Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions

Take steps in wake of Equifax breach

September 22, 2017
Following the recent breach of Equifax security, dealerships likely are encountering customer questions about the security of their financial information, and the prospects of credit freezes and fraud alerts on credit reports.
The credit-reporting agency this month acknowledged a cybersecurity incident where criminals exploited a website application vulnerability to gain access to certain files, potentially impacting about 143 million U.S. consumers, including about 5.4 million Illinoisans.
Equifax publicly disclosed the data breach Sept. 7, saying hackers accessed data including Social Security numbers, birth dates and addresses and, for 209,000 additional consumers, credit card numbers. According to Equifax, that announcement came nearly six weeks after it had discovered the breach.
"Given the number of people affected and the sensitive type of information exposed, dealers should understand the basics of the breach and what it means for their customers," Mark Scarpelli, chairman of the National Automobile Dealers Association, said in a statement.
"If dealership personnel do get questions," he added, "it is important to first explain that the reported breach occurred at Equifax, and does not involve the dealership, data stored at the dealership, or dealership processes."
Scarpelli said dealers should review guidance provided by the Federal Trade Commission regarding the Equifax matter. The guidance can help F&I personnel who spot a fraud alert or encounter a frozen credit report.
What if dealership personnel do see a fraud alert or encounter a "frozen" credit report?  Dealership personnel should review the FTC document entitled Fraud alerts vs. credit freezes: FTC FAQs that provides further information about fraud alerts and credit freezes. 
Basically, if a customer’s credit is "frozen" then that customer’s credit report generally cannot be viewed until the customer takes steps to "unfreeze" their credit. They will be assigned a PIN they must use (and may forget), and it may include a fee that the customer must pay (both to place, and to temporarily "lift" the freeze), and could include a lead time that could affect a financing transaction. If there is a fraud alert on the credit report, then the dealership must take certain additional steps to verify the identity of the applicant (generally calling a phone number that the consumer provided at the time they placed the fraud alert and speaking with the consumer) before the credit process can be finalized.
Dealers and their employees should be aware that there already are scammers trying to take further advantage of the Equifax breach by calling consumers and trying to obtain personal information through false pretenses.
The situation provides a good reminder for dealers to revisit their Red Flags program to ensure that they are taking the required steps to detect and prevent scammers from opening a line of credit using someone else’s information.
Equifax set up a website,, where consumers could determine whether their data were potentially exposed.