Credit Reporting Agencies Hoping to Melt "Freeze" Legislation

Consumer advocates laud reforms, while industry worries about unintended consequences

by Credit.com

The case for security freezes

Ten years ago, representatives from several leading consumer advocacy groups teamed up with California state lawmakers to answer a question about a serious problem: How does identity theft occur? Their conclusion was simple: in every known case of identity theft, a scam artist determined an unsuspecting victim’s name and social security number. If the victim had a satisfactory credit score, his or her information was then used to open a new line of credit, usually a credit card shipped to an address known only to the perpetrator.

Identity thieves make quick, high-volume hits—often charging, in a short space of time, thousands or tens of thousands of dollars worth of clothes, computers, digital television sets or other merchandise. Responsibility for the price tab on a fraudulent spending spree often falls on either the bank that issued the card, or the merchant who sold the goods to a thief. However, the victims shoulder other ongoing costs: legal fees, denied mortgages, threatening phone calls from debt collectors, and tedious hours spent trying to vindicate damaged financial reputations.

The California activists, among them members of PIRG (Public Interest Research Groups) and the Privacy Rights Clearinghouse, quickly realized the challenge of attacking the problem at the source of the breach. Thieves obtain names and social security numbers from any number of places—garbage bins, insecure computer databases, and other sources as yet unknown. Rarely is an identity theft’s exact method ever determined. Fighting the crime would be easier, then, at the next step in the process of a fraud—the point at which a thief creates a fraudulent account—through greater protection of the credit report itself. By limiting access to this key source of personal information, identity theft might be more effectively deterred.

Their solution was the “security freeze.” Known alternately as a “credit freeze,” the proposal offers consumers the opportunity to deny potential creditors access to their credit reports. With access to a consumers credit report cut off, creditors will generally deny an application for a new account. “It’s the only way that you can protect yourself,” says Ed Mierzwinski, an attorney with the National Association of State Public Interest Research Groups (U.S. PIRG) who worked on the issue in California.

Though credit bureaus offer fraud alert services for known victims and monitoring services that can help spot fraudulent spending on existing accounts, security freezes are the only tool available to consumers to stop identity theft before it occurs, says Scott Mitic, CEO of the California-based identity theft prevention company Trusted ID. He adds, “Every American should have the right to protect their data should they choose to do so.”

However, granting consumers the right to allow and deny access to their credit reports at will is new to the credit reporting system in this country. The credit histories of millions of Americans are shepherded exclusively by three private companies—TransUnion, Equifax and Experian – which only began allowing individuals free access to their credit reports (starting in December 2004) when Congress mandated they do so at least once a year. Before then, consumers wielded very little oversight of their personal credit histories. A credit freeze was unprecedented in the amount of control it turned over to private citizens.

To the chagrin of the credit bureaus, Mierzwinski and fellow consumer advocates began their push to enact state-level legislation that would make “security freezes” open to all consumers. (He prefers the term to “credit freeze,” which he derides as an industry expression with a more negative connotation.) The activists met early success in California, which approved the country’s first security freeze statute, effective January 2003. Since then, 24 other states have followed suit. Most, like California, extend security freeze privileges to all consumers. Only five are more restrictive, limiting the opportunity to freeze credit to those who’ve been victims of identity theft. (Texas is considering reversing its decision so that the option to freeze credit extends to all consumers).

Credit card-issuing banks and retail stores joined the bureaus in opposing these measures. The organizations expressed fear that credit freezes would interfere with day-to-day consumer activity. For example, a credit freeze might dissuade consumers from signing up for a store-branded credit card, because they wouldn’t want to bear the hassle (and cost) of unfreezing their credit reports. Even worse, the industry argued, confusion over how to unfreeze a credit report could prevent a consumer from securing a job or renting an apartment. Testifying in front of a Louisiana legislative committee in May 2004, a lobbyist for the Consumer Data Industry Association, which represents the credit reporting bureaus, referred to freezes as "the most dramatic and draconian alteration" ever to hit the credit reporting system.

A policy analyst with Consumers Union, the non-profit organization that publishes Consumer Reports magazine, sees the issue through a different lens. “This is one concrete tool we can give consumers,” says Susanna Montezemolo in a recent interview. “This is about giving people a choice.”

Proposed federal credit-freeze laws

The incoming Democratic Congress faces the choice of extending the credit freeze privileges offered by individual states to all Americans. Last year, two separate measures were introduced in the Republican-controlled House that would have changed the way credit freezes would be handled—one of them a pro-industry bill to set a nation-wide “victims only” standard for credit freezes (only proven victims of identity theft could institute a freeze) and the other a data security bill supported by consumer advocates. The latter addressed the issue by accepting the status quo, allowing states to author their own regulations, thus leaving the stronger state laws intact. Neither bill was argued before the entire legislature.

Generally speaking, advocacy groups favor legislation extending privileges to all, while banks, retailers and credit bureaus support “victims only” legislation. “Our main concern is that we make major changes to a system that has evolved over hundreds of years without understanding the repercussions,” says Maxine Sweet, vice president of public education for Experian. “It’s a ‘proceed with caution’ type of action.”

Laura Fisher, a spokeswoman for the American Bankers Association, points out that the type of identity theft which credit freezes are intended to remedy—when a perpetrator opens a new, fraudulent account in a consumer’s name—accounts for only a small percentage of total credit fraud. The majority, 73 percent according to 2004 Department of Justice estimates, occurs when scammers take over existing accounts, a problem credit freezes cannot curtail. Known victims who would benefit from credit freezes can take advantage of safeguards already in place: fraud alerts, for example, last anywhere from 90 days to a year depending on which credit bureau is enforcing them. Fraud alerts, placed on individual credit reports, serve as a red flag to creditors, prompting them to be more judicious in screening applications for new credit. The creditors are expected to call consumers to confirm approval for new accounts. However, the current system does not mandate this diligence on the part of the creditors, and consumer groups are quick to point out that the existing system has left an enormous number of people victims of account takeover or identity theft.

The industry argues that freeze legislation should be limited to victims and that this should be the national standard, if one is ever set. “Everybody might be concerned about a traffic accident, but they still continue to drive,” says Fisher. But Mierzwinksi, the most vocal of the consumer advocates, counters with his own vehicular metaphor, likening “victim only” policies to “saying you can’t have a seatbelt until you’ve been in a car crash.”

So far, it’s difficult to gauge the long-term implications of the state laws already on the books. Eleven of them became effective only this year. Eight new or revised laws will be effective by January 2007. Activist groups like PIRT and Consumers Union say that their efforts have been hampered by the three credit bureaus, which haven’t exactly gone out of their way to educate consumers about their credit freezing rights. (With the exception of Equifax, none of the web sites offers a clear path to such information.) More significantly, the agencies and financial institutions like the ABA have lobbied in support of the proposed legislation of 2005-2006 that would have created the narrower national standards for who has the right to freeze his or her credit.

How freezes work

In order to “freeze” their credit file, consumers typically send request letters including standard identifying information (i.e., name, address and social security number) by certified mail to each of the three credit bureaus. In states like Colorado, there is no fee to freeze credit. Other states, including California, charge everyone except victims of identity theft, who must provide legal documentation of a breach. Placing a security freeze usually costs around $10.

To undo a freeze (a “thaw” according to industry jargon), consumers typically incur a separate fee of $5 to $10. Most states ask for “thaw” requests to be sent to credit bureaus in writing, and they grant the bureaus three to five business days to honor them. But states including Utah and New Jersey have already mandated, effective September 2008, that bureaus unfreeze files within fifteen minutes.

Inevitably, procedural changes will lead to some confusion, and credit reporting agencies worry that the risks of a credit freeze may outweigh its advantages as an identity theft deterrent. “Any kind of credit transaction or other use of credit reports, which people many times don’t think about, can be held up, delayed or denied,” says Experian’s Sweet. Among the most significant legitimate transactions are those that deal with acquiring jobs or apartments. Some states have reacted to this viewpoint by exempting landlords and employers from a credit freeze, allowing them access to a consumer’s credit report even if it is frozen. Currently, only eight states allow landlords such unfettered access, while employers are granted the exemption in only three.

But then there are also less obvious concerns. “People just get surprised if they go to get a cell phone and they don’t realize that a cell phone, for example, is one of the biggest areas of fraud and most cell phone companies will check a credit report,” Sweet says. “People might not have their password at hand and aren’t prepared to get the freeze turned off.” She laughs when she adds, “You might say that’s a frivolous one—for most of us it’s not. It’s more emotional for people sometimes than a mortgage.”

However, some circumstances are clearly not frivolous, Rubinger says. “There might be more of an emergency situation. It’s ten degrees outside and suddenly your apartment is freezing. You don’t have money to pay for [a new hot water heater], and need somebody to come out to do the repair.” In order to open a new credit card to pay for this repair, Rubinger explains, a person would need to unfreeze their credit report, which by law could take up to three days.

Information not easily accessible

Consumer groups have charged that the agencies aren’t making it easy for people to figure out how to place and remove freezes. “When you go on the website for the credit bureaus, they don’t say ‘click here,’” Montezomolo says. In fact, none of the three agencies offers links to credit freeze information on their home page. Equifax has the easiest site to navigate for security freeze information, offering it within two clicks from the home page under a “customer service” heading. Experian and TransUnion’s sites, however, don’t make security freeze information easily accessible, even through links clearly designated for information on preventing fraud and identity theft.

Experian spokeswoman Maxine Sweet points out that the company doesn’t include information on the front page because it wants to be sure that it is distilling content on its web site only to those who are looking for it explicitly. “One of the challenges is that if that were on the front page, they’d be criticizing us for not making something else very obvious,” she says. “Initially we weren’t making it available at all when the first few states came on because consumers would come on, see something about file freeze, and go off looking for how to do it and it didn’t apply to their state—and once again, there was inconsistency from state to state.”

Making a new system work

Mitic’s company, Trusted ID, is shopping around a telephone-based platform that would facilitate the real-time “thawing” of frozen credit reports with all three reporting agencies simultaneously. He says that such an automated process could be set up, theoretically, within six months. If this were the case, there is no reason that reports couldn’t exist permanently in a “frozen” state, with agencies only thawing them at the consumer’s request. “If you can have instant credit, why can’t you have instant credit on freeze?” Mitic asks, quoting a line popularized by Mierzwinski. “In the world in which we live today, where technology makes possible just about any access required to instant information there are ways the credit bureaus could construct a way for a consumer to unfreeze a credit report.”  

Consumer advocacy groups point out that there is a financial incentive for Equifax, TransUnion and Experian to continue business as usual. The agencies make the majority of their money from retail and credit card companies, who routinely pay for individual credit checks on card applicants and for lists of people for pre-approved credit card offers. In the most severe case imagined, one in which everybody kept his or her credit perpetually frozen, credit freezes could impede on the ability to easily market and sell based on credit. Most industry experts agree, however, that this is an unlikely scenario.

More importantly, says Mierzwinski, credit freezes would render the three bureaus’ credit monitoring services null and void. Advertised as a means of combating identity theft, services that monitor credit reports from all three credit bureaus costs about $15 per month (single-bureau monitoring services cost less). Subscribers are alerted of credit changes on a daily basis. “It costs them pennies a month to provide,” Mierzwinski says. For those concerned about the takeover of existing accounts as well as fraudulent new account creation, monitoring is an expensive way to stay on top of credit, and not necessarily effective—given that consumers receive after-the-fact information, and that identity thieves often work fast. Of course, new account creation would be impossible under a credit freeze, which leads Mierzwinski to view this as the favored tool for consumers. He derides monitoring as a “useless, overpriced product” and claims the industry maintains it solely for the sake of its lucrative revenue stream.

Responding to critical suggestions that broader security freeze legislation could undercut credit-monitoring revenues, Equifax spokesman David Rubinger says the bureau is concerned about “balancing the needs of consumers and business customers.” Ten million consumers have purchased credit monitoring and other services from Equifax’s web site, which confirms that there is an “important marketplace” for them, he adds.

Security freezes, Mierzwinski says, require more personal customer service, an area he says is not one of the bureaus’ strong suits. “They don’t want to hire more people to help people. Credit monitoring is run by machines but credit freezes would require customer service,” he adds. Sweet says that while any hike in operating expenses is obviously of concern, the company’s opposition to sweeping security freeze laws stems from the potential impact on creditors, retailers and the entire credit economy. A spokesperson for TransUnion did not return several calls regarding this story.   

*

Return to Top