Equifax's big money-making product? It's you

Equifax has a trove of information about you: how much you owe on your mortgage, every loan you took out, and which credit cards you hold. That is, in essence, how it makes money.

The company and its competitors have in their files the personal financial information of tens of millions of Americans like you, going back decades. 

"It's a pretty simple business model, actually. They gather as much information about you from lenders, aggregate it, and sell it back to them," said Brett Horn, an industry analyst with Morningstar.

Equifax had more than $3.1 billion in revenue last year, largely from selling data to other companies. Experian's revenue came to $4.34 billion, while TransUnion had $1.7 billion.

The trove of data — Equifax's largest asset — has become its biggest liability after the company admitted that it didn't keep the information safe from criminals who stole or accessed the data on 143 million Americans who are now at risk for identity theft. It's now under investigation at the state and federal level, facing a series of lawsuits, and desperately trying to assuage the anger of the consumers who are its commodities.

What to know about how the credit companies work:

WHERE THE MONEY COMES FROM

Equifax, Experian and TransUnion make most of their money selling bulk lists to banks and credit card companies.

American Express, for example, could purchase a list of potential customers 25 to 30 years old with credit scores above 650. Armed with that, AmEx will send out pre-approved credit card mailers, hoping to sign up new customers.

Hundreds of millions of credit reports are sold this way each year to companies like Capital One, JPMorgan Chase and Citigroup. Since the banks buy the reports in bulk, they pay as little as a few dollars per report. While people can get their credit reports once a year for free, Equifax charges $15.95 for the report plus a credit score, while Experian charges $19.95 for a report and score.

The credit bureaus also sell credit reports to potential employers. About 45 percent of companies with 2,500 to 24,999 employees do background credit checks on some job applicants, according to a 2012 study by the Society for Human Resource Management. While employers cannot get a person's credit score, they can discover legal judgments or bankruptcies.

And there are products like fraud protection services and credit monitoring. Equifax normally sells a package of credit monitoring services for $19.95 a month. Experian is more involved in that market, but has gotten into some hot water. The Consumer Financial Protection Bureau fined Experian $3 million in March for selling misleading credit scores to consumers.

Critics of the credit companies argue that Equifax could make some money off its own security failings. Its TrustedID product, which it is offering free for a year to people whose information was exposed, could retain some customers. LifeLock, another identity theft product, has also seen increased interest since the breach — but it buys its protection services from Equifax.

Finally, the company charges fees to customers who want to freeze or unfreeze their credit files. Those fees vary by state, and Equifax has waived them in the wake of the data breach.

HOW THE CIRCLE WORKS

The credit companies get information, such as whether you've paid your bills on time each month, largely for free.

An estimated 10,000 different companies and sources report information about you to Equifax, TransUnion and Experian, according to a 2012 study by the Consumer Financial Protection Bureau. Industry experts say that figure could be as high as 30,000.

That information gets compiled into your individual credit report, pooled with data from banks to build a comprehensive picture of your financial history, and your potential financial risk.

Banks are just as reliant on the credit companies. Without the credit reports, a customer could default on a loan, then apply for another elsewhere without the new bank knowing the person's history. The U.S. has thousands of individual lenders and banks, so very rarely could one bank offer a complete picture of a person's financial history.

Often, banks make credit decisions based almost entirely on what they see in a credit report from these companies.

"They are the gatekeepers to whether you can get a credit card or an affordable car loan or a house," said Chi Chi Wu, a longtime critic of the credit-reporting industry and a lawyer at the National Consumer Law Center.

THE ORIGIN OF CREDIT COMPANIES

Equifax, TransUnion and Experian are often referred to as credit bureaus or agencies, which lends them an official air. But they're private companies without government affiliation.

How the companies got to hold information on so many millions of people in the first place is largely due to their position in a lightly regulated part of the U.S. financial system. The credit companies are governed by one main federal law, the Fair Credit Reporting Act, which requires the companies to give you access to your data once a year and allow for disputes. Most of the regulation in the industry happens at the state level.

It's also incredibly difficult to opt out of the system. You could live an all-cash lifestyle, never requesting credit from any bank, but still wind up with your information in the hands of the credit companies through less-obvious sources like cable or phone companies, property tax bills, or doctors' offices.

Customers like this are known as "thin file" borrowers, because of the lack of information, but that doesn't stop Equifax, Experian and TransUnion from building files on you. In these cases, the companies might only have a name, address, maybe a Social Security number — but that data could still be enough to start the process of identity theft.