How I took control of my credit report

Did you access my credit report? Senno ecto gammat!

Korben Dallas leans down and kisses Leeloo. Leeloo swipes his gun and holds it to his head.

Leeloo: Senno ecto gammat!

Korben Dallas: I'm sorry, I'm sorry!

Leeloo: ecto gammat!

Korben Dallas to Priest Vito Cornelius: ... what does 'ecto gammat' mean?

Priest Vito Cornelius: Never again, without my permission.

—Scene from the Bruce Willis movie The Fifth Element.

When businesses surreptitiously access my credit report I feel violated. But instead of putting a gun to their heads I decided to take advantage of a right that few people know they have. A relatively new law allows you to place a permanent security freeze on your credit report with each of the three credit reporting agencies. If you do that, no one can access it -- ever -- without your permission. Finally, you can take back control of your credit report! But if you sign up, be forewarned: It's a hassle. The problem is, people still don't ask for your permission. That's just fine if its a criminal. But it's annoying if it is an entity with whom you're trying to do business.

Businesses regularly access your credit report, often without telling you first, and often for no other reason than to market products to you. A landlord or telephone company or bank may check your credit report before sending you a solicitation or before setting up your account with them. But they almost never tell you that they're accessing your credit report. With a security freeze in place you need to ask them what their intentions are. Do they plan to run a credit check -- or not? If so, you also need to find out just exactly when they plan to request that report so that you can unlock it for them.

The Security Freeze

I placed a fraud alert on my credit report last fall after finding sensitive information online (since redacted). But a fraud alert is only good for 60 days. Then I learned that I could make that permanent. A federal law that quietly went into effect in November 2007 gives consumers control over who accesses their credit reports by allowing them to request a security freeze. You can now freeze access to your reports at the three major credit reporting agencies: Experian, TransUnion and Equifax. Doing so won't prevent all types of identity theft, but it can prevent new account fraud -- people opening up new accounts in your name.

That can be a big deal. Consider the story reported to me just this week of a woman whose identity was stolen. The thief purchased a home and a car in her name -- and changed information in her profile. When she went to issue a fraud alert the credit reporting agency denied her request because the perpetrator had changed some of the information the agencies used to authenticate her identity. The issue is still unresolved. A security freeze could have helped to prevent that.

Unfortunately, there's no protocol that says that businesses should ask for your permission -- or at least inform you -- before trying to access your credit report. The assumption remains that you do not own the information and have no right to control it. It is there for the taking.

Hassle Factor

Soon after the security freeze went into effect I ran into my first problem. I had asked a long distance carrier to restore in-state and state-to-state long distance service to one of my land lines. I had suspended the service several months before, but the company's Web site treated me like a new customer. I should have known that problems were coming when it asked for my social security number. When I declined, it continued with the request, but issued a warning that not providing it could delay initiation of service for a week or two.

Several weeks later I received a generic rejection letter in the mail stating that the provider had found insufficient information to approve my account. Translation: They tried to access my credit report and were rejected.

That's the drawback with the security freeze system as it's set up today: You have to unfreeze the account by phone or over the Web by submitting a special PIN and then close it again when the request has been completed. The first problem I have with this is that it costs me money, although I think that it's worth it. The exact cost varies by state, but for people in my state the price is $10 every time you unlock it.

To unfreeze my credit report I need to know that the vendor plans to access it. But I also need to know which credit reporting agency it will use, since I must unlock each -- for $10 -- separately.

The second issue is that with a security freeze I can't give just one vendor access to my credit report. Instead, I must open the barn door and leave it wide open for all comers until I am sure that the business I want to let in has finished its work. Since I don't really know when the vendor will conduct its credit check, and since the credit reporting agencies won't give me direct access to my report so I can see who has requested my credit report when (unless I sign up for one of their overpriced "monitoring" services), I can be stuck in this mode for days -- or weeks -- at a time.

A Better Mousetrap

A better method would be to allow me to provide the requesting vendor with a one-time PIN code to access the account through their preferred credit reporting agency. This would be generated by the credit reporting agency when I make an unlock request. Instead of leaving the house wide open I would be providing a self-destructing, single use key which I entrust to one requestor.

The credit reporting agencies do allow consumers to obtain one free credit report a year at the Web site (don't let them trick you into thinking you have to subscribe to a monitoring service to get it. It's a waste of money). But that's not good enough. Legislators should extend that control to give consumers the right to view changes and access requests to their credit reports in real time to make sure those changes and requests are correct and appropriate.

More importantly, there needs to be a sea change in how credit reports are viewed by the industry. The consumer may not own the data but they should have a right to have more control over it. Today, consumers can check the contents of their reports once a year, they can challenge inaccuracies in those reports, and they can control who sees them.

But businesses assume that accessing your report at any time, for any reason, is a right, not a privilege. Only when enough consumers assert control over their credit reports through security freezes -- and vendors realize that it is rude not to ask first -- will the protocols of business change.

Copyright © 2009 IDG Communications, Inc.

Shop Tech Products at Amazon