Claiming your $125 from Equifax is a “moral duty”

This is not to rag on boingboing in particular at all, this sort of language has become ubiquitous, but it's still incredibly frustrating. I have to wonder if "identity theft" represents one of the most effective bits of propaganda/doublespeak ever coined. The very wording flips around cause and effect and in turn responsibility. In reality people don't generally get their identities stolen, institutions/organizations fail to properly verify it. If someone claiming to be me applies for some financial service and the bank goes ahead and grants it, it's not that my "identity was stolen" it's that the bank/industry did a piss poor job of verifying it. It should be between them and the party that committed fraud, and if they go after me instead then they too should be punished for it as literal accessories to the fraud.

Instead we've ended up with this madness where parties A & B can do a transaction, and then party C can end up being pinned with it without ever having so much as a single interaction with A or B. There has been an internalized sense of helplessness and blame shifting that has allowed the industry to skate by something that we absolutely have the technology and economics to solve to a high degree. The article is not wrong that we should expend some effort to try to make sure that at least this minimal fine sticks a bit, but I resent having to be involved at all and having to give my info yet again to the guilty and having to buy into their root cursed fraud scheme and jump through their hoops.

What's really needed is a blanket law stating something along the lines that no unconnected 3rd party is ever liable for transactions between others, and that anyone who then goes after them for it is not only strictly liable for all expenses and damages but also minimum 3x punitive damages as well and some minimum flat level per incident too.

While I agree with the premise that we should make security breaches as painful and expensive as possible for negligent parties such as Equifax, the manner of this claim feels completely off.

For starters, I have to submit information to a 3rd party, and that in fact will start a process that I, as a victim (potentially, at least) of Equifax's negligence, must complete. Moreover, even the actual damages I will be entitled to is quite unknown. I realize a lot of this is due to class action law, but it's still woefully insufficient.

Furthermore, reading through the fine print, at least according to other analysis I've read about it, you also have to enroll or already be enrolled in some kind of identity protection program (such as what Equifax offers themselves). So, I would to have to opt-in to a system I am trying to stay out of in the first place.

And why do I even have to confirm my info? If Equifax has it already, then they should reach out to me, as a victim of their negligence.

There is more, but these are the most glaring issues. I realize there's not a lot that can be done, but these factors give me a strong distaste for this and I think we are deluded in thinking this will actually amount to anything more than a slap on this wrist or even cost them much of anything. It's going to cost them up to $31 million based on people's claims. It likely won't cost them more by me filling out the claims, but it will cost me as I'll have to become further entrenched in a monitoring system that got us into this mess in the first place.

I would love to dedicate my $125 (assuming I am part of the breach, which is almost certain) to the pursuit of damage, and possibly incarceration, for the Equifax CEO and top executives at the company.

Give me a reputable law firm willing to take my donation, with clear use of proceedings. I bet thousands of people would love to spend that $125 this way.

[1] https://twitter.com/rufo/status/1154872589241802753

This is a pure curiosity question, but I didn't think Equifax knew which numbers had and hadn't been leaked -- my impression was just that hackers got access to the full database. When the original announcement came out, wasn't there a big thing about how they were basically flipping a coin and returning a random result every time you checked if you were affected?

Are they really able to determine which social security numbers were stolen?

Edit: Question 12 on their FAQ says I can come back for more if there's damages in the future:

https://www.equifaxbreachsettlement.com/faq

https://equifaxbreachsettlement.com

You put in your last name and the last 6 digits of your SSN (not full SSN), it tells you if you were impacted, you give your full contact info, select the option for $125, it gives you an option for check or gift card, and done.

Legally it requires that you already have some form of credit monitoring, which from other comments here seems that many credit cards already include (mine do, e.g. Capital One).

But... I'm kind of amazed it's so easy. This really ought to be done by everyone who already has a credit card that provides free credit monitoring. I never thought I'd get to have a little feeling of personally holding Equifax accountable in a small way, but here we are. :)

I certainly had a lot of time wasted trying to figure out what to do and then taking more actions to protect from possible consequences of their screw up.

Yes its articles are somewhat fun to read, but when posting to HN, just post the real article, which is always linked in the website.

https://slate.com/technology/2019/07/equifax-settlement-mone...

[1]: https://i.imgur.com/ARPFyFl.png

I don't think it's hard for anyone to claim 10hrs on this. Just reading the news/basic research over the last 1.5 years can quickly reach 10hrs.

For me, I also signed up for credit monitoring a month after the breach announcement and have since been getting spammed every week with various credit alerts. If I spent 10 min on each mail and got 1 email/week over the last 1.5 years that would be 13 hours of pondering credit spam.