To: Credit Reporting Agencies, aka Credit Bureaus.
Message: YOUR credit rating is not so good right now.
Credit bureaus are a necessary, if slightly messy, reality in a world where serious money changes hands by phone or Internet with almost zero human-to-human contact. Nobody wants to grant credit to a deadbeat, and credit bureaus provide an efficient way of telling lenders not to trust us.
Unfortunately, as we learned last week, perhaps we can’t trust them.
Equifax Canada Inc., a subsidiary of Atlanta-based Equifax Inc., had to confess that it put the credit files of a whole lot of innocent Canadians into the very worst of wrong hands. As a terse company press release states: “We have learned of a situation in which the Equifax credit reports of about 1,400 consumers – primarily in British Columbia and Alberta – were accessed by criminals posing as legitimate credit grantors.” They go on to say that they have notified all these people, and that the company is co-operating fully with an RCMP investigation.
The implications are staggering, because there’s enough information in a typical credit bureau report to do industrial-scale identity theft. Indeed, on a phone-in show I did on QR77 radio the day after the story broke, we heard from a man who was having a very bad week because of Equifax. Not only did he get their “oopsie” registered letter, he was called by his credit-card company asking if he was indeed trying to make a $5,000 purchase. He answered that he was at home watching television, and doing no such thing. So, there’s evidence that identity thieves may indeed have hoodwinked the credit bureau out of lots of valuable data.
There is a delicious irony in the woes of Equifax, because they actually sell a service that’s supposed to protect you from identity thieves. (Of course, right now it appears that it’s Equifax itself that we need to be protected from.) This Equifax Credit Watch product costs $9.95 a month if you want to be e-mailed within 24 hours of “possible identity theft activity” or $4.95 a month if you’re willing to give the ID thieves a seven-day head start.
In talking with one of the victims who received the Equifax registered letter, I suggested that they should probably be giving him this service free for life. He said they were indeed giving it to him free – but only for a year.
In fairness to our credit bureau friends (and under Canadian legislation), you are entitled to a free copy of your credit history once a year, or if you are turned down for credit. The Equifax website tells you how to get it, and actually uses the term snail mail, referring to the fact that Canada Post will be delivering the good or bad news “in five to 10 business days.” Equifax then cheerfully offers to provide it, on the spot, for $14.50, charged, of course, to a major credit card.
Speaking of credit cards, you’d better be ready to type one in when buying your online credit report from Equifax, because there’s absolutely no way to pay them in cash.
And, of course, the first thing they ask for is your social insurance number. According to a Government of Canada website, the only people who can legally demand your SIN number are certain branches of government itself, your employer and “anyone who prepares income tax information on your behalf,” such as a bank that pays you interest.
Last time I looked, Equifax wasn’t paying me any money. One woman called in to the radio show saying that she refused to provide her SIN to Equifax and they refused to supply her credit report. This contradicts the stated policy of both Equifax and TransUnion (the other major Canadian credit bureau.) Both companies say that SIN number is “optional” on their printed credit report request forms. I called Equifax and they assured me that the number was indeed optional, but their web order form certainly doesn’t say so. Of course, it’s really a moot point, because the odds are very high that Equifax already knows your SIN number better than you do.
Just for fun, and to see how good their authentication process is, I went through the online ordering procedure for my own credit report on the Equifax website. In addition to asking for my SIN number and date of birth, it sprang one surprise question (multiple choice, five answers, guessing permitted) concerning a line of credit I opened several years ago.
Which financial institution was it with? Since one of the answers was a small credit union in a place I’ve never been, an identity thief could easily eliminate that one, and probably also the “None of the Above” option.
That brings it down to one in three odds, not bad for a crook who wants to hijack my credit power.
With identity theft being called the “fastest-growing crime in Canada,” it’s clear that credit bureaus, with their treasure troves of information, will continue to be prime targets. They need to balance doing business efficiently with good security and privacy protection.
At the very least, they absolutely must do a better job of deciding who is allowed to order credit reports. One technique would be to require biometric identification such as fingerprints for authorized bank officers and others who can order reports.
If this sounds far-fetched and costly, it really isn’t. A major Canadian retail chain has installed discreet fingerprint scanners next to each cash register to catch salesclerks who cheat. With almost every Canadian now an involuntary customer of Equifax, TransUnion or both, isn’t it reasonable to expect at least that level of protection for our personal financial data?
Web watch: www.equifax.ca www.hrsdc.gc.ca/en/cs/sin/030.shtml www.transunion.ca
(Tom Keenan is a professor at the University of Calgary and an expert on technology and its social implications. He can be reached at keenan@businessedge.ca)
