Reporting that starts where the advice runs out.
| Author | Aurelia Bassett |
|---|---|
| Section | Innovation |
| Filed | |
| Reading | 5 min |
A breach at the title company or servicer that handled your closing exposes an unusually complete file, and the letter you get back tells you how seriously it was handled.
The file a title company builds to close a house is the most complete record of you that exists outside a federal agency. Two years of tax returns, bank statements with account numbers in the header, a scanned driver's license, the Social Security numbers of everyone on the loan, the payoff instructions from your old lender, and the wire details that moved your down payment. When that company, or the settlement agent it subcontracted to, or the mortgage servicer that bought your loan ninety days after closing, sends you a breach notice, you are not reading about an exposed email list. You are reading about that file.
Set the thorough letter and the thin one side by side and the first difference is dates. A serious notice gives you three: when the unauthorized access began, when it was discovered, and when the forensic review concluded well enough to identify whose records were in scope. The gap between the first two is usually weeks and sometimes months, because intrusions are rarely found the day they happen. The gap between discovery and your envelope is the one worth reading closely, since state notification laws set outside limits measured in days after a reasonable determination, and a company that used all of them is telling you something about its pace.
The thin letter gives you one date, or none. It says an incident occurred, that the company takes privacy seriously, and that there is no evidence of misuse. That last phrase is accurate and nearly useless, because misuse of a closing file rarely shows up in the first quarter. Stolen Social Security numbers sit. They surface when someone opens an account in March of the following year, or when a tax return filed under your number arrives at the IRS before yours does. Absence of evidence at week six is a statement about the calendar, not about your exposure.
A good notice itemizes what was in your record specifically, not what the company holds generally. It will say that the affected file contained your name, Social Security number, and financial account number, and it will say so because somebody reconstructed the contents record by record rather than describing the system in the aggregate. That distinction matters for the first year in a house more than most people expect, since the closing file also carries the loan number, the escrow account, and the property address, which together are enough to impersonate you convincingly to a servicer's phone line.
The barely adequate version says that information "may have included" a list of categories, which covers everything the vendor stores and commits to nothing. You cannot act proportionately on that. If your Social Security number was exposed, the credit freeze is the response, and it is free at each of the three nationwide bureaus. If only your name, address, and loan number were exposed, the response is different: a call to the servicer to add a verbal password and a note on the account. A letter that refuses to distinguish between those two situations has pushed its own unfinished work onto you.
Nearly every notice offers credit monitoring, typically twelve or twenty-four months, with an activation code and a deadline that falls ninety days out. The thin version stops there. The thorough version explains what the monitoring does and does not cover, provides identity restoration services with an assigned caseworker rather than a hotline, and extends the term to reflect the fact that a Social Security number does not expire when the subscription does. It also says plainly that the monitoring is an alert system, not a lock, and points you toward the freeze, which is the only control that stops a new account from being opened at all.
Activation takes about ten minutes online and the enrollment is immediate. Freezes at the bureaus are also immediate when placed online, and lifting one for a legitimate application takes roughly an hour, sometimes less, with a PIN you must keep somewhere you will find it in two years. The Federal Trade Commission is the federal body responsible for identity theft reporting and recovery guidance, and its process produces a report you can hand to a creditor later. The thorough letter mentions that route. The thin one mentions only its own vendor.
Closing files carry wire instructions, and wire fraud is the one exposure in this category with a clock measured in hours. If the breach reached a settlement agent while transactions were in flight, the serious notice says so, tells recipients who have not yet closed to verify any payoff or wiring instruction by calling a number they already had, and warns that no legitimate party will email revised instructions. If you closed last year, the equivalent risk is a payoff scam aimed at your escrow or a solicitation referencing your real loan number and balance.
A letter that acknowledges this is doing the job. It gives you a reference number, a phone line staffed by people who can see which records were in your file, and a named contact at the company rather than a mailbox. The thin letter gives you a toll-free number that reads a script and cannot confirm whether your Social Security number was among the exposed fields. That single capability, a human who can answer the one question that determines your next step, separates a notification program that was planned from one that was improvised in a week.
Freeze first, at all three bureaus, within the week, because it costs nothing and reverses easily. Enroll in the offered monitoring, since you paid for it indirectly and the enrollment window closes. Call the servicer and the title company separately and ask for a verbal password on the account and a note that wiring or payoff instructions will not be changed by email. Then file the letter with your closing documents, because if something surfaces in year two you will need the date, the reference number, and the specific description of what was exposed, and reconstructing that later from a company that has since changed vendors is slow.
What to leave alone: the urge to close the account, refinance away from the servicer, or pay for a second monitoring product. None of those remove a Social Security number from circulation, and the servicer relationship is one you did not choose and cannot easily change. The patient response is the freeze, the password, and a calendar reminder at the eleven-month mark to check whether the monitoring is about to lapse and whether the freeze PINs are still where you put them.
Most of this is finished in an afternoon, and the thorough letters make that afternoon short by answering the questions in order. When one arrives that itemizes your record, dates the discovery, and puts a person on the phone who can confirm what was in your file, the company has done the work that lets you do yours quickly and stop thinking about it.