/tech/are you protecting your ssn [for usians]

if your credit is not frozen you are vulnerable

if you are a us citizen, you should attempt to keep your social security number private. of course, that is easier said than done. there continues to be large leaks of millions of numbers and you have to give it out to rent, work, bank, and more. while keeping the number private is mostly out of your hands, assuming you are already using common sense, there is one v important way you should be protecting your identity and your credit. if you haven’t already, you should freeze your credit with the big three credit reporting agencies.

contrary to how the name might sound, freezing your credit does not stop your credit from changing - it doesn’t even prevent ‘soft’ credit checks. in short, the only thing freezing your credit does is prevent anyone from opening new lines of credit using your social security number.

in case the distinction is new to you, soft checks are checks which let the entity checking see information about your credit without affecting your credit. a new job, new landlord, or background check usually only involves a soft check. even seeing if you ‘pre-qualify’ for a loan or a credit card is likely to only be a soft check. on the other hand, hard checks can ding your credit by a few points for a while and are needed to actually open a new line of credit.

when you freeze your credit, you can unfreeze it any time online or via phone. credit agencies are required to lift the freeze within an hour (requests to freeze can take up to a day). because the country is the way it is, each of the three major credit reporting agencies have their own system for managing freezes.

you can visit the page with information about freezes for each of the three at: equifax, experian, and transunion. after you confirm your identify either online or over the phone you can either get a pin or answer questions to lock or unlock your credit (choose the pin and save it in a password manager). once your credit is frozen, if you ever need to open a new line of credit you will simply go to the same webpage (or phone number) and use the pin you were given to pick an amount of time to temporarily unfreeze your credit (instead of permanently unfreezing it).

notes:

  • i would strongly recommend managing freezes online using an account with each agency so that you get notifications
  • equifax has their own thing they call a credit lock which is /not/ what you want - you want a ‘security freeze’
  • experian calls temporarily unfreezing your credit a ’temporary thaw’
     

postscript: since i last interacted with this system they have made it worse, it seems. they now may let you unfreeze your credit using only your name, address, and ssn. this meaningfully undercuts the whole point of having a freeze as a legally mandated mechanism to protect people against someone stealing their identity to take out credit just by knowing literally those three pieces of information. that said, freezing your credit is still v much worth doing as it makes you a more annoying target. additionally, if you manage your freezing and unfreezing online using an online account with each agency, you will at least get an email when someone tries to unfreeze your account to warn you something malicious is happening, but.. wtf


tags: security explainer best-practices