I have reached a stage in my life where I have very little need for my credit reports.
I am paying a mortgage on what I hope is my forever home. I have a minivan that I am planning to drive into the ground (this is a flex … listen to this podcast for the details). I have a couple of credit cards with sufficient credit lines. My credit score is very good (not as good as my wife’s, but let’s not open up that wound).
I really don’t have any immediate need for my credit reports.
Plus, you know, 2.9 billion personal records were recently stolen from National Public Data, a company that performs background checks.
So, it seemed like a good time to freeze my credit reports (and to help my family do the same).
This turned out to be quite a bit more difficult than I had hoped.
My Journey Into the Frozen Wastelands
A quick refresher — security freezes are a service provided for free (as mandated by Federal law) by the credit bureaus, which allow consumers to prevent anyone but themselves from accessing their credit reports. This stops fraudsters from illegally applying for credit using consumers’ identities, but it also restricts consumers from applying for credit themselves without first unfreezing their reports (a process that can be as easy as entering a 4-digit PIN or as annoying as calling into a call center).
My journey began with TransUnion.
The homepage of TU’s website loaded fast enough, but then a funny thing happened when I clicked on the Credit Freeze page on their website — the page didn’t load. It just spun and spun until my Chrome browser gave up.
This happened a few more times before I finally changed tactics and downloaded the TU mobile app, which did allow me to create an account and freeze my report, but not before attempting to upsell me on a more extensive credit monitoring and data security service that costs … [double checks notes to make sure it’s correct] … $29.95 per month.
I then moved on to Equifax.
Or, should I say, I attempted to move on to Equifax.
After completing a rather lengthy application on Equifax’s website to create an account and authenticate my identity, I encountered an unknown error that prevented me from freezing my report.
I was instructed to call the Equifax call center, where I was told I could complete the process over the phone. Except, oh no, the call center was “not available” and I was told to “call back later.”
Weird!
I then attempted to do what I had done with TU — go through the mobile app.
I downloaded Equifax’s mobile app for credit freezes, which (in a very confusing twist) isn’t branded as Equifax but rather as “Lock and Alert.” This was so off-putting that I almost quit right there, half-convinced that this was actually a fraud app that was being used to phish for PII.
Turns out, I would have been better off if I had quit right there.
After another lengthy sign-up process, the application crashed when the CAPTCHA verification step repeatedly got hung up.
Fun!
At this point, I moved on to Experian.
I have to say — Experian’s sign-up process was a dream come true. They leveraged telco data to pre-fill my application using my phone number and the last four digits of my social security number. It was a breeze.
The trouble was that after I created an account, I couldn’t find out how to freeze my credit report.
There was an option to “lock” my credit report (displayed beneath a helpful banner warning about the dangers of the National Public Data breach), but was a lock the same as a freeze?
I couldn’t tell!
Eventually, I discovered that a “lock” is merely an Experian-branded version of a credit freeze, with a few useless bells and whistles tied on. And to get access to this credit lock feature, I would have to pay $24.99 a month for Experian’s premium credit monitoring and financial management service.
After clicking through many different menus and lots of fine print, I finally found the free credit freeze option, which I promptly enabled.
Taken all together, the experience of attempting to freeze my credit reports left me with two distinct impressions:
- The credit bureaus really don’t want me to freeze my reports.
- To the extent that the credit bureaus make it easy-ish to attempt to freeze my credit reports, it’s because they are trying to cross-sell me an overpriced credit monitoring and service.
This is intensely annoying to me.
So, I decided to dig into the history of the credit bureaus’ legal and commercial relationship with consumers.
An Obligation and An Opportunity
The history here is mostly a combination of congressional action and the slow but steady monetization of consumers’ confusion about how the U.S. credit system works.
Here are the major milestones:
A quick review:
- The Fair Credit Report Act (FCRA) is passed in 1970. It was the first national law that governed the credit bureaus (which were, at the time, growing quickly and transitioning to digital technology). The FCRA restricted the purposes for which a consumer’s credit report could be used (decisions relating to credit, insurance, or employment) and gave consumers the right to know when their report was used against them and to see a free copy (if they were denied for credit, insurance, or employment) and to dispute any inaccuracies.
- The Consumer Credit Reporting Reform Act is passed in 1996. This one amended the FCRA, allowing consumers to receive more specific adverse action notices when denied and giving them the right to dispute inaccuracies directly with the companies furnishing data about them.
- FICO launches MyFICO.com in 2001. This kicks off the modern era of paid credit monitoring, with FICO realizing that this could be both a lucrative business and a way of increasing familiarity with and trust in the FICO Score brand. Similar efforts from the credit bureaus would quickly follow.
- The Fair and Accurate Credit Transactions Act (FACTA) is passed in 2003. FACTA amended the FCRA, giving consumers the right to a free copy of their credit reports from each bureau once per year and the right to opt out of prescreen credit offers (when lenders make a firm offer of credit without you asking). This resulted in the creation of AnnualCreditReport.com and OptOutPrescreen.com, which were set up and operated by the credit bureaus to facilitate these activities.
- Credit Karma is launched in 2008. Credit Karma’s novel insight was that it could outcompete paid credit monitoring services like MyFICO.com by giving away credit scores to consumers for free (this was helped by the fact that the bureaus had just launched a cheaper credit score alternative, VantageScore) and then monetizing them through lead aggregation. This model (and Credit Karma’s aggressive digital marketing) was extremely effective. By 2015, Credit Karma had given away one billion credit scores.
- The Credit CARD Act is passed in 2009. This one was primarily focused on credit card regulation, but it did amend the FCRA to require the disclosure of credit scores (not just reports) to consumers when they are denied for credit.
- The Dodd-Frank Wall Street Reform and Consumer Protection Act is passed in 2010. Dodd-Frank expanded the requirement to share credit scores for any adverse action or risk-based pricing decision. It also created the CFPB, which took over from the FTC as the primary regulator of the credit bureaus under the FCRA.
- FICO launches the Open Access program in 2013. Recognizing the trend towards the free disclosure of credit scores (due to both legislation and the Credit Karma business model), FICO enables lenders that are already buying the FICO Score for origination or customer management to share the scores with their customers for free.
- Experian strikes a partnership with FICO to distribute the FICO Score through its B2C products in 2014. This was the moment that Experian prioritized its competition with Credit Karma (which had been eating the bureaus’ lunch in B2C credit monitoring) over its competition with FICO via VantageScore. Experian would go on to make substantial investments in its B2C business over the next ten years.
- Equifax’s data is breached by hackers in 2017. The breach, which exposed the private records of 143 million Americans, significantly damaged trust in Equifax (and the credit bureaus in general). It ended (at least in the near term) any significant B2C ambitions that Equifax may have had.
- The Economic Growth, Regulatory Relief, and Consumer Protection Act is passed in 2018. This one was primarily focused on providing regulatory relief to mid-size and community banks (hi, SVB!), but it also amended the FCRA to make credit freezes free for consumers and required the bureaus to provide free electronic credit monitoring to active-duty military members.
After studying this history, my own experiences trying to freeze my credit reports made a lot more sense.
The deep and abiding strangeness of the U.S. credit system has created a massive commercial opportunity for the credit bureaus, FICO, and fintech companies like Credit Karma. These commercial interests run contrary to the spirit of laws like the Fair and Accurate Credit Transactions Act, which is why the credit bureaus have done their best to completely undermine them while still adhering to their letter.
The thing I don’t understand is why regulators have let them get away with it.
What Are We Doing Here?
When Rohit Chopra, Director of the CFPB and the person in charge of regulating the credit bureaus, talks about the CFPB’s personal financial data rights rule (AKA open banking), it’s very clear that he has a specific vision for how the U.S. data economy should work:
When a consumer permits their private data to be used by a company for a specific purpose, it is not a free pass for that company to exploit the data for other uses.
Importantly, the rule says that firms that receive financial data to provide a specific service cannot feed the data into algorithms for unrelated activities, such as targeted advertising and marketing. Firms couldn’t collect data to provide a service, and then also monetize it by selling to data brokers. Authorized data also couldn’t be used to train artificial intelligence that manipulates consumer behavior.
And firms would not be able to hold onto your personal financial data indefinitely. If a consumer chooses to end a relationship, the firm would have to stop collecting and using the consumer’s data as well as delete the data it already possesses.
How Director Chopra and the CFPB can be pursuing that vision so aggressively on the one hand, while on the other hand allowing this fossilized website …
… to continue to exist, almost entirely unchanged from 2004, is beyond me.
I mean, look at this shit:
Wow! Really? A free copy of my credit report every year, if I ask nicely? And they also make it easy to accomplish many credit-related tasks from my computer? Oh, happy days! I’ll just run over to my Compaq Presario and fire up the dial-up internet modem!
We can do a lot better. And we deserve better.
Given the amount of money that the credit bureau ecosystem extracts from our data and the carelessness with which they have treated that data at times in the past (credit reporting is, by far, the largest source of complaints in the CFPB’s consumer complaint database), I don’t think it’s unreasonable to ask the companies in this ecosystem to contribute their time and resources (at the direction of the CFPB) to the development of a new solution.
What I’d love to see is a single mobile app that has exceptional UX and performance (I’d suggest mandating minimum performance metrics like the CFPB is planning to do for open banking) that gives consumers the ability to:
- Get free copies of their credit reports (from all three bureaus) and credit scores (VantageScore and FICO) as frequently as they would like. (The annual restriction in FACTA is bullshit … the marginal cost of delivering these reports electronically is basically zero … the bureaus voluntarily started giving out free reports weekly in 2020, and their profits haven’t suffered.)
- Push a button to freeze and unfreeze their credit reports (it’s dumb that you have to go to each bureau individually to place and lift freezes) and digitally initiate the process of freezing minors’ credit reports (I know the authentication process for freezing a minor’s credit report is tricky, but the current method of mailing in printed forms and copies of identity documents is absurd).
- Push a button and permanently opt out of prescreen offers (this actually wouldn’t be that useful now that the bureaus have gone all in on prequalification, but that’s a different essay).
- Initiate the process of disputing errors on reports, tracking the status of disputes, and contacting furnishers directly (again, it’s dumb that you have to go to each bureau individually to do this).
- Submit complaints to the CFPB and track the status of prior complaints.
I know it’s highly unlikely that this will happen.
AnnualCreditReport.com will probably persist in its current form for another 800 years and will be bewildering to future generations of consumers (and their AI assistants), who won’t understand why you’d want to get a free copy of your credit report when you can just see your FICO Score and pre-approved credit offers in the ads that run in Experian’s $425/month video streaming/personal finance/digital concierge super app.
But a man can dream …
