National Oct 6, 2017

Equifax credit breach

Recently, Equifax made the news when it announced an information breach affecting approximately 140 million Americans. This breach is different from the other breaches because Equifax stores personal information of financial identity, including Social Security and driver’s license numbers and credit card numbers—basically every aspect of a person’s financial identity.

So far, New Hampshire and New York are the only two states in our readership that have addressed the Equifax security breach. However, every state; including Connecticut, New Jersey and Vermont, allows individuals to put a credit security freeze on their personal information, so unauthorized individuals are unable to access the information.

It also is coming to light that Equifax was remiss in creating the most basic standards or procedures to protect consumers’ information from hackers. It is because of this threat that New York Gov. Andrew M. Cuomo introduced legislation to give the New York State Department of Financial Services oversight of credit reporting agencies. Under the proposed regulation, all consumer credit reporting agencies that operate in New York state must register annually with the NYDFS.

As it stands now, all credit reporting agencies must comply with the department’s cybersecurity regulation, which requires banks, insurance companies and other financial services institutions regulated by the NYDFS to have a cybersecurity program with goals to protect consumers’ private data.

Insurance and the credit score

Insurance companies have determined that certain attributes in a credit report can reliably predict claims activity. Using credit scores, insurance carriers have created an insurance score, which closely resembles a credit score. These insurance scores are then built into the carriers’ rate-making schemes. Actuaries have determined that the lower the score, the greater potential probability that a claim will occur from that individual. So, carriers have built rating variables into their rate making, which charges a higher rate, or premium, for risks that have low insurance scores. So, suffering a breach to an individual’s personal credit data could have an effect on his or her credit score and, ultimately, an insurance score, which could lead to higher premiums.

Credit freeze

What is a credit security freeze? A consumer report credit freeze or security freeze limits a consumer reporting agency from releasing a credit report or any information from the report without authorization from the consumer.

All 50 states and the District of Columbia have enacted legislation to allow consumers to place a "security freeze" on their credit reports. This is supposed to make it impossible for anyone to access a consumer’s credit report unless the person unlocks it first. Credit freezes are a great tool to block lenders and credit card issuers from accessing a report without a consumer’s knowledge.

As stated above, the credit score can be used by insurance carriers to determine their rate-making algorithms. So, if there is a credit freeze on an account, and the carrier cannot access the information, then the carrier will not be able to process that renewal or application if the information is missing. Think of it like this: It is similar to applying for an auto policy, in which the carrier does not have information on the type of vehicle to be insured. Without that information, they cannot process the business. If they cannot process the business; they cannot renew or issue a new policy.

However, there are loopholes. For example: The Consumer Credit Reporting Security Freeze law in New Hampshire does not apply to the use of a consumer report by any person or entity for use in setting or adjusting an insurance rate or claim or underwriting for insurance purposes. (New Hampshire Revised Statutes Section 359-B:24(XVIII)(j))

What if the consumer lives in a state other than New Hampshire? For the insurance carrier to complete the renewal or application process, it would have to be able to access the credit information. However, with if the consumer has instituted a security freeze on his or her account, the carrier would be unable to complete the process. To remove the freeze, the client or insured would have to contact the credit reporting agency and ask it to remove the security freeze. Once the process was over, the consumer would need to reinstate the security freeze, which usually costs about $10.

Is there another alternative? There are several third-party companies that can monitor a person’s line of credit—all for a monthly or annual fee. Many of these advertise on TV and radio.

The bottom line is: It is becoming increasingly obvious that individuals are solely responsible for the welfare and protection of their credit data. The Equifax breach has shown that even agencies that purport to store and protect such data cannot be relied on to provide consumers with peace of mind.