Equifax Announces Comprehensive Consumer Settlement Arising From 2017 Cybersecurity Incident

Jul 22, 2019 Agreements Establish Restitution Fund for Consumers

ATLANTA, July 22, 2019 /PRNewswire/ — Equifax Inc. (NYSE: EFX) today announced a comprehensive resolution of significant U.S. consumer-related litigation and regulatory matters facing the company related to its 2017 cybersecurity incident. 

EFX logo - Powering the World with Knowledge (PRNewsfoto/Equifax Inc.)

The $671 million resolution includes settlement agreements that would resolve the multi-district consumer class action litigation, as well as investigations by the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), the Attorneys General of 48 states, Puerto Rico and the District of Columbia, and the New York Department of Financial Services (NYDFS).

If approved by the Court, a consumer restitution fund of up to $425 million will be available to pay for three-bureau credit monitoring for consumers whose information was impacted in the 2017 breach, actual out-of-pocket losses related to the breach, and other consumer benefits such as identity restoration services. Equifax has been providing free credit monitoring services to consumers since September 2017.

“This comprehensive settlement is a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company,” said Equifax Chief Executive Officer, Mark W. Begor. “The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data – and reflects the seriousness with which we take this matter. We have been committed to resolving this issue for consumers and have the financial capacity to manage the settlement while continuing our $1.25 billion EFX2020 technology and security investment program. We are focused on the future of Equifax and returning to market leadership and growth.”

As part of the resolution, Equifax has agreed to continue the significant steps it has taken in the wake of the cybersecurity incident to enhance its information security and technology program. It also has agreed to make payments totaling $290.5 million directly to certain state and federal regulatory agencies and to pay attorneys’ fees and costs in the multi-district litigation. Equifax recorded an accrual of $690 million in the first quarter of 2019 and expects to increase its accrual by approximately $11 million in the second quarter of 2019 principally related to the comprehensive consumer settlement, resulting in a total $701 million accrual related to the 2017 cybersecurity incident.

If the Court approves, members of the settlement class will receive notification of their rights and options as part of the multi-district litigation. More information can be found at www.equifaxbreachsettlement.com.

Additional detail on the terms of the proposed settlement in our Form 8-K filed today with the Securities and Exchange Commission.

Equifax CEO Mark Begor will provide details in the following conference calls:

  • 9:00 a.m. ET Conference call for investors, analysts and others
    U.S. and Canadian participants should dial: (888) 254-3590.
    International callers should dial: (786) 789-4797. 
    A replay of this conference call will be available beginning Monday, July 22 at 12:00 p.m. ET and ending at 12:00 p.m. ET on Monday, July 29.  To access the replay, please register.
  • 9:30 a.m. ET Conference call for media
    U.S. and Canadian participants should dial: (800) 289-0438. International callers should dial: (786) 789-4783.

Please dial the appropriate number 5-10 minutes prior to the start of the calls to complete registration. Name and affiliation/company are required to join.

Forward-Looking Statements

This release contains forward-looking statements and forward-looking information. These statements can be identified by expressions of belief, expectation or intention, as well as statements that are not historical fact. These statements are based on certain factors and assumptions. While the company believes these factors and assumptions to be reasonable based on information currently available, they may prove to be incorrect.

Several factors could cause actual results to differ materially from those expressed or implied in the forward-looking statements, including, but not limited to, potential adverse developments in new and pending legal proceedings or government investigations, including the failure to obtain final court approval of the agreements which make up the Consumer Settlement; uncertainties regarding the ultimate amount and timing of payments the Company may be required to make in connection with the Consumer Settlement; the cost of compliance with the Company’s non-monetary obligations associated with the Consumer Settlement; uncertainties regarding the outcome of the remaining legal proceedings or government investigations related to the 2017 cybersecurity incident; and limitations on the Company’s ability to access the capital markets and corresponding effects on the Company’s ability to finance its obligations. A summary of additional risks and uncertainties can be found in the Company’s Annual Report on Form 10-K for the year ended December 31, 2018, including without limitation under the captions “Item 1. Business — Governmental Regulation” and “— Forward-Looking Statements” and “Item 1A. Risk Factors,” and in the Company’s other filings with the U.S. Securities and Exchange Commission. Forward-looking statements are given only as at the date of this release and the company disclaims any obligation to update or revise the forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

About Equifax 
Equifax is a global data, analytics, and technology company and believes knowledge drives progress. The Company blends unique data, analytics, and technology with a passion for serving customers globally, to create insights that power decisions to move people forward. Headquartered in Atlanta, Equifax operates or has investments in 24 countries in North America, Central and South America, Europe and the Asia Pacific region. It is a member of Standard & Poor’s (S&P) 500® Index, and its common stock is traded on the New York Stock Exchange (NYSE) under the symbol EFX. Equifax employs approximately 11,000 employees worldwide. For more information, visit Equifax.com and follow the company’s news on Twitter and LinkedIn.

Which Payment Gateways Support Stored Credential Requirements?

Rules for storing and using stored cards changed for merchants in 2017, yet many payment gateways in 2019 still don’t support the transaction requirements, opening risk of issuer chargeback, fines, and assessments to merchants. Since the card networks are now notifying acquirers of non-complaint merchants, it’s time to get serious about making updates.

The four types of stored credential transactions are recurring billing, installment billing and Unscheduled Credential On File, where buyer agrees to store the card and future transactions will be initiated either by merchant or buyer. Read more about the stored credential rules either by searching the blog for ‘credential’ or click here for card network rules. The payment gateway manages most of the compliance after merchants make the appropriate changes for standalone or integrated solutions, but merchants also have responsibility for getting the proper wording and opt-in record keeping for agreements to store cards.

Which payment gateways support authorization requirements for stored credentials? Ask gateways if they support your specific card not present transaction type. Even if they do, merchant compliance is not automatic and merchants cannot rely on web developers to automatically get them updated either. This list is valid as of today. Please comment below if you have new information about updates or more payment gateways to add to the list.

  • Authorize.net- No, see developer forum for updates.
  • Bluepay- Unable to determine.
  • Braintree- Yes, added MasterCard 1/18/19, Visa 2018.
  • CenPOS– Yes, since 2017, all transaction types. CenPOS does not publish developer information online. See contact info below for sales, integrations and developer assistance.
  • Cybersource- No, not if this article is still valid. It says they are getting ready.
  • Ingenico- Maybe. Yes, with Ingenico ePayments DirectLink on the international web site, but I was unable to find the related developer code for updating US ePayments needs.
  • Orbital (Chase)- Unable to determine.
  • Payeezy (First Data)- Yes, developer instructions.
  • PayFlow Pro- Unable to determine, doesn’t look like it.
  • Shift4 – No.
  • Vantiv/WorldPay- Maybe. With the merger of these companies, merchants might or might not be using a payment gateway that supports it. Developer info for Worldpay.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for a payment gateway compliant with stored credential rules that can be quickly implemented. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

D365 ERP payment gateway

What’s an economical payment gateway for D365? One that enables business to qualify for the lowest rates possible for any given card type, mitigates chargeback risk, and creates efficiencies. Many businesses using AX 2012 and D365 need to store a card and charge on demand. To qualify for the lowest rates and mitigate risk of penalties and fines, compliance with the card network rules is required.Minimum requirements to potentially qualify for the best rates are:

  • For card not present payments, including invoice portal, support 3-D secure; some issuers offer a lower rate averaging 20 BPS (.20%) less.
  • Compliance with 2017 Visa stored credential mandate (which will also get you compliant with MasterCard etc). Many payment gateways do not support this yet.   Ask, ” Do you support “Unscheduled Credential On File” rules?; store the card, charge on demand. Currently authorize.net, Red Maple and Payflow Pro do not.
  • If doing preauthorizations, a method to reauthorize expired auths, and a method to make initial and final auth the same amount if it changes after the preauth. Failure to do so increases the qualified credit card rate an average of 30% for businesses on pass-through interchange pricing.
  • Reversing unused authorizations; Mastercard penalty is now a hefty .25% for misuse of authorization.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for a D365 payment gateway that can be quickly implemented. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

authorize.net alternative for Visa stored credential

Need an alternative to Authorize.net to comply with stored credential rules, including for both recurring and Unscheduled Credential On File? Authorize.net does not yet offer a solution for Visa stored credential or Mastercard. This includes both merchant initiated transaction and customer initiated transaction in addition to the other items in the Visa Stored Credential Transaction framework and mandates effective October 14, 2017.

The payment gateway is the biggest piece of the puzzle for compliance. My clients were compliant back in 2017. Whether integrated or standalone, I can help you comply with this and many other rules that impact merchant fees and chargeback risk. Even B2B companies that never have chargebacks are at risk.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for all your recurring billing and stored credential payment gateway and virtual terminal needs. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

Recurring Billing Rules Update

Do you hate it when you want to cancel a recurring billing service, but the business doesn’t let you cancel online and instead provided a phone number? Merchants offering SaaS or any recurring billing sign-up online, must allow customers to cancel online to comply with the Visa Stored Credential mandate.

Visa Product and Service Rules Table 5-20: Requirements for Prepayments and Transactions Using Stored Credentials, October 2018, pg 444.

What if a business does not allow you to cancel online? Report Visa violations here https://usa.visa.com/Forms/visa-rules.html. It says for in store only, but there is a check box for recurring transactions. The web site also says to contact your financial institution via the phone number on the back of the card.

The basis for the change is to enable customers more control over their purchasing, and stored card management. It makes sense if you can buy online 24/7, then you should be able to cancel online 24/7.

Rules for merchants to store cards and use stored cards changed dramatically in 2017, with enforcement beginning last year. Compliance is not automatic. Payment gateways manage most of the technical details, however, not all payment gateways are capable yet. Compliance is not optional and merchants are getting notices of violations subject to assessments and fines if not resolved. If your payment gateway or integrated solution does not support the needs to comply with the stored credential mandate, contact your acquirer, or credit card processor, to request a temporary waiver.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for all your recurring billing and stored credential payment gateway and virtual terminal needs. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.