Is Using AnnualCreditReport.com Safe?
What You Should Know Before You Check Your Credit
Checking your credit report regularly can help you spot errors and detect potentially fraudulent activity. And under federal law, you’re entitled to a free credit report from each of the three major credit bureaus—Equifax, Experian, and TransUnion—once every 12 months.
The three bureaus sponsor a website called AnnualCreditReport.com for just this purpose. But, is it safe to use? Impersonators used the site to obtain the reports of some celebrities in 2013, and there are several scam sites trying to imitate AnnualCreditReport.com. Here’s what you should know before you access your reports.
Is AnnualCreditReport.com Safe?
To understand the precautions AnnualCreditReport.com takes, it's important to have an overview of how the site works. First, you must provide your Social Security Number. You'll also need to give AnnualCreditReport.com your first and last name, your current address, and if you've lived there for less than two years, your previous address.
Once you enter that information, the site asks you which credit report you'd like to request. You can select one, two or all three. Perhaps you may want to space out your requests so you are checking on one report every few months.
After making your selection, AnnualCreditReport.com takes additional steps to verify your identity. You'll be asked to review your details to make sure they're correct. Then you'll be asked to answer three security questions. These will vary depending on your situation. For instance, you may be asked what year you took out a car loan, the balance on your mortgage—a dollar range—or to choose a city you’ve previously lived in from a list. If you answer those questions successfully, you'll be able to view your credit report(s).
Your credit reports won’t include your credit scores. Experian, TransUnion, and Equifax can provide those separately, but there are sometimes fees. You can get scores for free from sites such as CreditKarma.com or CreditSesame.com. Many major credit card companies also include free scores monthly as a perk.
AnnualCreditReport.com says your information is encrypted while you are filling out the form and when it sends your details to the three bureaus. According to the site, there are "physical, electronic and procedural safeguards” in place to ensure security, including internal and external firewalls.
Still, there is a disclaimer that “no data transmission or storage can be guaranteed to be 100% secure.” The company didn’t respond to a request for more information about the site’s security features.
In 2017, a major data breach at Equifax impacted the personal information of roughly 147 million people. There is a $671 million class-action settlement pending, and the company is undertaking a $1.25 billion technology and security investment program called EFX2020.
Can AnnualCreditReport.com Be Hacked?
While AnnualCreditReport.com takes steps to keep its site secure, hypothetically, your credit report could be accessed if an impersonator had enough of your personal information. That’s what happened in an incident in 2013. Perpetrators were able to illegally access the credit reports of some celebrities “using considerable amounts” of personal details gathered from other sources, according to TransUnion. “As we confirmed at the time, neither AnnualCreditReport.com nor TransUnion was hacked,” said David Blumberg, a TransUnion spokesman.
Keep in mind that even if someone were to obtain your Social Security Number, address history and date of birth, they would also have to successfully answer the identity verification questions. If they don’t know who holds your mortgage or the balances on your student loans, for instance, they’d hit a roadblock.
How to Spot Credit Report Scams
AnnualCreditReport.com is the only site sanctioned by the government, and there are a number of lookalike websites that the Federal Trade Commission calls imposters. Some include terms like ‘free report’ in their names, others purposely misspell annualcreditreport.com so the URL is nearly the same.
These sites may attempt to collect your personal information or direct you to other sites that want to sell you something. Or they may try to get you to sign up for a seemingly free credit report for which you'll later be charged.
Use caution if you're asked to enter your credit card or bank account number, as this could be used to bill you at the end of a free trial. Also, check the site's security certificate and be wary of sites with “HTTP” rather than “HTTPS” in the address. “HTTP” means the site is less secure.
Make sure to steer clear of sites that contain spelling or grammar errors, and be wary of phone calls or emails from senders claiming to represent AnnualCreditReport.com or one of the three major credit bureaus. The FTC says these companies won’t contact you, so anyone claiming to be them is likely a scam. You can forward emails you suspect to be scams to the FTC at firstname.lastname@example.org.