Can Victims of the Equifax Breach Simply Ignore It?

Last week, Equifax revealed a security breach that may have compromised the personal data of some 143 million customers—Social Security numbers, birth dates, addresses, and driver’s license numbers are all potentially in the hands of hackers. And yet as of Sept. 12, only around 15 million people had visited the Equifax website to check their breach status. That’s roughly 10% of those potentially affected.

It’s possible that many people already know what to do—a temporary credit freeze is a good place to start—or are planning to look into it in coming days. But it seems likely that many more people aren’t doing much of anything, either because they don’t know about the breach (Equifax is not emailing or even definitely confirming affected parties) or aren’t sure whether taking action will actually have an impact.

So what are the consequences if you decide to do, well, nothing at all? Quartz put some questions to Eva Casey Velasquez, president and chief executive of the Identity Theft Resource Center (ITRC).

This post has been edited and condensed for clarity.

If someone chooses not to do anything… is that OK?

The reality is this is one of the few situations where sitting back and taking a wait-and-see approach is really detrimental. I understand when people go, Hey I need to wait until the facts come out before I can make a decision on how I move forward. That’s very logical and I applaud that. But in this case, the steps that you can take here are good steps regardless of whether or not you have been affected.

We’re telling people to pull and read their credit report. Most people don’t do that on a regular basis; now would be a great time. There’s no downside. If you weren’t affected by this breach, it’s not like you wasted your time doing that. It’s a solid consumer-protection move. Then go ahead and either freeze your credit or look into taking advantage of the free services that the credit-reporting agencies are offering for a year and evaluate those. Those positive proactive consumer steps are not going to hurt you. So to answer your, “is that OK?”—I would say, emphatically, no.

What’s the most likely scenario if a person chooses not to act? What’s the worst that could happen?

The most likely thing is that you will have your information misused in some manner and you will end up needing to resolve that issue. There are a number of types of identity-theft cases where resolution takes maybe a couple of weeks to a couple of months, and you will be distressed and inconvenienced.

The worst thing that could happen is that you ignore this problem and allow it to fester over time. You then have multiple identity-theft incidents across multiple silos that will take you years to clean up. It will most likely have some kind of negative impact on your life during a critical time, whether you’re trying to get a job or purchase a home, maybe get a car loan, maybe get a student loan.

That’s not hypothetical. We talk to victims all the time that are going through those types of issues. One was pretty recent: This couple was trying to refinance their house, and while going through that process they noticed things pop up on their credit report that were unfamiliar to them. Long story short, because of the relative newness of the transactions and what was going on, the issues didn’t stop them from refinancing their house and getting the interest rate that they wanted. So guess what they did about the weird stuff they saw? They did nothing. Fast forward four months and they were getting inundated with collection notices and calls. They had all kinds of new credit cards opened in their name. Not only had the original issues festered and were now harder to resolve, but now they had multiple new ones as well.

What should people be looking for once they obtain their credit report?

They need to look for any accounts that are unfamiliar, and they need to be thoughtful about that. Sometimes it can be an older account that really is yours—maybe it was the car you paid off two, three years ago. But it really isn’t that hard when you look line item by line item.

If you see cards or loans that you don’t recognize, you have to follow up on those immediately. Call the issuer of the credit, ask to get the information on that account, and report it as fraudulent, and then also contact the credit-reporting agencies. Remember, the credit-reporting agencies are not the issuers or the creators of this data. They are just reporting the data that’s fed to them.

How does getting a credit freeze resolve the issue? If your Social Security number has been stolen, a temporary freeze won’t keep you protected, right?

With a credit freeze, you can freeze and unfreeze. What a freeze does is it locks your credit for whatever period of time you decide. And it does not affect the accounts or relationships that you currently have—your current credit card accounts, your mortgage, your car loans, any of those things.

So you decide to get a credit freeze and then you want to buy a new car. You lift the freeze temporarily. You allow that entity to run your credit so that you can get the financing. And when that is complete, you put the freeze back on. You are issued a pin that allows you to do that.

So is this something you’re advising consumers to do for the rest of their lives? They should default to having a credit freeze in place and only unfreeze it when they actually need to take out a loan or open a new credit card?

We advise people to strongly consider it. The main reason people don’t do it is the hassle factor. They want open and free access to their credit whenever they want. But what that creates is open and free access for thieves as well. It’s sort of like saying, “I don’t really want to be hassled with locking and unlocking the deadbolt on my house every time I want to come in and out, so I think I’ll leave it open.” Nobody does that. Everybody goes, I have to secure my home. It’s sort of the same mentality.

There are some exceptions to the rule, and there are some legitimate reasons why this isn’t always a good fit. You do have to remember a pin, and you do have to be vigilant about not losing that pin because there is no process in place for the credit-reporting agencies to replace it. The other factor is there are fees associated with freezing and unfreezing your credit. It can be anywhere from $5 to $10 per credit-reporting agency. For some folks, that’s not something that they can afford. (Editor’s note: To freeze your credit, you must freeze it with all three agencies: Equifax, Experian, and TransUnion.)

What level of hassle should people expect if they decide to make credit freezes a lifelong habit?

Theoretically it is supposed to happen very quickly, but it doesn’t always. People can expect that they’re not going to get an instant answer. They can circumvent that with a bit of planning. Back to the car analogy: You’re going to go car shopping. If you know which dealership you’re going to, even if you haven’t purchased the car, you can call that dealership and ask which report they pull. They’ll say, for example, “We use TransUnion,” and you go ahead and unfreeze that account temporarily.

Is there anything else people should know?

We really focus on the financial aspect here and that’s important, but the information that was breached can be used to commit multiple types of identity theft. You are still unfortunately at risk for things like criminal, medical, and even government benefits and documents fraud. The steps that we’ve talked about with your credit do not have any proactive, preventative ramifications for people on these fronts.