Personal Finance

New service, same old Equifax: Credit locking app freezes up

Tara Siegel Bernard and Ron Lieber
Source: Equifax

Equifax introduced a free consumer service Wednesday that allows people to lock access to their credit files from a mobile phone. It didn't work.

Are you surprised?

After cyberthieves gained access to 145 million Social Security numbers in a breach at Equifax disclosed last fall, the company's consumer-facing technology melted down. Websites froze, tools to check your potential vulnerability did not work, and people trying to freeze their credit files or temporarily lift the freezes spent hours at the task.

Amid that mess came a promise from Equifax that it would create a simple app that allowed people to "lock" their credit files without all the hassle and without a fee. That is what the company introduced Wednesday.

It was supposed to be simple: You download the app and swipe the lock to the right, which restricts access to your file.

Except that's not what happened.

We started by downloading the app — with my (Tara's) husband's credit file as the guinea pig for the test.

Read more from The New York Times:
The post-Equifax marketing push: Identity protection services
How to protect yourself after the Equifax breach
As Equifax amassed ever more data, safety was a sales pitch

The home screen said, "Your Equifax credit report — you're in charge." (Nope, not until we can opt out of the credit reporting system altogether. But we digress.)

Before you start trying to lock your credit, you can be diverted and given an option to remove your name from the lists that the credit bureaus give to credit card and insurance companies. That's something you would probably want to do so you're not inundated with marketing offers. Is it easy? Heh.

Here, you have a few choices. You can opt in (which is already selected), you can opt out electronically for five years, or you can opt out permanently by printing the opt-out form. From your phone. Then, you need to walk to the nearest mailbox and send it to Equifax.

But first, you'll need Barbie-sized fingers to fill out the opt-out form, because it isn't optimized for mobile phones and makes typing difficult. So I (Tara) put on my Barbie fingers, and began. I filled out the entire form and then emailed it to myself so I could print it (after all, is your mobile phone hooked up to a printer?).

As it turns out, I emailed myself a blank form. So I had to fill out the entire thing again, but at least I could do that from the luxury of a regular-sized keyboard.

I turned back to my phone and continued on the app. Next, you're asked to enter your name, date of birth, Social Security number, mobile number and address (that's O.K., because most of those are already exposed, right?). After you confirm you're not a robot, you create a password.

The user agreement and privacy policy come next. Don't click on them! At least not from your phone. If you actually try to read them, as I tried to, when you press "done" you may be kicked back to the home screen. And you'll need to start over — name, date of birth, Social Security number and so on.

Back to creating the account. Once you enter your personal information, you're sent a numeric passcode via text to confirm your identity. My husband read it to me from his phone.

"1, 2, 3 … "

No, it couldn't be.

I laughed, and he continued.

The numerals 4, 5 and 6 did not follow. Phew.

I entered the code. Now, all I had to do was slide to the right and — voilà! — his credit file would be locked.

The lock was circling, but I figured it would take 10 seconds. After all, there are roughly 200 million individual credit files. That could take a while.

But several more seconds passed, and I started counting. I got to 90 before I was booted back to the sign-in screen.

I gave it another try. And another. And another still.

That's when we told Equifax. About 90 minutes later, a spokeswoman said the company had identified the issue and resolved it.

Except that it hadn't. The locking mechanism still wouldn't lock. A company spokeswoman said Equifax had not experienced widespread issues with the service, but, as with any new product, there had been isolated problems they were working to resolve. She also offered to put me on the phone with a technical support representative.

Why go to all of this trouble to cut off access to your credit file? Credit-card issuers, mobile phone companies and others generally won't do business with you without first checking your credit report with at least one of the three major bureaus: Equifax, Experian and TransUnion.

If companies can't get to your file, they won't issue credit. That protects you when thieves get access to your information and then try to open new accounts in your name.

Shutting companies out of your credit files has traditionally meant initiating something called a credit freeze. It often costs a few dollars and you have to use a PIN — which you may not remember or could lose — to temporarily lift the freeze when you do want to authorize access to your credit file. Getting a new PIN takes a fair bit of tedious work. (For a longer primer, see our consumer guide to the Equifax breach.) Freezes are also subject to a variety of state laws.

Equifax's new app offers a lock instead of a freeze. Locks works similarly to freezes — both restrict access to your credit file — but it should be easier to unlock your credit file since you can do it from your phone with a swipe, and doesn't require a 10-digit pin or a fee.

What is not clear, however, is what disadvantages may come with locks. Many state laws exist that govern freezes, offering consumers protection. By creating locks, the companies avoid them.

"Freezes are a right mandated by law and not conditional on terms set by companies," said Mike Litt, consumer campaign director at U.S. Public Interest Research Group. "Your rights as a consumer are on firmer ground with a freeze."

It isn't clear, however, what — if any — practical implication this will have.

We offered Equifax the opportunity to promise that their push toward locks will not cause the loss of legal or regulatory protections. The company declined.

The lock's user agreement does explicitly promise to never add an "arbitration provision" to that agreement.

But Equifax reserves the right to change any other terms and also wipes its hands clean of any liability, through another legal clause, should things go wrong. "Bottom line," said Chi Chi Wu, a lawyer at the National Consumer Law Center, "if the 'lock' fails and you become a victim of identity theft, you have no recourse."

Which is why vigilance is an important part of protection. Wednesday is the last day that you can sign up for Equifax's monitoring service, TrustedID Premier, which is free for a year. It will alert you to changes in your credit file, among other things.

Meanwhile, Equifax has also waived any fees that may be associated with freezing your credit files through the end of June. You cannot freeze and lock your files at the same time, so you'll have to choose.

We wanted to find a happy ending for the locking problems. So, after I tried to lock my husband's file five times with no luck, I changed course and obtained what we've been telling people to get for years: a freeze. It took all of a minute on Equifax's website.

Maybe in a year or two, Equifax will have its act locked up once and for all.