AT&T data-breach victims: Here's something better than credit monitoring - and it's free

By Andrew Keshner

'The reality of living in 2024 is your information is going to be stolen, so you need to act accordingly'

AT&T is offering to pay for credit monitoring for some of its customers in the wake of a data breach that spilled information about millions of the company's current and former customers on the dark web.

Sure, credit monitoring is one way people can keep tabs on their credit score and attempt to fight identity theft, experts said.

But a credit freeze is an even more effective way to stave off scammers and criminals before they can even try to take advantage of a consumer's name and information, these experts added.

Along with credit monitoring, or a credit freeze, customers affected by a data breach can also sign up for fraud alerts. But one option is more effective than the others.

"In order of effectiveness, the credit freeze is certainly the top of the list," said John Ulzheimer, a credit expert who formerly worked at Equifax (EQX) and FICO (FICO). "With a freeze no new creditor will be able to access your credit reports. So it effectively stops any attempt to apply for credit in its tracks."

Some say a credit freeze should be a consumer's default position. "The reality of living in 2024 is your information is going to be stolen, so you need to act accordingly," said John Dwyer, director of security research at Binary Defense, which works with companies to defend them from cyberattacks.

"I recommend everyone keep their credit frozen at all times," Dwyer said. That's what he's done for himself since 2013. He briefly unfroze his credit report when he was buying a car and a house, and then re-froze it.

He added, "It's not an everyday occurrence you need to access your credit file."

After disclosing the data breach, AT&T (T) said it will be emailing or mailing letters to customers with "compromised sensitive personal information" to offer them free identity-theft and credit-monitoring services.

The discovered data trove included AT&T customers' Social Security numbers, mailing addresses, email addresses and dates of birth, according to the telecommunications company.

The mountain of impacted customers include 7.6 million current customers and 65.4 million former customers. The data appears to be from 2019 or earlier.

Read also: AT&T customers say a $5 credit for a massive cellphone outage is 'a joke.' But the law says they're not owed anything.

AT&T did not respond to MarketWatch's request for comment. Its disclosure shines new light on an old problem in the information age: What should people do after their sensitive personal data gets exposed to the world?

It's a problem gaining more and more urgency.

There were 3,205 publicly reported data compromises last year, according to the Identity Theft Resource Center. That's easily a new record, beating 2021, when there were 1,860 publicly disclosed compromises, according to the nonprofit organization.

Here's what consumers can do, instead of waiting for a notice that their information may have been exposed - or worse.

What is credit monitoring and when should you use it?

As the name implies, this is an approach where people can watch what's happening with their credit reports. It's "passive monitoring for activity on your credit reports that is indicative of fraud, like new inquiries or newly opened accounts," Ulzheimer said.

To do it effectively, Ulzheimer said a person needs to keep tabs on what's being reported or sought after at the big three credit-reporting companies, Equifax (EFX), TransUnion (TRU) and Experian (EXPGY).

Yet "monitoring is reactive and only informs you after something has already happened," he said. There's nothing wrong with credit monitoring but it only can accomplish so much by itself, Ulzheimer said.

"It's not going to stop you from being impacted, it just notifies you," Dwyer said.

People can pay for credit monitoring, and some of the services can cost approximately $15 a month, according to the Consumer Financial Protection Bureau.

If someone wants to review their own credit reports for free themselves, they can get one free copy each week from the three major reporting agencies, according to the Federal Trade Commission.

What is a credit freeze and when should you use it?

Freezing a credit report means you cannot open a new credit account while it's in effect, the Federal Trade Commission said. The move also ices out fraudsters who are trying to tap credit lines in a consumer's name.

"You have to lift the freeze or 'thaw' your credit reports when you legitimately apply for credit," Ulzheimer said.

The freeze stays in place until the person lifts it. There's no cost to freeze a credit report, but a consumer needs to contact Equifax, TransUnion and Experian to freeze their report at all three companies. All three need to be contacted independently.

People who want to shut down any sort of outside access to their credit report may also hear of a "credit lock." It's a similar idea, but it may require a paid subscription depending on the credit-reporting company.

Credit freezes are free, thanks to the Fair Credit Reporting Act of 2018.

But how long does it take to thaw a frozen account if someone needs credit to make a big purchase? When Dwyer unfroze his reports, the turnaround was "almost immediate," he said.

An online freeze request needs up to one hour to go through, TransUnion said. A request via phone or mail needs up to three days, the company said.

What are fraud alerts and how should you use them?

AT&T said it "encourage[d] customers to remain vigilant by monitoring account activity and credit reports" and one way to do that was with fraud alerts. To set up fraud alerts, a consumer must contact the three major credit reporting agencies - Equifax, TransUnion and Experian - separately.

With a fraud alert, a potential lender has to authenticate your identity before it issues a line of credit. In other words, it has to check that a consumer is the person who's actually seeking the credit.

A fraud alert is somewhere between monitoring and freezing your credit, according to Ulzheimer. A fraud alert obligates a lender to check the authenticity of an application before approval.

"Fraud alerts set at one credit bureau are shared with the other two, so there's a little bit of efficiency there that doesn't exist with freezes or monitoring," he noted.

Dwyer's qualm with fraud alerts has to do with the lengths lenders need to go when giving consumers a heads-up that someone is trying to access credit in their name. "I don't know how rigorous the verification process is," he said. For Dwyer, the credit freeze is a more effective option.

Fraud alerts are free and are good for one year. They need to be renewed after a year, according to the FTC.

We want to hear from readers who have stories to share about the effects of increasing costs and a changing economy. If you'd like to share your experience, write to readerstories@marketwatch.com. A reporter may be in touch.

-Andrew Keshner

This content was created by MarketWatch, which is operated by Dow Jones & Co. MarketWatch is published independently from Dow Jones Newswires and The Wall Street Journal.

(END) Dow Jones Newswires

04-02-24 0936ET

Copyright (c) 2024 Dow Jones & Company, Inc.