Equifax, clean up your act, AGs demand

While the hacked credit reporting service Equifax has tweaked a few consumer remedies in the last week, Pennsylvania Attorney General Josh Shapiro and 33 of his colleagues are still fuming, warming up for a bipartisan, multistate investigation and pressing the company to do more.

Their moves come on the heels of a third of  U.S. Senators demanding answers and, on Monday, the Justice Department opening a criminal case into whether Equifax executives violated insider trading laws by selling close to $2 million in stock before the company disclosed it had been hacked.

On Friday, the group — which includes New Jersey Attorney General Christopher Porrino and Delaware Attorney General Matt Denn — sent a letter demanding that Equifax eliminate confusing language and practices and take more responsibility for the actions being undertaken by distraught consumers to shore up their now vulnerable financial information. The colossal breach of the Equifax system included scooping up the names, Social Security numbers, and birth dates of 143 million Americans, including "up to 5.4 million Pennsylvanians," Shapiro calculates.

The attorneys general salvo doesn't warn of a collective states lawsuit, though one could be forthcoming if Equifax doesn't shoulder more responsibility and reach a settlement. Massachusetts Attorney General Maura Healey has separately announced plans to sue the company for violating state consumer protection laws, and more than 23 class-action lawsuits have already been proposed.

Nor does the notice argue gross negligence, though it came out last week that Equifax was first informed of a dangerous data compromise to its open-source software in March by the Apache Foundation.

It also came to light that security PINs issued to consumers by Equifax could be readily guessed. (To receive a new PIN, people must call 866-349-5191, speak to a live agent, and provide identity verification information.)

Topping the group's list is an elimination, at least presently, of any fee-based services for consumers to check their credit. Currently, there's both a free (for a year) and an extra-features paid-service offering, a situation confusing to consumers. The attorneys general also suggest that the cutoff date of Nov. 21 for consumers to avail themselves of the freebie monitoring should be extended to at least Jan. 31, 2018. And that paid renewals of the service should not be triggered automatically on the expiration date.

Also, they want consumers to be reimbursed by Equifax for all costs incurred both at its site and at other credit reporting agencies for enabling credit freezes. These lockouts prevent scam artists from opening credit cards and taking out loans in your name.

Equifax is now waiving freeze fees, but the other two major credit bureaus, Experian and TransUnion, continue to charge fees for freezing credit. Industry experts say you need to separately lock out all three.

Shapiro and his fellow attorneys general also are pushing Equifax to improve its hotline support, to display call numbers prominently on websites (www.equifax.com and www.equifaxsecurity2017.com) and to clearly explain how it plans to communicate in the future with impacted consumers.

Shapiro also recommends that consumers keep vigilant by checking credit card statements for unauthorized activity, alerting the credit card company or vendor immediately if they see anything suspicious. And he urges residents to call or email the Pennsylvania Attorney General's Bureau of Consumer Protection if you believe you've been affected by the Equifax breach or any kind of identity theft — reaching out at 800-441-2555 or scam@attorneygeneral.gov.

Other numbers to note: Equifax at 1-800-685-1111 (to freeze credit) or 1-888-766-0008 (to report fraud); Experian at 1-888-397-3742 (to freeze and report fraud); and TransUnion at 1-888-909-8872 (freeze) or 1-888-909-8872 (fraud).