September 14th, 2017

What does this mean for Canadians?

Since Equifax announced their data breach on September 7th, the company has addressed numerous concerns and complaints, but for Canadians there are still unanswered questions. Equifax call centre agents are advising callers that if they did not have credit dealings in the US they are likely not affected. It appears the media have been unable to confirm this with Equifax management. However, the Office of the Privacy Commission of Canada (OPC) has released a statement in regard to the Equifax breach, stating that the OPC has contacted Equifax and is working with them as well as other data protection authorities in Canada. The OPC is urging Equifax to find a way to inform Canadians if they are affected by the breach as soon as possible. The OPC also had the following recommendations for concerned individuals:

• Monitor your credit cards and bank accounts regularly and keep a close eye out for any transactions you did not authorize. Report any issues to your financial institution or credit card company right away.
• If you identify a concern involving a theft/crime, report the incident to local police.
• Report any incidents involving a scam or fraud to the Canadian Anti-Fraud Centre.
• If you think you have been targeted by identity fraud, advise your bank and credit card companies. Close any accounts and cancel any cards that may have been compromised.

What has changed since September 7th?

As for US consumers, initially we cautioned against accessing and using Equifax's website to check if the breach affects you because it may waive your rights to participate in subsequent litigation against Equifax. The company has amended its Terms of Use on their website and explains "enrolling in free credit file monitoring and identity theft protection that we are offering as part of this cybersecurity incident does not waive any rights to take legal action." As well, Equifax has corrected the Potential Impact Checker to properly inform if your data may or may not be impacted by the incident, along with a button to enroll for free in their TrustedID Premier monitoring. Note that the Impact Checker is effective for US consumers only as it keys on a US Social Security number.

Given the nature of Equifax's business as a collector and purveyor of credit information, in addition to the recommendations indicated above you should also consider:

• Placing a potential credit fraud alert or freeze on your credit file. Contact Equifax, TransUnion or Experian (US only) to inquire about credit freezes and alerts.^*
• Get your credit report to review and help detect for any signs of fraudulent activity.

Canadians don't have the benefit of placing a freeze on their credit file, which prevents financial institutions and creditors from opening new lines of credit until the freeze has been lifted, but we do have other options for credit file protection. Canadians can add a fraud alert to their credit file to warn credit grantors to contact you before approving credit, but applicants may need to prove that there has been an incident or confirmed risk of fraud. TransUnion Canada warns that "it is important to recognize that, subject to applicable law, credit grantors have the discretion to decide what steps they will take (if any) when they see the fraud alert on your credit file," so it is best practice to review and monitor your credit card, financial account and credit report.

When considering a credit freeze or alert be sure to check any fees that apply and the duration the freeze or alert will last. In some jurisdictions, freezes, alerts and reports are to be provided at no charge.

We will continue to monitor this situation and provide updates as more information is released.

^* Credit freezes do not affect access to your existing credit, but prevents increases or new credit from being established until it is removed. Placing a Credit Fraud Alert on your file will warn credit grantors to contact you before approving credit applications.

Sources: