MARY LOUISE KELLY, HOST:
When more than 140 million people have their Social Security numbers stolen, you assume it's a moment that will lead to change. NPR's Chris Arnold has been looking into the credit reporting industry after the giant Equifax breach that was revealed last month. Chris says the hack is raising important questions about these agencies.
CHRIS ARNOLD, BYLINE: This past spring, David Mifflin looked at his credit report online and saw that something wasn't right. There were inquiries from Chase Bank regarding a credit card application, and it turned out that someone was trying to open a credit card in his name. Mifflin, who lives in San Antonio, Texas, called up the bank and found out that the identity thieves...
DAVID MIFFLIN: They had my Social Security number as well. And this was the first two attempts.
ARNOLD: Mifflin set up fraud alerts with the three credit reporting companies, but he says the bad guys still kept trying to open credit cards.
MIFFLIN: Multiple times a week, multiple times a day even, things were sent in.
ARNOLD: Soon Mifflin was in the thick of it, talking to debt collectors about debts that he didn't recognize. He had to keep calling the bank to say please don't issue those cards. It's fraud. He was sometimes waking up at 2:30 in the morning worried and angry. And even to discover any of this, he'd had to sign up for a service with the credit reporting firm Experian. He says he's been paying $26 a month. That's 300 bucks a year.
MIFFLIN: Yeah, just to get my information that they're collecting. That's my information that I should have access to that at any time for free.
ARNOLD: Mifflin put what's called a freeze on his credit report with the credit bureaus. That apparently stopped anybody from opening new accounts. But he had to pay more money for that. And then the Equifax hack came to light, more than 145 million Americans involved.
MIFFLIN: When I heard that, my anger level really, really kicked up.
ARNOLD: The Equifax website told Mifflin that his personal information might have been stolen, and he started asking questions that a lot of lawmakers are asking now too. How can these credit reporting firms collect our information and sell it for a profit without asking our permission? Why do they have the right to charge us to see our own credit report or to freeze it?
MIFFLIN: It's incredible power that they have, and they hold us just short of hostage, you know? I'd like to see some major reform.
ARNOLD: Maura Healey is the attorney general of Massachusetts, one of more than 30 AG's investigating Equifax and the first to file a lawsuit against the company.
MAURA HEALEY: I find this incredibly irresponsible and outrageous. The company and its executives need to pay, and reforms need to be brought to this industry.
ARNOLD: Healey and state legislators have crafted a bill to require better security. It would also block any company from buying our credit reports or scores without our permission.
HEALEY: They should get our consent first. This is our personal data. And for far too long, these companies have been out there collecting our personal data. We don't even realize it. We never gave them permission to collect it, let alone sell it to other entities.
ARNOLD: In Washington, a Republican bill would force the credit reporting firms to get federal cybersecurity reviews and to stop using Social Security numbers to identify people. At a Senate banking committee hearing yesterday, Republican John Kennedy told an industry spokesman...
(SOUNDBITE OF ARCHIVED RECORDING)
JOHN KENNEDY: You could develop technology very easily that would allow people to go to an app on their phone to put a credit freeze on and off free of charge. That ought to be a minimum.
ARNOLD: That sounded pretty close to a bill introduced by Democrat Elizabeth Warren that would require free credit freezes. Chris Hoofnagle is a cybersecurity expert at Berkeley Law School. He says we need to make a fundamental change in the way that credit exists in the U.S. financial system.
CHRIS HOOFNAGLE: Right now credit is in a liquid state, and it doesn't make a lot of sense. It means that every second of your existence someone can come along and pretend to be you, get your consumer report and get a new credit card or an auto loan in your name.
ARNOLD: Hoofnagle says the U.S. should shift to a frozen state. That is, your credit report is frozen by default, and if you want to unfreeze it to, say, buy a car, you can. For his part, the industry spokesman at the hearing said the industry already faces enough regulation and that the credit bureaus help consumers get access to credit. Chris Arnold, NPR News.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.