October 03, 2017
Equifax is facing a major backlash over a last month's security breach. But the company, and its core business -- selling your information -- probably isn't going anywhere.
Equifax makes money by selling your personal information to banks, credit card companies, and basically any financial institution that would lend consumers money.
The system proved flawed earlier this year when the company was hacked, potentially exposing sensitive information of more than 145 million consumers. Criminals can use the information to steal your identity and rack up debt in your name.
Equifax may face government fines and is named in several lawsuits filed by consumers and lenders. But the business of collecting and selling information on consumers is just too valuable to go away.
"I think, frankly, it's not in the interest of the industry or even regulators to shut down Equifax. They provide an essential service for consumer lending," said Brett Horn, a senior equity analyst for Morningstar.
The three big credit rating agencies -- Equifax, Experian, and TransUnion -- aggregate data into credit reports and scores that financial institutions use to evaluate how risky it is to lend money to an individual. They show whether someone has ever been late paying a credit card bill, for example, or has ever defaulted on a loan.
That information exchange makes it easier for consumer to access credit. It also makes it easier for lenders to run their business. That gives lenders a big incentive to work with the agencies.
"Most major lenders have relationships with all three agencies so that they get the most accurate information about the consumer," Horn said.
In some cases, like when loaning a mortgage backed by Fannie Mae, a company is required to check with all three agencies.
While lenders are the credit rating agencies' primary customers, they are also the ones providing the data -- for free.
Cutting off this pipeline would certainly harm Equifax's bottom line. The company reported $489 million in profit last year. In its financial filings, it said it relies "extensively" on the "voluntary contribution on credit data from most lenders in the U.S."
But it's not in the interest of lenders to stop sharing information with the credit rating agencies, Horn said. It could hurt the accuracy of the credit reports they buy back.
Lenders say that it would also harm consumers if some of their information was left off a credit report.
"By and large, financial institutions are erring on the side of continuing to report information so that accurate information gets to the credit bureaus," said Doug Johnson, senior vice president, payments and cybersecurity policy at the American Bankers Association.
Lenders may not stop sharing information with Equifax, but they could put pressure on the company with a lawsuit.
The Summit Credit Union, which has 34 branch locations in Wisconsin, is suing Equifax, asking that it cover any financial loss it will incur due to the breach.
In most cases, it's the financial institution that's responsible for fraudulent charges made to a customer's account -- regardless of where their personal information was hacked. The credit union can also face costs associated with canceling compromised credit cards and issuing new numbers, as well as monitoring for new account fraud, according to the lawsuit.
Still, lawsuits and fines are one-time costs. Beefing up security could have a longer-term impact, Horn said.
Regulatory changes could require strengthened security. Currently, the rating agencies are regulated by the Securities and Exchange Commission and consumers' rights are governed by a patchwork of state laws.
Some members of Congress have already called for a change to regulation ahead of grilling former Equifax CEO Richard Smith at four separate hearings scheduled for this week.
"It's very difficult to say when new regulations will come down. But we would expect Equifax's earnings to take a slight hit at that time," said Anthony Gambardella, an analyst at IBISWorld.
It would hit the company financially at first, but he predicts Equifax would adjust, and possibly use a strengthened security system to its advantage.
On Tuesday, Smith is expected to tell Congress that there should be an industry-wide standard that would require agencies to offer consumers free credit locks for life. It's one of the offers Equifax has made in the wake of the breach.