If you could forget the $125 from Equifax and just take the free credit monitoring, that would be great – FTC

Not enough settlement cash to go around, sighs watchdog

America's trade watchdog has officially told millions in the US not to apply for the $125 it promised each of them as part of the deal it struck with Equifax – and instead take up an offer of free credit monitoring.

In a memo on Wednesday, FTC assistant director Robert Schoshinski said the regulator has been overwhelmed by people filing claims against Equifax after the biz was cyber-looted by hackers in 2017.

He then warned that, because the settlement with the mega-hacked outfit had been capped, it is very unlikely people will end up receiving that promised $125 each. In fact, the deal may be worth no more than 21 cents. We note that the FTC website folks can file claims through, ftc.gov/equifax, no longer mentions a $125 option, whereas the settlement website it redirects to still offers the cash lump sum.

"There is a downside to this unexpected number of claims," noted Schoshinski.

"The pot of money that pays for that part of the settlement is $31 million. A large number of claims for cash instead of credit monitoring means only one thing: each person who takes the money option will wind up only getting a small amount of money. Nowhere near the $125 they could have gotten if there hadn’t been such an enormous number of claims filed."

This is what the FTC's announcement of its deal with Equifax, made on 22 July, stated:

If you were affected by the breach, you may be eligible for benefits.

1. 1. Free Credit Monitoring or $125 Cash Payment…

It seems the FTC massively underestimated the number of people that already have credit monitoring, possibly thanks to the seemingly endless number of previous cyber-heists that also come with free credit monitoring.

Equifax-you-too

Plus, it's worth pointing out that the very company at the heart of the claims – Equifax – is the same one offering the credit monitoring service that it claims is a "much better deal" than getting $125 in hard cash. Say what you like about American consumers, they aren't stupid.

It turns out that the wonderful deal that the FTC struck, which it advertised as worth "$575,000,000+," is in fact worth $31m, the cap it put on the cash-reward part of the settlement. And the $125 that the FTC put on its own announcement? When you account for the 147 million people affected, it ends up being worth just 21 cents.

"If you haven’t submitted your claim yet, think about opting for the free credit monitoring instead," prods Schoshinski before schilling for the very company that it supposed to be punishing. "Frankly, the free credit monitoring is worth a lot more – the market value would be hundreds of dollars a year. And this monitoring service is probably stronger and more helpful than any you may have already."

How did the FTC say with a straight face just this month that it had struck a $575m settlement with Equifax?

Well, aside from the $31m in actual real money, and accounting for the full market cost of credit monitoring, the deal also includes, according to the FTC, an reimbursement element of up to $20,000 for…

• Time you spent protecting your identity or recovering from identity theft, up to 20 hours at $25 per hour
• Money you spent protecting your identity or recovering from identity theft, like the cost of freezing or unfreezing your credit report or unauthorized charges to your accounts
• Up to 25 per cent of the cost of Equifax credit monitoring or identity protection products you bought between September 7, 2016 and September 7, 2017

Pull up your breaches

Schoshinski wants you to know that while you aren't going to get any money from its cash component "there is still money available under the settlement to reimburse people for what they paid out of their pocket to recover from the breach."

The sad truth is that the FTC pulls this kind of nonsense all the time: putting out massively inflated settlement figures to make it look like it is doing a great job when in fact it is massively constrained in resources and by the law to actually do anything that would cause business to think twice. There is a reason we at The Reg refer to it as "the toothless watchdog."

Just look at the FTC's largest ever fine, which it announced just this month: a massive $5bn fine for how Facebook completely ignored a previous FTC judgement against it. What happened after the enormous fined was announced? Facebook's share price actually went up.

And then there's the agency's pathetic effort to scale back the problem of robocalls. Not a month goes by without the FTC levying some huge fine against a robocaller, but the truth is that the announcement is the only thing the FTC puts any effort into.

Since 2004, the FTC has fined robocalling companies a total of $1.5bn. And it recovered just $121m, or 8 per cent of those fines. Earlier this year we decided to dig into one recent case where the FTC had got a $2.5m judgment against Daniel Carver of Perfect Image Online.

At the exact same time as it was announcing this multi-million-dollar fine to the public, the FTC was in court and told Daniel Carver that if he sold his car and gave it the proceeds, it would forget all about the fine. No monthly installments, no minimum payoff, no five-year payment plan, just a car sale and off you go.

And in case you're wondering, no it wasn't an Aston Martin Vulcan, it was a garden-variety Lexus.

And so for all of you that heard about the $125 you could get from Equifax for splashing your personal details all over the internet, guess what? You've been screwed again. This time by the very US government agency that is supposed to be overseeing all this. ®