MSE News: Got an Equifax letter saying you were hacked? The helpline's struggling...

Doc_N

andromedean wrote: »

I received the letter a couple of days ago about a breach back in June. So I registered with Equifax using their free offer.

Today, I received my first alert from WebDetect which scans for evidence of fraudulent activity on the web. Unfortunately, they now expect me to change every password I have on the Internet to complex combinations of characters, It's taken me years to familiarise myself with a few of them, and I often get those wrong.

If I press on Alert data it provides part of my Email address and part of a password like nothing I would ever use! Do I spend the next week changing passwords into a form so I will never remember them?

Has anyone else used this and received similar alerts? Surely they must have had my data 6 months ago and I'm not aware of anything untowards happening.

It claims my social media footprint is low, but my social media risk is high, yet my Twitter and Facebook sites have no public information available. However, two other names have popped up, Gravatar and Klout which I've never heard of. The first seems to be linked in some way to Wordpress, so I have closed that account. The other seems to be linked to an old Twitter account I've long since closed and can't even access myself! My risk rating remains high however. Any ideas where I can find what site they are referring and how it can remain high?

My situation is similar, but with some differences. WebDetect has revealed that two of the email addresses I use have been compromised, and it shows the masked passwords. It's impossible to tell whether they're mine or not.

Social media shows nothing - so far.

You'll have seen this, I'm sure, and it's certainly a concern:

"Information

If you have received an alert referencing one of your monitored email addresses, this indicates that a cyber criminal is selling or trading this email address and potentially your password as well.

To correct this situation, follow the actions below:
Change/update your password on all existing email and Internet accounts you may have. Your password should be a "strong" format with a combination of upper and lower case letters, including special characters such as @,&,%,!. For example, bRo$NdoG726.

Contact your email/Internet provider to ensure that no additional email accounts have been created under your service with them without your knowledge. If so let the provider know that the account is fraudulent and have it deleted.

Request to add a security or password phrase with your email/Internet provider so no one except you may access your account information by calling them without your knowledge.
During this search a number of other pieces of information were discovered that may or may not be related to you, click here for more info."

However, I suspect that the cause has more to do with the TalkTalk hack than the Equifax one - have you by any chance had a TalkTalk account at any point?

I think your post proves, though, that ignoring the Equifax protection services (normally £14.95 per month) that they're more or less obliged to provide now for free to those affected isn't a very wise move. I'd much sooner know about these risks (which are very real) than not.

Doc_N

andromedean wrote: »

https://www.theguardian.com/technology/2017/sep/08/equifax-hack-credit-social-security-helpline-response-criticism

Does this apply to British customers? Presumably we have a cooling off period and can decide not to take up the service, then the condition doesn't apply?

It applies very much to British customers, and I wasn't prepared to sign up to the free services while at the same time signing away my rights to take legal action against them via a class action.

You can, however, obtain, on request, an assurance from them that it will not limit any legal rights, and that's what we've all done in this family. You never know what's round the corner, and I think this fiasco has yet to be fully played out as more and more people come to realise its impact.

vertex

RG2015 wrote: »

Most people register with all three. The third one being Experian which is free via the MSE Credit Club. It is not at all overkill because not all banks use all three, particularly for searches which is always the first sign of any fraudulent activity.

Thanks. I shall be doing this!

vertex

I think Noddle is free too.

andromedean

Doc_N wrote: »

However, I suspect that the cause has more to do with the TalkTalk hack than the Equifax one - have you by any chance had a TalkTalk account at any point?

I think your post proves, though, that ignoring the Equifax protection services (normally £14.95 per month) that they're more or less obliged to provide now for free to those affected isn't a very wise move. I'd much sooner know about these risks (which are very real) than not.

Yes I did have an account with Talk Talk, they took over another of my services, but I've moved away after poor service.

Perhaps it would have been wiser to use one of the others though. I don't this Equifax is the best.

andromedean

Doc_N wrote: »

It applies very much to British customers, and I wasn't prepared to sign up to the free services while at the same time signing away my rights to take legal action against them via a class action.

You can, however, obtain, on request, an assurance from them that it will not limit any legal rights, and that's what we've all done in this family. You never know what's round the corner, and I think this fiasco has yet to be fully played out as more and more people come to realise its impact.

Thanks, I may do this, but if I leave within a certain time of joining is it still too late?

Doc_N

andromedean wrote: »

Thanks, I may do this, but if I leave within a certain time of joining is it still too late?

Sorry - how do you mean?

And you may well find thatTalkTalk's the real culprit in allowing your details to get into the public domain. That's certainly the case for me and it's nothing to do with Equifax but I'm happy to take their normally expensive alert service for free!

The fake TalkTalk calls are a constant source of amusement.

RG2015

vertex wrote: »

I think Noddle is free too.

andromedean wrote: »

Yes I did have an account with Talk Talk, they took over another of my services, but I've moved away after poor service.

Perhaps it would have been wiser to use one of the others though. I don't this Equifax is the best.

Yes. Noddle is free but like Experian via MSE, it only updates once a month. The Equifax protect product can be updated every day. Clearscore is also free and gives data from Equifax so doesn't benefit you as long as the free Equifax deal lasts (2 years I think).

I also use GiffGaff which gives the same data as Noddle (CallCredit data) but the GiffGaff credit report updates every time you log in. You do not require a GiffGaff account to access your credit report.

Finally it is not a question of which CRA (Experian, Equifax or CallCredit) is best. They all provide credit reports but the information is different especially the search records.

RG2015

andromedean wrote: »

Thanks, I may do this, but if I leave within a certain time of joining is it still too late?

I believe that if a company's Terms & Conditions are unreasonable they cannot be enforced. Your data is protected by law (data protection act). Equifax cannot shirk away from their legal responsibilities by slipping in an exclusion clause hidden in their copious Ts&Cs.

RG2015

Within the Equifax Protect service their Web Detect offers to monitor the following:

1) Up to 6 email addresses
2) Up to 6 telephone numbers
3) Up to 12 credit/debit cards
4) Up to 6 bank accounts
5) My driving licence
6) My National Insurance number

I am quite happy to review my searches on a regular basis. My wife took out a new mobile phone contract on Thursday and the search was there on my Equifax credit report the next day.

Equifax say that "Equifax WebDetect continuously actively scans hard-to-find websites for your personal information and alerts you if your information is at risk of being traded."

I do not quite see how giving Equifax all of this extra data is of any benefit. I assume that my data is always at risk and I should be fine as long as there aren't any unknown searches