Security Breaches: What To Do Next

CONSUMER ALERT

BILL SCHUETTE
ATTORNEY GENERAL

The Attorney General provides Consumer Alerts to inform the public of unfair, misleading, or deceptive business practices, and to provide information and guidance on other issues of concern.  Consumer Alerts are not legal advice, legal authority, or a binding legal opinion from the Department of Attorney General. 

Security Breaches - What to Do Next:

A Step-by-Step Guide for Consumers Receiving Notification of a Breach

A "security breach" is a term used to describe a loss of control over information that is very personal to most Americans - your Social Security number, bank account information, medical records, and even your mother's maiden name.  It is quite frightening to think that any company or government may lose control of such information, but it actually happens more often than one might imagine.  This consumer alert provides a step-by-step guide for Michigan consumers who receive notification that their personal identifying information may have been compromised in a security breach. 

I Received Notification of a Security Breach - Now What?

There are some basic steps you can take to help prevent identity theft, or quickly detect identity theft, that may result after your information is compromised by a security breach:

1. Place an "initial fraud alert" on your credit file: Once you receive notice of a security breach, federal law provides you with a free and easy way to help minimize the risk of fraudulent accounts being opened in your name. 

An "initial fraud alert" is an alert, or flag, that is placed on your credit file when you notify a credit reporting agency that your information may have been compromised.  This alert, or flag, will make it more difficult for anyone to open an account in your name.  For example, if a potential identity thief attempts to open an account with a merchant in your name using your compromised information, ideally, the merchant would notice this flag and ask for additional information confirming the potential thief's identity.  If they don't have this information, the merchant should not open the account in your name. 

There are three major credit reporting agencies operating in the United States.  These are: 1) Equifax; 2) Experian; and 3) TransUnion.  Federal law requires the credit reporting agency that you notify to in turn notify the other two credit reporting agencies.  If you would like to contact any of the three credit reporting agencies via their toll-free numbers, or to request a fraud alert online, the information is provided below:

Equifax: 1-888-766-0008;
https://www.alerts.equifax.com/AutoFraud_Online/jsp/fraudAlert.jsp

Experian: 1-888-397-3742;

https://www.experian.com/fraud/center.html

TransUnion: 1-800-680-7289

http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/fraudAlert.page

Federal law also requires that the credit reporting agencies provide you with a free copy of your credit report after you place a fraud alert.  Be sure to review your credit report carefully, to ensure that there is no inaccurate information in your file and that no fraudulent accounts have been opened in your name. 

There are two important things to keep in mind when placing an initial fraud alert on your account: 1) the alert makes it more difficult for anyone, including yourself, to open an account in your name; and 2) the initial fraud alert will only stay on your account for 90 days. 

2. Consider placing a security freeze on your credit file: If you are worried about the possibility of identity theft, you should consider placing security freezes as quickly as possible after learning of a security breach.  Although security freezes are somewhat costly ($10 per file per agency - a total of $30 per person), they are a very effective way to prevent identity theft from occurring.  Once you place a security freeze on a credit file, you are the only person that can access your file, after you provide the credit reporting agency with your unique Personal Identification Number (PIN).  Security freezes do not affect your credit score.  They are especially helpful to residents who do not often apply for credit or employment, as there are also costs associated with "thawing" or temporarily lifting a security freeze. 

For more information on how to place security freezes on one's credit reports, please see the Attorney General's consumer alert entitled "Security Freeze Information for Michigan Consumers," which can be found here: http://www.michigan.gov/ag/0,4534,7-164-17337_20942-182414--,00.html.

3. Take advantage of any unconditional and free subscription to any credit monitoring, fraud resolution, or other service designed to protect and help you: Credit monitoring services may be helpful if you would like your monitoring service to alert you if there are any changes to your credit report.  That said, credit monitoring does not necessarily prevent identity theft.  As the name implies, most credit monitoring services simply monitor a consumer's credit report and notifies the consumer if the monitor believes they have been a victim of identity theft.  
   
   Sometimes, subscriptions to credit monitoring services can be costly.  However, if you are offered a free subscription to a credit monitoring service for a limited period of time, you may wish to consider utilizing this service, if for no other reason than the additional peace of mind a monitoring service may provide.  Before you decide to accept a free subscription offered to you as a result of a security breach, make sure you carefully consider any conditions placed on your acceptance of this subscription.  For example, will you be charged after a short free period?  Or will you only be provided a free subscription if you give up your right to seek additional legal redress?  If you decide to accept a free and unconditional subscription, but you would not like to continue subscribing to the service after the initial offer period expires (which means that you will have to pay to maintain the subscription), be sure to take all steps necessary to cancel this subscription once your free offer expires. 
    

ADDITIONAL RESOURCES ON IDENTITY THEFT PREVENTION AND RESOLUTION

For additional information on identity theft prevention and resolution for Michigan consumers, please see the Attorney General's Consumer Alert entitled "Identity Theft Information for Michigan Consumers," located at: http://www.michigan.gov/ag/0,4534,7-164-17337_20942-230557--,00.html.

Michigan consumers may also wish to visit the Federal Trade Commission's website devoted to identity theft, at http://www.ftc.gov/idtheft.  Michigan consumers may also wish to call the Federal Trade Commission's ID Theft Hotline, at 1-877-ID-THEFT (438-4338).

IF YOU HAVE A GENERAL CONSUMER PROBLEM, FILE A COMPLAINT:

For general consumer questions or complaints, you may reach the Attorney General's Consumer Protection Division at:

Consumer Protection Division
P.O. Box 30213
Lansing, MI 48909

517-373-1140
Fax: 517-241-3771

Toll free: 877-765-8388

www.michigan.gov/ag (online complaint form)