesday, Experian had been charging money for its credit lock. To get the lock, you have to sign up for a monthly credit monitoring service, which can cost $9.99 to $24.99 a month. This will always cost more than what they charge to simply freeze your credit file and thawing it occasionally when you need to apply for credit.
When I asked Experian whether it would change its policy on this, it declined to commit to anything. "We will continue to review this issue in light of the other alternatives available and engage with consumers and other stakeholders to ensure consumer-centric solutions are available that enable consumers to be safe in the credit economy," it said in its statement.
Like TransUnion, Experian forces people to sign away legal rights, which probably isn't the best way to help people feel safe. Experian said that this was "consistent with the industry standard for consumer terms and conditions." Arbitration agreements represent "a simple and convenient dispute resolution mechanism that helps ensure claims are resolved quickly and to the parties' satisfaction." For an alternative view, see my colleagues' series of articles about how these clauses actually work in practice.
Why might Experian be taking such a hard line?
There could be a cold political calculation at work. Sure, making its locks free might head off any federal legislation forcing free locks or freezes on the companies. But given the dysfunction in Washington, perhaps its lobbyists are telling executives that any new laws are unlikely.
Meanwhile, as John Breyault, vice president of public policy, telecommunications and fraud at the National Consumers League, said to me in an interview, making freezes and locks cumbersome and expensive creates a competitive advantage for Experian. After all, if Experian has fewer blocked credit files than Equifax or TransUnion, it will be easier for Experian to ultimately sell access to more files than its competitors.
Which is not to say that Experian doesn't believe what Mr. Smith of Equifax is saying. It knows that people should shut down access to their credit file as a matter of basic financial hygiene. In a podcast on its website, where the host made the radically misleading statement that a credit freeze can take "weeks or whatever it is," a guest, Michelle Felice-Steele, endorsed the locking concept heartily.
"Basically people lock things that are valuable to them, and your credit is also valuable," said Ms. Felice-Steele, Experian's director of product management in its consumer services group. "They value that information not getting into identity thieves' hands."
So cutting off access to your credit report is an excellent idea, and Experian knows it, even if it might cause problems for the banks and others who keep it in business. Experian simply wants to stick us all with the bill for its freezes and locks. We'll see how long it continues to get away with it.