Want Equifax to pay? This bot helps victims file a $15,000 small claims suit

Elizabeth Weise | USA TODAY

Show Caption Hide Caption Equifax breach: How to protect your identity now Nearly half of all Americans are affected by a cyber security breach at Equifax, one of the nation's three major credit-reporting agencies. Here's how to avoid being a victim.

SAN FRANCISCO — A 20-year-old Stanford student has built a free online bot that helps anyone affected by the Equifax breach sue the company in small claims court.

For customers angry at the massive breach of financial data, the free service holds hope — and likely disappointment. If used enough, it could cause severe financial pain for Equifax. But winning in small claims court can be an arduous process.





The website created by Joshua Browder is called Do Not Pay. He originally started it in his hometown of London after he got his driver's license because he was “terrible at parallel parking, so I got a large number of parking tickets.”

He automated the system for filling in the forms to contest a parking ticket so that his bot would print them out after the user answered a series of questions.

At Stanford, he ported the site to work in the United States. When he realized his information was part of the Equifax breach that affected as many as 143 million people in the U.S., he looked around to see what his legal options were here.

More: At Equifax, a Category 5 data breach

More: Equifax data breach: I tried to freeze my credit. There were problems.

More: Readers sound off: Equifax is all show, no action for customers

More: Equifax hit with at least 23 class-action lawsuits over massive cyberbreach

He talked to some lawyers, and then this week added a new option to the site — suing Equifax in small claims court. While at least 23 class-action suits have been filed against Equifax already, Browder says "class-action suits take too much time, and too little goes to the victim. That's why I like small claims court."

Now when users visit donotpay-search-master.herokuapp.com, they see a clickable box that says “Automatically sue Equifax for $15,000.”

That leads to a series of boxes that adds the user's name and address. Browder's feeling about Equifax are clear from the last question, "What is your zip code? I am looking forward to helping you fight corporate incompetence," the bot asks.

Filling that in results in a printable PDF of the papers necessary to file suit in small claims court against Equifax in the user's state — all filled out with information about the Equifax breach.

However, that doesn’t mean the process is finished.

“A computer program that prepares small claims complaints might help people overcome the initial fear of getting the process started; however, that's just the beginning. The filer would still need to serve the paperwork and appear at the trial. That's when things get a bit more difficult,” said Cara O’Neill, a small claims expert and editor with Nolo Press, which produces do-it-yourself legal guides.

First, as the papers make clear, the individual must review, sign and then file the documents at the court address listed. In some states they might have to pay a fee to file.

Once that’s done, a court-stamped copy of the form must be sent to Equifax's registered agent in the individual's home state.

"To find that, you have to go to your state's Department of Corporation and look up the company name, which can take some searching," said Steve Reger, vice president of data breach and fraud prevention for ConsumerDirect, a consumer credit management company based in Costa Mesa, Calif.

There are broader issues as well.

“The court will likely require proof that the particular individual's information was included in the breach, that the conduct leading to the breach was negligent, and that the filer suffered harm,” Nolo's O'Neil said.

What this means is that first, the person must show what Equifax specifically did wrong to allow the breach to happen — something that thus far the company has not explained and dozens of eager computer security reporters have been able to uncover.

To be eligible for more than simply reimbursement for actual damages, the person would also need to establish that Equifax was willfully negligent.

"That's very difficult to do," said Reger, who spent 26 years at TransUnion, one of the nation's three credit-reporting companies, and dealt with thousands of such cases.

Next, the person would have to be able to prove to a judge that attackers had made use of their personally identifiable information to open accounts or otherwise steal from them. Even more important, and difficult, is that they would have to prove the information used to do so was obtained in the Equifax breach and not from some other breach.

That attribution piece is very difficult to come by and where many class-action suits stumble. Whether an individual could do so to a small court judge’s satisfaction is unclear.

If they can’t make a definitive connection, the filer might instead be required to present “pertinent statutory or case law and prove all elements required by the law,” O’Neill said.

“Either way, winning an action is more complicated than filling out paperwork, and for some, participating in a class action might be the better way to go."

However, if consumers simply want to punish Equifax, small claims court could be a viable option simply because if enough of them file it could bring the company to its knees, Reger said.

"If even a couple of thousand people filed small claims cases it would be a nightmare for Equifax to manage. At TransUnion we only ever had maybe a dozen going at once. I don't think they'd know what to do if that many people all filed against them at the same time," he said.