I have three credit monitoring services. Yeah, overkill. Though they are all paid services, I did not not pay for them. The first I got as a benefit at work. The second is complimentary from Equifax because my identity was compromised by their massive leak. The third is also complimentary from BestBuy because they screwed up like Equifax.
I’ve had my credit card number stolen three times. No identity theft yet… knock on wood. As a result, I’ve configured all my bank and credit card accounts to text or email me whenever there is a charge/debit or credit over zero cents. If a single penny crosses into or out of my accounts, I want to know about it.
Note: Kudos to Chase Bank for supporting all the above and including the dollar amount in the notification. Other banks aren’t as comprehensive and may not include the amount in the notification, which makes it impossible to tell whether it is a legitimate charge or not.
A few days ago, I learned about the Newegg data breach. Hackers had injected card skimming code into Newegg’s checkout process. The hack was active between August 14 and September 18. I had ordered a graphics card for my nephew on September 5 from Newegg. Darn it.
Yesterday and today, I received a flurry of text messages and emails from my credit monitoring services concerning a credit pull from Capital One Bank. I believe it is a hard credit pull which occurs when a bank is checking credit before making a lending decision. (A soft credit pull is when a hiring company is checking your credit as a background check.) Because there are three credit reporting agencies and I have three credit monitoring services, I received a total of nine alerts.
I called Capital One to inquire as to why they had issued an unauthorized credit pull. The Capital One representative said that they didn’t have any record of such an action and that I do not have an active account with them. So “don’t worry” were his parting words, which didn’t alleviate my concern at all.
Note: I’m not surprised that Capital One didn’t know that they had issued a credit pull. The credit pull could have been issued by a store that is partnered with Capital One, not by Capital One itself. And I doubt a customer service representative would have access to view actions which are not tied to an existing customer account.
Yesterday, I read that thanks to a new federal law, free credit freezes and year-long fraud alerts were available starting September 21. All of this (hack, unauthorized pull, and free credit freeze) seemed very coincidental to me. Or the Universe was telling me to do something… which I proceeded to do today.
Initiating a credit freeze with all three credit reporting agencies was not difficult. I just browsed to each of the agencies’ websites and searched for the term “freeze” until I located their credit freeze tool. Below is what to expect when doing a credit freeze at each agency.
Note: Each credit freeze requires a PIN (Personal Identification Number) to be set. Save the PIN because you will need it to unfreeze or temporarily lift the freeze. In addition, TransUnion and Equifax will require you to create an online service account with them.
Experian Credit Freeze
- Browse to the Experian website.
- Search for “Security Freeze” (in middle of the page) and click on it.
- Click on “Add a security freeze” and then “Freeze my own credit file”.
- Fill out the form, create your PIN, and submit.
TransUnion Credit Freeze
- Browse to the TransUnion website.
- Search for “Protected Consumer Freeze” (near bottom of the page) and click on it.
- Click on “FREEZE MY CREDIT” and then “Add Freeze” (with subtitle “Online”).
- Fill out the form and create a TransUnion service account. You will be logged into your account automatically.
- Click on “FREEZE” and input your PIN (6 digits max). You may see “REPLACE LOCK WITH FREEZE” instead if you have a lock on your credit report (see note below for what a lock is).
Note: I erroneously selected TransUnion’s credit lock feature, created a TrueIdentity account, and locked my report first. (TrueIdentity is TransUnion’s free identity protection service; yay, my fourth credit monitoring service!) A lock is the credit reporting agency’s own method of preventing access to your credit report. A freeze does the same but has legal protection from federal law. So if the credit lock is bypassed, the agency is not legally liable. If a credit freeze is bypassed, I suppose the agency will have trouble with the law.
Equifax Credit Freeze
- Browse to the Equifax website.
- Search for “Place a security freeze on my Equifax credit report” (at bottom of the page) and click on it.
- Click on the “GET STARTED” button.
- Fill out the form and create a myEquifax service account.
- Sign into the myEquifax account using your newly-created credentials.
- Click on “Add a Security Freeze” (not 100% certain on this wording) and the PIN will be created for you.
Note: In my case, I got a “Replace Lock with Security Freeze” option because I had earlier locked my report using Equifax’s TrustedID monitoring service.
Update: Innovis Credit Freeze
There is a fourth, little known credit reporting agency called Innovis. Evidently it is quite large (though not as large as the big three) and has been operating since 1970. You can request a credit freeze by browsing to Innovis and selecting the “Security Freeze Request Online” option. Innovis will then mail you a confirmation letter containing the 10-digit Security Freeze PIN.
Tip: If you wish to opt-out of receiving pre-approved credit card offers (very vulnerable to mail theft, followed by credit card theft), visit OptOutPrescreen.com. You can opt-out of “firm offers” online for 5 years or permanently by mail.
With the credit freezes in place at all four three credit reporting agencies, I can rest a little easier.