A month past the Equifax breach — the largest known theft of Social Security numbers in history — attorneys general around the country and members of Congress are launching both investigations into how this happened and bills to stop it from happening again. Those things, however, take time. And in the interim, your personal data is still at risk. Breaches continue to happen, an average of more than one every single day, according to the Privacy Rights Clearing House. So the big question is what can you do to protect yourself right now.
The answer is more substantial than simply freezing your credit. Here are five things to consider.
1. If you’re over 18, create a my Social Security account
Anyone over the age of 18 can set up an account with the Social Security Administration (SSA). That’s in case you need to apply for disability benefits — or access income summary statements to plan ahead for how much you can expect once you’re eligible for benefits. So why create an account even if retirement is far off? If you don’t, a criminal could do it on your behalf — and then apply for disability benefits (if you’re under 65), apply for Social Security benefits (earlier than you would have) or redirect benefits into a new bank account. “I’ve had people where, when they turned 70, they contacted Social Security — only to find out Social Security was paying someone under their identity for five years already,” says Carrie Kerskie, director of the Identity Fraud Institute at Hodges University. Just make sure that if you plan on creating a my Social Security account and freezing your credit (both good ideas), create the account first. (The SSA works with a credit bureau to verify your identity before opening your account. If your credit is already frozen, you’ll have to temporarily unfreeze it for this to work.)
Employment identity theft — when someone uses your information to obtain a job (and sometimes doesn’t pay taxes on what they earn) — is another form of identity theft.
Note: Once you've created your account on the SSA website, make sure your listed reported income is accurate — and keep checking on that every year. Employment identity theft — when someone uses your information to obtain a job (and sometimes doesn’t pay taxes on what they earn) — is another form of identity theft. If the amount is ever greater than what you filed on your tax return, that could be a warning that someone else is using your identity to cover their earnings. Contact Social Security (the phone number information is here) to let them know your income amount is not correct, and they’ll let the IRS know and begin the resolution process.
2. Expand your credit freeze
The next thing to check off your list if you haven’t already? Freezing your credit — or expanding your current credit freeze. A reminder: A credit freeze prevents new creditors from accessing your credit report. If they can’t see your report — and therefore the risks you could pose as a borrower — they won’t open a new account in your name. You get a special pin number — known only to you and the bureau — that allows you to unfreeze your credit in the future. Note that credit freezes do have a cost in most states, but it’s only once per incident — so you’d pay once to freeze your credit, then again when you unfreeze it. U.S. PIRG published an interactive map showing each state’s different fees. (In Maine, Indiana, North Carolina and South Carolina, it’s free to both freeze and unfreeze your credit.) Below is an outline of how to freeze your credit at each bureau, including a smaller bureau (Innovis) and a utility-related one (NCTUE).
- Equifax: Go to the bottom of the page and, under “Credit Report Assistance,” click on "Place a Security Freeze on Reports." Note that Equifax says it’s waiving credit freeze fees until November 21 of this year.
- Experian: Under the Credit Report Assistance tab, click on security freeze, then click "Add a Security Freeze.”
- TransUnion: You can try to do this online, but it can be easier to do it through the phone. The phone number for TransUnion's Security Freeze Line is 1-888-909-8872. (It asks you to enter your current mailing zip code, then press option 3 to get through the maze. After that, it'll ask you to enter some personal information, like your Social Security number, to get started.)
- Innovis: This is a smaller credit bureau, but if you’re already on a roll with freezing your credit, it doesn’t hurt to do it here, too. Under “Personal Solutions,” go to “Security Freeze,” then submit the Security Freeze Request Online Form. By phone, you can request a freeze by calling 1-800-540-2505.
- National Consumer Telecom & Utilities Exchange (NCTUE): This industry-related credit bureau mostly deals with utilities and phone lines, says Kerskie. Power, water and other utility companies — even cell phone companies — might pull this report instead of one from the big three credit bureaus, meaning if you don’t instate a freeze, someone could feasibly open an account in your name. On the website, click on “Consumers,” then scroll down to “Security Freeze” and click here.
3. Make sure your credit is actually frozen
When you attempt to place a freeze on your credit report, there’s a good chance a credit bureau will try to sell you extra credit monitoring services or talk you into a fraud alert instead. (To recap: A fraud alert means that if someone tries to open a new account in your name, the potential lender is sent a note saying there might be fraud associated with the account. They’re also sent an extra way to verify your identity (usually your phone number). The key here is there’s no mandate saying the lender has to verify your identity — meaning they might go ahead and open the account anyway.)
When you attempt to place a freeze on your credit report, there’s a good chance a credit bureau will try to sell you extra credit monitoring services or talk you into a fraud alert instead.
Another thing a bureau might try to sell you? A “credit lock,” which usually comes as part of a credit monitoring service and gives consumers the option to “lock” and “unlock” their credit through the bureau’s website or app. The result is similar to a freeze, but one big difference is the price of the service. For example, Experian offers a first-month introductory price of $4.99 — then bumps it up to $24.99 a month after that. For TransUnion, a credit lock costs $19.95 a month. Equifax has said that starting January 31, it will offer free credit locks for life for consumers. A credit lock “gets extremely expensive, and every bureau has a different fee range on it,” says Jerry Irvine, CIO of Prescient Solutions. “For Illinois, [a credit freeze] is $10 a request… a heck of a lot cheaper than that $25 a month.”
So if you’re aiming to get a credit freeze, stay strong and don’t hang up the phone (or end your website session) without obtaining an actual freeze. “When you end that call, if you do not have a pin number, you do not have a freeze,” says Kerskie.
4. Set up online access for all your important accounts
Your next move: Setting up online access for all your sensitive accounts — financial institutions, utilities and communications companies — so that someone posing as you doesn’t do it first. Without an existing online account, it’s not very difficult for a hacker to call up a company and ask to set up online account access. Armed with your name, address, date of birth and Social Security number, they’ll likely be able to do it, too, and that opens the door to all sorts of fraud. Once you do set up these accounts — it can usually be done on the company websites or via phone — update your account settings so that you’ll receive an email about any future changes to your password, mailing address, etc.
Even if you think you might not get a tax refund this year, someone posing as you can input fake salary and other financial information to get a refund.
5. File your tax return as early as possible
Finally, taxpayers will be able to file in to mid- to late January this year. The exact date hasn’t been established yet and will likely be announced in early January, according to the IRS — but that doesn’t mean you can’t start getting documents together ahead of time. Why get a jump on things when the deadline usually isn’t until mid-April? “Otherwise someone else can file using your Social Security number, which can cause major headaches down the road,” says Ben Rossen, a senior attorney in the FTC’s Division of Privacy and Identity Protection. Even if you think you might not get a tax refund this year, someone posing as you can input fake salary and other financial information to get a refund. Thieves have got it down to a science, says Kerskie, when it comes to figuring out how to snag the largest refund with the least risk of being audited. So keep an eye out for that early filing date, and in the meantime, start gathering your documents to avoid post-holiday stress. Here’s a checklist of what you’ll need.
With Hayden Field
Want more tips like these? NBC News BETTER is obsessed with finding easier, healthier and smarter ways to live. Sign up for our newsletter and follow us on Facebook, Twitter and Instagram.