Scam Detective
Scam verdict · Educational pattern check
Scam Detective research desk · Updated October 2026
Real bureau — record breach settlement

Is Equifax Legit? The Bureau Is Real — So Is the Record Settlement Over the Breach That Hit 147 Million People

Equifax is a real, regulated credit-reporting agency — and the subject of the largest data-breach settlement of its kind: in 2019 it agreed to pay at least $575 million, potentially up to $700 million, resolving FTC, CFPB, and 50-state allegations that its failure to take reasonable security steps caused the 2017 breach of approximately 147 million people's data. Use your free reports and freezes with confidence — and treat any “Equifax” outreach as a costume until you verify at a site you typed yourself.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL freeRead the full guide
The record · Quoted verbatim

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“Companies that profit from personal information have an extra responsibility to protect and secure that data.”

— FTC Chairman Joe Simons, July 22, 2019.

The durable question

Why this question never goes away

Equifax is one of the three nationwide credit bureaus — a real company at the center of American credit. The record is real too. The FTC alleged Equifax failed to patch a known critical vulnerability for months in 2017; hackers walked through it and operated undetected for months, taking at least 147 million names and dates of birth, 145.5 million Social Security numbers, and 209,000 payment card numbers — with network credentials and consumer data stored, per the complaint, in plain text. The 2019 settlement: at least $575 million — a $300 million consumer fund (plus up to $125 million more if needed), $175 million to 48 states, D.C., and Puerto Rico, and a $100 million CFPB civil penalty — plus a mandated security program with independent assessments and, starting January 2020, six free Equifax credit reports a year for every U.S. consumer through 2026. Read your reports, freeze what you don't need, and remember the real bureau never calls, texts, or emails to “verify” you.

The checklist

Five red flags — any one is enough

Any “Equifax” call, text, or email asking you to confirm a Social Security number or pay a fee — the bureau doesn't work that channel; breach-brand costumes are the genre's oldest trick.
A “settlement payment” message demanding information or money to release funds — real settlement administration never works that way, and the claims window for the 2019 fund closed years ago.
A credit-report site reached from an ad or a link — the only federally authorized free-report portal is annualcreditreport.com; lookalikes farm exactly the data a breach took.
Paying for your statutory free reports — Equifax must provide six free reports a year through 2026 under the settlement, on top of the weekly free reports all three bureaus offer.
Confusing “regulated” with “spotless” — the settlement record is the regulator's own document; read it before you grant anyone your data.
What to do now

Your next three moves

1
Pull your free reports at annualcreditreport.com — typed by you — and place a free credit freeze with each bureau if you won't need new credit soon.
2
Never act on “Equifax” outreach; navigate to equifax.com yourself.
3
Report breach-impostor messages at reportfraud.ftc.gov and identity theft at IdentityTheft.gov — and run any “settlement” or “credit alert” link through the $2 instant check.
Instant URL Check · $2, one-time
Holding the actual message? Check the exact link, number, or sender.
Paste it into the instant check — free risk signal in 60 seconds, then the full report for $2: a 0–100 scam risk score, a plain-English verdict, the top 5 red flags found, and a 3-step what-to-do-now list. No subscription.
Run the $2 instant check
Related verdicts

People asking this also asked

Are Credit Repair Companies Legit? Federal Law Bans Their Favorite FeeUpfront fee — illegalIs Credit Karma Legit? The Company Is Real — So Is Its $3 Million FTC RecordReal company — real FTC recordIs LifeLock Legit? The Service Is Real — So Is Its $100 Million FTC RecordReal service — $100M FTC record
← Browse all 218 answers
$2, one time
No subscription, no account, nothing to cancel.
Verdict in minutes
Full report on screen and as a PDF, usually within minutes.
Honest verdicts
If it looks safe, we say so — a clear “safe” is worth $2 too.
Got a link of your own?

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Check a URL free
Spot the scam before it spots you.
For businesses · $19, one-time
Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19
Free brand scan first — you only pay for the full audit.