Freezes on credit files need to be free

Whatever your political affiliation, there is now one financial issue on which we can all agree.  We need Congress to pass legislation allowing consumers to temporarily freeze and unfreeze their own credit files at no charge to help thwart identity theft.  In case you missed it, the credit-reporting agency Equifax recently discovered that criminals had gained access to people's names, Social Security numbers, birthdates, addresses and, in some instances, driver's license numbers.

In all, the hack could potentially affect 143 million US consumers

Stop. Just take that in.  More than 40 percent of Americans are facing the possibility of identity theft.  Their financial lives could turn into a nightmare.  

Protect yourself after Equifax breach

Here's one way to know if your accounts are vulnerable:  When you access your bank statement, brokerage account, medical records or even when you file your taxes, are you asked to verify your identity by providing your Social Security number or the last four digits of your Social Security number?

"If so, you are extremely vulnerable, because the thieves have the Social Security numbers," O'Farrell said.

Consumers also need to be more attentive to the layers of authentication and the passwords they use for their online accounts.  Although many consumers hate the multistep authentication processes and the hassle of remembering passwords, such practices are now essential, he said.

This means you should expect banks to send messages to your phone and email to confirm your identity each time you want to withdraw or transfer funds, O'Farrell said.  At some banks, this is standard procedure, but if it's optional, you should still take advantage of the service.  By requesting that verification come to both your phone and email, you are protecting yourself from criminals who may already have one of those pieces of information, O'Farrell said.

When selecting passwords, avoid using names and information thieves may be able to discover about you by stalking you on social media or hacking into your email account.  This means not using names of pets, relatives or anything that could be traced back to items you've posted on social media.  When setting up answers to the security questions that you'll use to verify your identity when accessing online accounts, lie about the answers.  

Consumers should also brace for a wave of phishing scams.

O'Farrell said one of the biggest risks in the wake of the Equifax breach is that criminals know consumers are fixated on credit monitoring and freezes.  He expects criminals to capitalize on that by sending emails that appear to be from Equifax or financial institutions.  The emails will look legitimate but will direct consumers to a fraudulent website or otherwise persuade them to divulge personal financial information.  With that data, criminals could fill the gaps left in the trove collected in the Equifax breach, and get more information that will allow them to get into your accounts.

"These criminals are smart people," O'Farrell said.  "They know that a lot of people now are signing up for credit monitoring services, so they may wait for a year."  Then they will send phony emails that look like they are legitimately selling an extension of the monitoring services.

If you receive a suspicious email, don't call the phone number provided in the message.  Instead, look up the number and directly call the bank or credit card company the email purports to be from to see if there is a legitimate fraud concern.

there is no need to shut down your existing accounts if you think your identity has been stolen.  Unfortunately, with breaches common, this makes little sense unless you know someone has attempted to tap a particular account.

Instead, the smart approach is to watch activity in all your accounts, said Adam Levin, chairman and co-founder of the identity protection firm CyberScout.  Each week, if not daily, you should look at the activity in your bank, brokerage an credit card accounts.