Why a Credit Freeze Beats Equifax’s Free ‘Credit Lock’

Equifax has made us an offer that seems too good to be true.

In the wake of a hack on its system that put potentially 143 million consumers at risk of becoming fraud victims, the credit reporting company said this week that it plans to offer consumers a credit lock — free and for life.

Equifax’s new interim CEO, Paulino do Rego Barros Jr., publicly announced this new service in the Wall Street Journal. He wrote:

“By Jan. 31, Equifax will offer a new service allowing all consumers the option of controlling access to their personal credit data. The service we are developing will let consumers easily lock and unlock access to their Equifax credit files. … Most significantly, the service will be offered free, for life.”

That’s about the extent of what the interim CEO said about this new credit lock. But Equifax’s “Cybersecurity Incident” website provides a little more detail, namely that “consumers will be able to use their smartphone or computer to lock and unlock their Equifax credit file directly and quickly.”

Credit locks versus credit freezes

From the day news broke that Equifax had been hacked, experts have offered the same advice to consumers affected by the data breach: Put a freeze on your credit reports.

So, what’s the difference between a credit freeze and a credit lock like the one Equifax is pledging to offer for free for life?

Equifax answers this question in four sentences on its cybersecurity website. The first two sentences say that “at their most basic level,” freezes and locks accomplish the same end. The second two sentences, however, show that freezes and locks work differently:

• “Security freezes were created in the early 2000’s, are subject to regulation by each state and use a PIN based system for authentication.
• Credit file locks were created more recently, are mobile-enabled and use modern authentication techniques, such as username and passwords and one-time passcodes for better user experience.”

Perhaps the most important difference between freezes and locks is that only freezes are generally regulated by law. The Consumer Financial Protection Bureau explains:

Forty-seven states and the District of Columbia have laws that govern the procedures and requirements for security freezes and how much you can pay for them. For the remaining states (Alabama, Michigan and Missouri), the nationwide credit reporting companies have voluntarily given residents the opportunity to place freezes.

Chi Chi Wu, a lawyer at the nonprofit National Consumer Law Center, tells Consumer Reports that because state laws regulate freezes, consumers are not liable for losses if the freeze goes awry. If your credit accounts are fraudulently accessed while your credit is frozen, the law will protect you from financial liability.

If a lock goes awry, however, “it’s not clear who would be liable,” Wu says.

Consumer Reports likens locks to a contractual agreement between you and the credit reporting company — Equifax, Experian or TransUnion are the “big three” nationwide — through which you lock your credit.

Christina Tetreault, staff attorney at Consumer Reports’ advocacy arm, Consumers Union, explains:

“Having a contractual agreement is not as strong as having protections under law. The contract may be unclear, may include provisions that allow the other party to change it, or include provisions that you may be better off not agreeing to, such as an arbitration agreement.”

One downside of credit freezes worth noting is that they require more effort on the consumer’s part. As we detail in the “After Equifax Data Hack, Should I Freeze My Account?” post, fully freezing your credit involves putting a freeze on your credit file at — and generally paying a fee to — all three nationwide credit reporting companies.

A freeze also requires you to not lose the personal identification number (PIN) that you will receive from each company; you will need the number to unfreeze your credit.

There’s a reason that credit freezes are more arduous than alternatives like credit locks and credit monitoring, however. Credit freezes offer the strongest protection, which is why experts have urged consumers affected by the Equifax breach to freeze their credit.

Should you ‘lock’ your Equifax credit file?

Equifax’s new credit lock service is not a finished product that’s available to consumers right now.

The interim CEO used the words “the service we are developing” to describe it, suggesting it’s still in the works. Further, he said it won’t be available for up to three months. We don’t yet know the terms of the service, that is, the “fine print” you would be agreeing to if you signed up for the service.

Equifax has already given consumers reason to be wary of the fine print attached to its services.

The U.S. Public Interest Research Group, a federation of consumer advocacy groups, noted this week that the terms of the free credit monitoring service that Equifax is offering to folks affected by the breach initially “came with strings attached — specifically, signing away your right to a day in court in the future.” The company removed that arbitration agreement from the fine print only after public outcry.

The U.S. PIRG’s statement continues, “The best way to protect yourself from an identity thief opening a credit account in your name is still by getting credit freezes at all three credit bureaus.”

If you’ve yet to confirm whether your data was jeopardized in the breach, you can do so through a webpage Equifax set up for this purpose.

What’s your take on the news of Equifax’s new lock service? Sound off below or on our Facebook page.