The Nitty-Gritty of the Equifax Settlement

It may take you a while to get your $125. It’s still worth it.

Money falling and piling up in front of an Equifax logo.
Photo illustration by Slate. Image by greenaperture/iStock/Getty Images Plus.

On Friday, I wrote about why you should all file claims for at least $125 with Equifax as part of its data breach settlement instead of opting in to its credit monitoring product so that it ends up paying the full $575 million to $700 million settlement it negotiated with the government. My concern at the time was no one would bother to file any claims at all, and Equifax would get away with paying far less than the full terms of the settlement. But since writing the piece, lots of people seem to have taken notice, and there’s enough confusing information flying around about the terms and conditions of those payouts.

Long story short: You may not get a full $125 depending on how many people sign up, at least not right away, but you don’t forfeit the ability to file claims for out-of-pocket losses if you ask for the $125. It may take a while to get your money, too. And you could end up getting even more money if you take the credit monitoring option, but that’s a bit of a crapshoot (and a bureaucratic nightmare). Additionally, if more than 7 million people end up signing up for the credit monitoring instead of the $125 payments, that could ultimately cost Equifax even more money.

The fund for paying those $125 payouts is initially capped at $31 million out of the larger consumer fund. So, if more than 248,000 people claim them, each of them will get a prorated payout for less than $125 at first. We’ve asked the legal team representing the plaintiffs in the Equifax proceeding how many people have filed claims so far, but they said they cannot comment on those numbers yet because they are still assessing which of those claims are valid and made by class members.

There are a few important things to keep in mind here. First, the claims website allows you to request additional out-of-pocket losses as well as compensation if you spent any time trying to deal with the fallout of the breach. If you had to call up your credit bureau to freeze your credit or purchase credit monitoring or anything like that, you can claim up to 10 hours of lost time at a rate of $25 per hour even if you don’t have any documentation of that time. (If you do have documentation, you can claim up to 20 hours.) That money for lost time comes out of a separate $31 million fund and doesn’t affect the $125 payouts, so you should still claim it if you spent time dealing with the Equifax breach.

Additionally, a clause in the settlement lifts both of those $31 million caps in a period of 4½ years if Equifax has not spent its entire consumer fund (which will be at least $380.5 million and possibly as large as $505.5 million). At that point, according to the settlement, the first thing that happens with any leftover money is “the Aggregate Time Compensation Cap and Alternative Reimbursement Compensation Cap shall both be lifted (if applicable) and payments increased pro rata to Affected Consumers with valid claims up to the full amount of those claims.” (The Aggregate Time Compensation Cap is the $31 million for lost time, and the Alternative Reimbursement Compensation is the $125 payouts, also capped initially at $31 million.)

In other words, it may take a while, but odds are decent that you will eventually get your full $125, unless there are so many legal fees and claims filed for out-of-pocket losses and credit monitoring that Equifax ends up spending the entire consumer fund of at least $380.5 million on that. If more than 7 million people sign up for credit monitoring, the fund could potentially grow even larger than the initial $380.5 million.

This raises two important questions: Are you allowed to choose the payout if you didn’t purchase credit monitoring following the Equifax breach? And is it more beneficial to you—or more damaging to Equifax—to pick the payout or the credit monitoring service?

The answer to the first question is pretty clearly yes. You do have to check a box saying that you have credit monitoring. (The exact text is “I certify that I have credit monitoring and will have it for at least 6 months from today.”) But nothing on the claims website or in the text of the settlement says that has to be credit monitoring that you have paid for. Hence my suggestion that you rely on the monitoring provided to you through other breaches (my credit monitoring comes to me courtesy of the U.S. Office of Personnel Management breach, the Excellus Blue Cross Blue Shield breach, and the Anthem breach) or through free services like Credit Karma.

In terms of whether you can get more money out of Equifax by choosing the credit monitoring service instead of the cash payment and claims for lost time and out-of-pocket losses, the answer is: It depends. The settlement estimates the value of the Experian credit monitoring being offered at $1,200, but if you already have credit monitoring, it may still not be terribly valuable to you (and it will almost certainly do less to protect your money than a credit freeze!). And you can still file claims for lost time and out-of-pocket losses if you choose the cash payment. The website will even prompt you to add any claims for lost time or out-of-pocket losses.

Every individual is capped at receiving up to $20,000 from the settlement, and you can claim up to that much regardless of whether you pick the $125 payout or the credit monitoring. The difference is that in order to get a payment beyond the initial $125 (and the potential additional $250 for 10 hours of undocumented lost time), you’ll have to show some documentation of out-of-pocket losses. So you don’t forfeit your ability to claim more money just by taking the $125. You can still ask for reimbursement for any other credit monitoring you purchased after Sept. 7, 2017, or costs associated with credit freezes after that date, any losses due to identity theft, or any notary fees, long-distance phone call bills, postage, copying, or mileage involved in trying to deal with the fallout of the breach.

On the other hand, the credit monitoring service you can sign up for will come with $1 million in identity theft insurance, per the terms of the settlement. You probably don’t need me to tell you that $1 million is a lot more money than $20,000. So yes, you could personally derive a larger payout from enrolling in the monitoring service—but you’ll have to be prepared to navigate the notoriously bureaucratic and time-consuming identity theft insurance claims process. Among other obstacles, it’s often difficult for people to prove that an identity theft incident was the direct result of a particular breach, like Equifax’s, especially if their personal data has been stolen on other occasions, as part of other breaches. I’m not saying you won’t be able to claim funds through this service if your identity gets stolen; I’m just saying it will probably be a fair bit of work—as opposed to the $125, which will take you less than 60 seconds to claim.

The outcome that will cost Equifax the most is all 147 million people affected by the breach claiming out-of-pocket losses and/or signing up for credit monitoring. That’s because the settlement compels Equifax to pay up to another $125 million above and beyond the initial $380.5 million consumer fund to cover out-of-pocket losses, as needed. (That’s why the fund could potentially grow as large as $505.5 million.)

Meanwhile, the settlement assumes that roughly 7 million people will take advantage of the credit monitoring service, but if more people than that end up signing up for it, instead of claiming the $125, then Equifax will have to contribute more to pay for those additional monitoring service subscriptions, so long as they have spent the rest of the initial consumer fund on other costs (like the out-of-pocket claims and the $125 payouts). That’s why the consumer fund could grow even larger if enough people ask for credit monitoring. For every 1 million people beyond the first 7 million who sign up for credit monitoring, Equifax will have to pay an estimated $16.4 million according to the terms of the settlement. If all 147 million affected people signed up for credit monitoring, that would cost Equifax nearly an additional $2.3 billion beyond the initial consumer fund.

So the maximum penalties for Equifax do come from as many people as possible enrolling in credit monitoring—but that’s not to say that outcome provides the maximum benefits for consumers. If you forgo your $125 in hopes of driving up Equifax’s costs, that only works if at least 7 million other people do the same. And many of us don’t need any more credit monitoring, and probably wouldn’t be sufficiently motivated to bother signing up for it in numbers that would actually meaningfully drive up Equifax’s penalties. That’s the beauty of the $125: It gives people a reason to fill out the form. So I’d still encourage people to freeze their credit and take the payout, unless you don’t have any other credit monitoring and are the kind of person who is willing to put in the time and effort needed to file future claims through that monitoring service and its associated identity theft insurance.

And yes, you may not get the full $125 until 4.5 years from now, when the extended claims period ends and Equifax has to pay out the remaining money in its consumer fund. And if enough of the 147 million people affected by the breach file claims, you may not even get it all then. But on the other hand, the money would have gone to consumers, and not to Experian, which is being paid to run the credit monitoring service.

So think about what makes the most sense for you. If you don’t have any credit monitoring and you’re not intimidated by bureaucratic claims processes, then perhaps the credit monitoring is the right choice for you. On the other hand, if you’ve got some credit monitoring, either free or paid, and you know you’re not going to want to navigate filing and arguing about claims for the next few years, take the payout. Either way, you can still claim out-of-pocket losses and lost time with Equifax, and you’ll be doing your part to max out the consumer fund. Oh, and you should still freeze your credit. That’s far better protection than any monitoring service.

Update, July 31, 2019: The FTC is now encouraging people to take the credit monitoring because so many have filed for the $125. Josephine Wolff explains what’s going on—and what it means for your claim.

Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.