March 18, 2006
Your Money
Opening the Door on the Credit Report and Throwing Away the Lock
By DAMON DARLIN
In a dozen states, legislatures have set up procedures for residents afraid of identity theft to lock and unlock their credit reports.
But credit-reporting agencies are pushing Congress to override the state laws, which could make it harder for Americans to keep their credit information under wraps.
Lobbyists for the big agencies — Equifax, Experian and TransUnion, owned by the Marmon Group — are seeking to add an amendment to the Financial Data Protection Act, a bill being rewritten by the House of Representatives. (A similar bill, S1408, is working its way through the Senate.) While the wording has not been set for the bill, also known as HR3997, lobbyists for the credit agencies are pushing for a law that limits the ability to lock credit reports to victims of identity theft. Moreover, the reports could be unlocked with five days' advance notice.
Once a report is locked, an agency cannot release any of its details.
Consumer groups are upset that a federal law might supersede what has been done at the state level.
"Is Congress going to go soft on crime?" asked Abigail Caplovitz, legislative advocate at the New Jersey Public Interest Research Group. Her group thinks that a law it pushed through the New Jersey Legislature last year cuts down on identity theft because it makes it relatively easy and inexpensive for consumers to lock and unlock their credit reports. "Unless a credit freeze is user-friendly, it is useless because it won't be used," Ms. Caplovitz said.
Even if Congress does nothing, protecting credit information is going to become more complicated and inconvenient as more states pass laws that try to balance protecting consumers and protecting the credit-reporting industry.
Before we get to the advice, let's take a look at what is at stake here. The New Jersey law, which went into effect in January, permits any resident to freeze access to a credit report free. A thaw costs the consumer $5 an agency. The law also calls on the agencies to set up technology allowing credit to be thawed as quickly as 15 minutes after notification. Utah recently passed a bill, as yet unsigned by the governor, that would require the credit agencies, by 2008, to switch a lock on or off in 15 minutes.
The lag time is important because a three- or five-day delay could prevent a person from making a spur-of-the-moment purchase. Merchants may lose sales if they have to wait several days before they can verify a customer's creditworthiness. By then the consumer's urge to buy may pass — which, for some people, might not be such a bad thing.
Getting Americans to spend less and save more is not what the credit-reporting agencies are after. And there is no technological barrier that makes a quick unlock impossible. They are concerned that each state will have different rules and prices. That is already happening. Nevadans pay the most: $15 to lock and $18 to unlock. It is free in Illinois, Texas, Washington and Vermont, but only fraud victims can do it.
The agencies also dislike laws like New Jersey's because they fear that making it too easy to lock a credit report may ruin their business in the way that the Do Not Call list decimated the phone solicitation business. The companies' main business is selling credit information to potential lenders, insurers and even employers.
The ability to turn credit reports on and off is a "false promise," said Stuart Platt, president of the Consumer Data Industry Association, the trade group that represents the credit reporting industry. He said it could damage an industry that has helped to reduce the cost of credit by helping lenders manage risk.
Locking reports, however, does not stop credit card solicitations. That can already be done by calling 888-5OPTOUT (888-567-8688). The ban lasts five years.
Congress will not take a vote on the full Financial Data Protection Act until fall. In the meantime, the confusion in the current system presents an opportunity for businesses to charge consumers who want to protect themselves. They have already scared Americans with statistics like, nine million Americans were victims of identity theft. Never mind that most cases labeled identity theft are simple fraud resulting from a lost or stolen credit card, according to Federal Trade Commission statistics. A consumer's liability is limited to $50 in those cases.
But the marketing campaigns seem to be working. Ten million Americans already pay about $100 a year to protect their credit information. In other words, it is already a $1 billion industry. Consumers will probably be paying more, though they don't always need to.
There are various levels of protection. Every year, a person can go to annualcreditreport.com for a free copy of all three credit reports or space them out over several months. There is no reason to ever pay for this service. Look it over for errors. (Making sense of credit scores, which determine your rate of interest, may be getting easier. This week, the three agencies said they had created a VantageScore, a single scoring system that each company will use.)
If you are worried about someone opening accounts in your name, you can call or write one of the agencies to put a fraud alert on your account. Each has the responsibility to alert the other two. The protection lasts 90 days. An additional 90 days are available but you will have to write to each credit bureau and ask. You have to keep doing this for as long as you want lenders to double-check with you.
When this fraud alert works correctly, lenders are supposed to take extra precautions before extending credit, but they do not have to do this. It could be a simple as asking for additional identification, but others may want to call you and ask for other information.
One drawback of fraud alert is that you may find it difficult to take advantage of instant-credit offers at stores. (Though this, too, might not be a bad thing. Opening too many lines of credit in a short period of time will harm your credit score.) Sometimes you may be denied credit because the lender does not want to go through the extra verification.
Another drawback is that while it is simple to sign up for a fraud alert, it is difficult to get off the list when you find it more trouble than it is worth. You have to make the request in writing and provide documents attesting to your identity.
An alternative is credit monitoring, but these services will cost you. TransUnion's TrueCredit offers three-bureau credit monitoring for $15 a month, while Equifax's Credit Watch Gold is $13 a month, also for three bureaus. A consumer is notified by e-mail after a new credit card has been issued or when a chunk of a home equity line of credit has been used. But after a while, those messages sound like the little boy who cried wolf and you might start ignoring them.
"They tell you after the fact," says Scott Mitic, vice president for business development at TrustedID, a start-up company that intends to take advantage of the confusion surrounding the protection of credit information. "It is this reactive system that irked us."
Mr. Mitic, a former executive with Fair Isaac, the company that created the formulas for computing credit scores, and Omar Ahmad, chief technology officer at TrustedID, were introduced on what they call an "entrepreneurial blind date." They discovered a shared interest in identity theft and they came up with a way to profit from it.
"No one will confuse the credit bureaus' customer service with Nordstrom's," said Mr. Ahmad, a former chief information officer at Napster.
TrustedID plans to automate the process of locking and unlocking credit reports. When you want your credit locked or unlocked, for instance, when you intend to buy a car or apply for a mortgage, TrustedID will send the agencies all the paperwork and the fees and charge you $8 a month or $90 a year.
You could do it yourself for far less, especially if you live in one of those states where the service is free. But the company is counting on the process being so onerous that you would pay them to do it instead. Indeed, the notion that people will pay extra for the convenience of protecting their credit reports is so compelling that the company has attracted financing from one of Silicon Valley's top venture capital firms, Draper Fisher Jurvetson.
The bottom line: Those few people who have been victimized by identity thieves — not credit-card thieves — and continue to be vulnerable should take the extra precautions. For everyone else, all these services are just going to be one more hassle.
E-mail: