Editorial: Get tough on Equifax and its ilk

Wednesday, September 13, 2017

When a Bedford Falls resident went to Bailey Building and Loan to borrow money, George Bailey, as played by actor Jimmy Stewart in the 1946 holiday classic It’s a Wonderful Life, didn’t pull his credit report. He knew the borrower, his family, his economic situation and a fair bit about his character – that was the borrower’s credit score. Not so today.

The rate a borrower pays, or whether he or she can get a loan at all, depends on a credit score, a number based on a slew of information about people collected without their permission and kept by one or more of the big three credit monitoring companies: Equifax, Experian and TransUnion.

The information includes name, address, Social Security number, birthday, payment history and more.

Last week, Equifax belatedly reported that between mid-May and late July “criminals” succeeded in stealing much of that information from 143 million Americans, or more than half the nation’s 249 million adults. They are the real victims of the theft, or will be if the purloined information is used by thieves to assume their identities, pose as the person to claim tax returns or secure health care, or borrow under the stolen name.

If one’s identity is stolen, it can take weeks of work to untangle the mess, all at the victim’s expense.

Information about what to do if one’s personal information has been compromised is easy to find. Essentially it consists of contacting the credit reporting companies and ordering a freeze on issuing new reports used to borrow, and closely monitoring bank and credit card statements and health care bills.

The Federal Trade Commission offers an online guide to follow at identitytheft.gov.

What to do about Equifax and its ilk is another problem. The credit reporting industry is lightly, many would say poorly, regulated and the companies and their stockholders lose little when a breach occurs.

As a result, they have proven reluctant to invest what’s necessary to make theft less likely. The latest data breach was Equifax’s third since 2015.

It’s time for Congress to strengthen laws and regulations, and establish penalties that give data gatherers an incentive to protect personal information and promptly report breaches when they occur.

Equifax knew of the theft for more than a month before it was announced. Action like that merits a substantial fine.

Credit monitoring companies and the data they aggregate are necessary evils. The financial information they assemble helps the economy run. Their customers are the banks, auto dealers, rental companies and others who won’t extend credit without a report on the borrower. The borrower’s information is the product the companies sell. Once stolen it can turn up anywhere in the world and pose a threat for years.

Data thefts also harm taxpayers since they can and have allowed thieves to falsely claim Social Security payments and tax refunds and take advantage of Medicare and Medicaid programs.

Every scrap of information about people, including their purchasing history, payment records, preferences in food, entertainment and other matters that can be gathered at no cost has been and will continue to be collected and sold.

When that information isn’t adequately protected it can harm a lot of innocent people. And when that happens, the companies that collected that information from unwilling and often unwitting people should pay the price.