The official title of this post is “Unlocking Frozen Credit Without a Pin,” but the unofficial title is “Unlocking frozen credit, the lost pin fiasco, and the three ring circus.”
Ever since the absurd Equifax hack, the Handy Millennial has been a little uncomfortable. Uncomfortable because while the public outrage was swift and loud, the consensus opinion has been, “freeze your credit and everything will be fine.”
Well, my dear reader, it may not really be fine. In fact, freezing your credit is a little bit like tying your shoe laces together so someone else doesn’t steal your shoes. It’s at best an imperfect solution and at worst yet another swindle pushed on the average person to make them feel safe. The trouble with that last statement is that while we don’t want people to be scared (never scared, always educated – that’s the Handy Millennial motto!), we do want them to be vigilant.
But really, how vigilant can you be when you think you’ve frozen that sucker so deep no one can get to it?
The Biggest Problem with Credit Freezes is the PIN
Ok Handy Millennial, what is the problem? The biggest problem with credit freezes is the PIN. The personal identification number (PIN) issued to you is a big Big problem. Why, you may ask? Well, when was the last time that you kept anything forever? Go on, I’ll wait… Take you time… Okay, now this is getting a bit long so I will jump in and help you: NEVER! You see my dear reader, it’s simply not human to remember something like this – 2347862347823473265 – forever.
And by the way, even if you do happen to be careful and keep that pin forever you still might lose it. Why? Well because in order to keep something like this forever and secure you must put it on a piece of paper (yeah, not on a note in you iPhone or in a Document on your Desktop titled – My Equifax Pin). And if you do write the pin on a piece of paper, it better be acid-free paper with special ink otherwise this might happen:
That’s right! Ink actually fades if it’s not printed on acid-free paper and stored in just the perfect conditions. Check out the US Constitution in Washington DC for an example of a forever document, or closer to home, your receipt drawer for a receipt from last year.
So basically storing your pin forever is a lost cause. And because of this your average person will need to re-request that magical number. This is where we get into a bit of a pickle. Because you see my dear reader, it turns out that the process to re-obtain that PIN is not secure at all!
What to do if you lost your Pin
To see how insecure it actually is, let’s go through all three major credit reporting bureaus (yes I know there are 4, but trust me you’ll get the point) and see what they their procedures are for unlocking your frozen credit without your PIN!
We begin with Experian! While TransUnion and Equifax are moving towards offering an actual convenient solution for consumers to lock their credit, Experian is basically saying, “Nope! That’ll be $25 a month, thanks!” Apparently, like Janice in accounting, they just don’t give a fuck.
So let’s say you lost your PIN, then you go to the Experian website and you find this:
Okay, my dear reader, let’s play a game – we’ll call this information roulette: what information requested by Experian might appear on your Equifax credit report.
- Date of Birth?
- Social Security Number?
Oh and look, you can provide an email to get the results faster!!! How convenient!
So essentially, the thieves took the keys to the kingdom, and the best we can do is ask them what color the key is! And t Experian is the company who has done no wrong and sees no point in launching new and free tools to the consumer.
Let’s move on to TransUnion. Coincidentally, probably one of the more responsible credit agencies. Why? Well they already have a free credit lock, and they have double blind processes for credit such as background checks for renters. In case you aren’t familiar, double blind means that neither side sees the sensitive information.
Anyway, back to recovering a lost pin and such. A quick Google search tells me that there is actually no easy to read and understand page from TransUnion on how to recover your pin. Right away, let’s take some demerit points. Seriously? In the age of the internet, not being able to find an answer should be a capital crime.
So then we resolve to looking on third party sites like aprfinder.com (no idea if this is a trustworthy site but I didn’t call TransUnion) which informs us that you:
- Call 1-888-909-8872
- You will be prompted to respond to identifying information from your credit history. Key word here is prompted. Meaning this is probably an automated system. And therefore probably will give you multiple choice questions.
Fun sample! Will Johnny lose all his money today or just some? A. Yup B. WTF is this? C. I’m not playing anymore D. No one cares and you’re screwed.
Let’s repeat our cutesy game – information roulette: which information could be used by the TransUnion during the automated phone that could also have been on your stolen Equifax report?
- Personal Identification Information such as Name or Birthday?
- Credit history?
- Residence History?
At this point, you should be rolling your eyes because this is clearly ridiculous. Alternatively, you can hide in a bag and scowl at the world.
This brings us to the last of the champions: Equifax. Master of the Universe! Keeper of our secrets! You must be protecting us well, right? Right?!
Okay, let’s give them some credit. They do have a section called: “What to do if I lose my security freeze PIN?” and also a helpful list of documents you need to prove your identity! Let’s check it out!
Let’s play Round 3 of our game!!! Which information requested by Equifax might be on the stolen Equifax report?
- Social Security Number?
- Driver License Number?
- Birth Date?
Twist! Which of these documents does not have a Federal standard of security, thereby making it a big risk for falsification? (Don’t even tell me you didn’t think of that. How much CSI have you watched?)
- State ID (Apparently some state IDs are nothing more than a laminated card with a picture glued to it.)
- Birth Certificate?
- Cell Phone Bill
- Utility bill with correct address?
- Valid Driver License?
Instead of commenting, I’ll let this nice gentleman tell you what to feel.
This is a mess! Can’t we use the free Lock services instead?
To be fair the solutions here are not easy. Ask yourself, how would you identify a person?… See, not obvious.
So maybe the solution is to use a free locking service, again by our favorite actors. So far TransUnion has one, and Equifax will be launching one by Jan 31, 2018. Not a bad solution because if the freeze is imperfect, the lock (just as imperfect) gives you better flexibility.
One big caveat. Freezes are guaranteed by law: if you freeze your credit you are not responsible for fraud! Locks are a contractual agreement between you and the credit agency. As I wrote in my post on Fraud in Security Accounts, that is a shaky stool to sit on.
Why we need new technology and some rules
So what can we do? The short answer right now is… nothing. The long answer is push for new regulations. You see my dear reader, life in a capitalist market-based society is determined by consequences. Right now, there are little consequences for the credit bureaus when your info gets stolen.
Little consequence means little action. If you want action and innovation here, you need to have a stick and a carrot.
Stick = legal financial liability,
carrot = keep making $$$ off people who never even think about you.
Once we create the right incentives and rules of the game, we need innovation. We need some really smart people to get together and come up with new and creative ways to tell us apart. Why? Because like it or not, you are part of the system and it’s in your best interest if it functions well and protects the actors within.
But it won’t happen to me!
“But wait! Mr. Handy Millennial, the odds that out of 140,000,000 files mine will be used to steal my identity are pretty small!”
“Okay, then I probably don’t have to worry because if I freeze my credit no one will try to hard to break into it.”
Umm…. not so fast.
While your credit report does not have your salary, assets and net worth, one can make some educated guesses as to whose identity might be more worth stealing. For example, would you steal an identity of someone that has 12 maxed out credit cards, a car loan and a mortgage? If you guessed NO, that would be the right answer.
On the other hand, would you work at stealing the identity of someone who has an $80,000 line of open credit but only uses $5000 monthly? Why sure, that might be a good one to work on!
You see my dear reader, the right answer here isn’t necessarily the easiest one, just the most profitable. And if there is anything the Equifax hack did, it provided a nice big database to explore for opportunity.
Last but certainly not least, the provided information is also often used to identify customers at other sensitive financial and societal institutions. This alone should make us all do a double take. Here is a non-exhaustive eye opening list:
- Brokerages – ex. Fidelity and Vanguard
- State License Centers
The hope is that these places link to some kind of superior verification system. Wanna bet?
The Handy Millennial would like to conclude this post by saying that nothing written within is intended to be an attack on the mentioned companies. The Handy Millennial does not think badly, wish ill will, or otherwise harbor any negative feelings. This is merely a discussion of the facts as observed by the Handy Millennial and his (perhaps not so gentle) opinions. But the Handy Millennial believes that we must clearly understand what is happening, the rules of the game and where the pitfalls lie. It is only after we have educated ourselves, thought deeply about our problems, and critiqued our own way of life that we can truly begin to learn and move forward.
And this, Moving Forward, is what this blog is and always will be about.