Last week, I reported about the travails I and others experienced while trying to use a new service from Equifax called "Lock & Alert." The service, which is front-ended by a website and a mobile application, allows individuals to place or remove a "security lock" on their credit reports with a click or a finger-swipe. After installing the app, I (and reporters from The New York Times as well) encountered some usability issues—as in, the app wasn't working at all.

On Friday afternoon, a spokesperson for Equifax reached out to me and offered to connect me with a senior technical support person to figure out what was going on. Yesterday, we got on the phone to work out the problem. Part of the fault for my issues rested between my chair and the touchscreen of my phone, and a whole bunch more rested with the application itself and Equifax's help line. The app is now functioning as intended. But what the app does, exactly, requires a reading of the website's fine print.

Data validation is hard

When I set up an account from my phone, I entered my email address with a typo at the end—".cm" instead of ".com." Instead of telling me that I had a malformed email address (well, an address in Cameroon), the app went ahead and created the account but then gave me a mysterious error message that instructed me to call technical support. This, I was told by the Equifax tech support representative I spoke to yesterday, was a feature, not a bug: my email address had triggered a fraud warning that a human being needed to address.









Unfortunately, when I dialed the tech support line on Friday, the person who handled my case did not catch the typo in my email address (which I spelled out over the phone three times). So when she hit a password reset button, the email alerting me to a password change went off into the bit bucket somewhere. Attempts by me to reset the password myself later were futile because I was unaware of the typo, and the app rejected my email address as invalid.

When I then assumed that my account was not actually set up and I created a new one with the same (now without a typo) email address, the app allowed me to. And then I got a screen informing me, "We are experiencing technical issues."

This, I was told by my high-level tech support person, was because Equifax had set up the system to not allow two accounts with the same individual's identity information. Again, it was for fraud prevention. But again, this was a situation that could have been easily resolved by data validation (telling me that my data already existed for another account) rather than a mystery error page that prompted another fruitless call to tech support.

Armed with that information, I was able to log in to my initial account with the malformed email address and change the email address settings. I did this from the webpage and a real keyboard this time. And, voilà, the app worked, both on the Web and on the smart phone.

While attempting to get to the page to do this, however, I found out by happenstance that someone with a Hong Kong address was already typo-squatting on "exquifax.com" and redirecting all requests to Equifax competitor TransUnion. I let the folks at Equifax know.

What does this thing do, exactly?

OK, so I can now lock and unlock my Equifax credit report at will (or as long as the service is up and running). So what does that mean exactly, and how is this different from putting a "security freeze" on my credit report? According to the Equifax spokesperson, there's no difference at all—other than the process required to manage each. The Lock & Alert approach, she said, was simply a version of the credit freeze "designed for people who are more credit-active," frequently applying for new credit—like Millennials, she explained—while the credit freeze is for people who have fewer, less-frequent interactions with companies who want to check their credit.

But there are other differences, as the Lock & Alert site explains in its FAQ (and also in this infographic), including that credit report locks may not be subject to the same regulatory control:

Security freezes (also known as credit freezes) prevent access to your Equifax credit report. Freezes are subject to regulation by each state. A security freeze must be lifted each time you apply for new credit, and temporarily lifting or permanently removing a freeze requires a PIN. In some states, you may pay a fee for placing, lifting, or removing a security freeze.

(also known as credit freezes) prevent access to your Equifax credit report. Freezes are subject to regulation by each state. A security freeze must be lifted each time you apply for new credit, and temporarily lifting or permanently removing a freeze requires a PIN. In some states, you may pay a fee for placing, lifting, or removing a security freeze. Credit report locks use identity verification techniques such as user names and passwords. With Lock & Alert, you can quickly lock or unlock your Equifax credit report using your smart phone or computer. No PIN is required, and there are no fees to lock or unlock your Equifax credit report.

Equifax's Lock & Alert service is free, but it only protects your credit report at Equifax. Credit freezes, on the other hand, are subject to fees in most states, both to put in place and remove (though some states, such as Maryland, have banned fees for credit freezes). At the federal level, a bill introduced by Senators Elizabeth Warren and Brian Schatz would require credit reporting agencies to provide freezes free of charge—but that bill, the "Freedom from Equifax Exploitation Act" (Senate Bill 1816) has not left the Senate Banking committee yet.

TransUnion and Experian offer a similar credit lock service, but only if you sign up for their credit monitoring programs. And as with Equifax's, while these are similar to credit report freezes, they are not identical in terms of regulatory oversight. And as with credit freezes, these services from all three credit reporting agencies will not prevent some access to your credit record, as Equifax notes on the Lock & Alert site:

Locking your Equifax credit report will not prevent access to your credit file at any other credit reporting agency. Locking your Equifax credit report prevents access by potential creditors and lenders, but there are exceptions. These exceptions may include: Companies like Equifax Global Consumer Solutions that provide you with access to your credit report or credit score or monitor your credit file

Companies you have an existing account or relationship with

Federal, state, and local government agencies

Collection agencies acting on behalf of companies you owe

For fraud detection purposes

Companies that wish to make pre-approved offers of credit or insurance to you

Companies reviewing your application for employment

An Equifax spokesperson said that these exceptions are true for credit freezes as well. So, if you thought locking down your credit report (or freezing it) would stop the flow of credit card offers to your mailbox, bad news—it won't.