Equifax Inc. (EFX)

Equifax collects and sells information about people’s financial behavior and creditworthiness. The company maintains credit files on hundreds of millions of individuals across the United States and in many other countries, and it sells access to this information to lenders, employers, landlords, and others who need to assess credit risk or verify identity. For most people, a credit score—a number that summarizes creditworthiness—is the only direct interaction they have with Equifax, yet the company’s role is foundational to modern credit markets. If you apply for a loan, a credit card, a mortgage, or even a job, someone is almost certainly checking your Equifax credit file.

The ancient history and modern business

Equifax was founded in 1899 as an Atlanta-based credit bureau at a time when credit was local and based on personal reputation. A borrower would approach a bank, and the bank’s loan officer would know (or find out about) the borrower’s character and payment history through community connections and a local ledger. As credit markets grew and became less local, the need for a centralized, verifiable record of someone’s payment behavior became obvious. Equifax built that business—collecting information from banks, credit card companies, retailers, and others about how people paid their debts, organizing that information into credit files, and licensing access to those files.

For most of its history, Equifax was one of three major credit reporting agencies in the United States (the others are Experian and TransUnion), and all three followed a similar model: collect data, build files, license access. The companies were often called “the big three” and their oligopoly position was durable because once a credit file system is established and trusted, switching to a new vendor is extremely disruptive. Lenders have integrated their systems with Equifax and do not change vendors lightly.

Over the past few decades, Equifax has expanded far beyond simple credit reporting. The company now sells a wide range of data products and analytics: identity verification and fraud prevention services, marketing lists and analytics, employment verification, rental background checks, and risk-assessment tools for insurance, banking, and other industries. This diversification has been important because credit reporting alone, while stable and profitable, does not offer much growth—the credit-file business is mature and regulatory changes (like the Fair Credit Reporting Act and various state laws) place limits on what the company can do with data.

How the business makes money

Equifax generates revenue from three main sources: credit reporting (licensing credit files and credit scores to lenders), consumer services (selling credit reports and scores directly to consumers, and providing credit monitoring services), and other services (identity verification, fraud prevention, employment verification, analytic products). Credit reporting is still the largest and most profitable business line because it is high-margin—once data is collected, licensing it to multiple customers costs little. Consumer services are smaller but growing. The “other” category is a grab-bag of analytics and data services sold to employers, insurers, and others.

The unit economics are favorable. Equifax does not have to make anything tangible or deliver physical products. It collects data that is generated for free as a byproduct of normal economic activity (whenever someone applies for credit, that information flows into Equifax’s files), organizes it and indexes it, and then licenses access. The marginal cost of serving an additional customer is small—copy the data and deliver it—so the business is very high-margin once the infrastructure is built.

Data as the moat

Equifax’s competitive moat is data. The company has been collecting credit and financial information for over a century, which means it has the longest and most comprehensive files on the largest population. A lender would not switch to a competitor unless that competitor had equally comprehensive files, and starting from scratch would take decades. This incumbent advantage is powerful.

But it is also complicated by regulation. Consumer data is subject to more and more regulation as policymakers worry about privacy and the misuse of personal information. In the United States, the Fair Credit Reporting Act (passed in 1970 and amended several times) governs how credit reporting agencies collect, maintain, and share data. The European Union’s General Data Protection Regulation (GDPR) imposes strict limits on data collection and sharing in Europe. State laws are also tightening. This regulatory environment constrains what Equifax can do with data, even though the company has the data.

The data breach and its aftermath

In 2017, Equifax suffered a massive data breach in which hackers accessed personal information on roughly 150 million people—a significant fraction of the U.S. adult population. The hack exposed names, Social Security numbers, dates of birth, and other sensitive data. The breach was a major scandal, triggered lawsuits, regulatory investigations, and public outcry over the fact that a company so central to people’s financial lives had been storing their data so insecurely. Equifax settled with regulators and plaintiffs and agreed to pay (collectively) billions of dollars in fines and remediation. The breach also damaged the company’s reputation, though it did not materially harm its business, because lenders had few alternatives and continued relying on Equifax’s credit reports.

The breach underscored a tension in Equifax’s business: the company controls sensitive personal data that it did not generate itself (consumers do not voluntarily provide it to Equifax in the way they do to Facebook or Google) and which it has incentives to monetize as widely as possible. Consumers have little ability to opt out or control what happens to their data. This dynamic has made Equifax a political and regulatory target, and it is likely to remain one.

Market maturity and growth pressures

The U.S. credit reporting market is mature. Credit penetration is high, the number of credit active adults is stable, and regulatory limits on what Equifax can do with data do not allow for rapid growth. The company has been looking for growth in adjacent markets: identity verification and fraud prevention (where demand is rising as digital commerce grows), international credit reporting (where markets are less mature), and analytics for employers and insurers. These businesses are smaller and growing faster than core credit reporting, but they are also more competitive and lower-margin.

The company is also investing in artificial intelligence and machine learning to improve risk prediction, identity verification, and fraud detection. These tools are powerful for lenders (better prediction means better lending decisions) and for insurers and employers, but they are also subject to fair-lending concerns: if an AI model is trained on historical data and that data reflects past discrimination, the model may perpetuate it. Regulators are increasingly watching AI in financial services, which constrains how aggressively Equifax can deploy these tools.

Cyclicality and economic sensitivity

Equifax’s business is less cyclical than that of, say, a retail bank, but it is not immune to economic downturns. During recessions, lenders reduce lending and may use Equifax’s services less intensively. However, they do not stop using them, because credit decisions still need to be made. The company’s credit-reporting business is defensive—it holds up during bad times. The other businesses (identity verification, fraud prevention) may grow faster during recessions as lenders become more cautious.

Employment verification is another service line that is economically sensitive: during recessions, employers are less likely to be hiring, so there is less demand for employment verification services. The company’s consumer services (credit monitoring, credit reports sold directly to consumers) can actually be anti-cyclical: consumers are more interested in monitoring and protecting their credit during economic uncertainty.

How to research Equifax

Equifax’s 10-K filing (SEC CIK 0000033185) provides revenue broken down by segment and geography, discusses regulatory risks, and lists the company’s major customers and risk exposures. The quarterly earnings calls discuss trends in the credit reporting market, the performance of newer business lines, and the company’s investments in technology and data security. Key metrics include revenue by segment, margins (especially gross margins, which reveal the profitability of the core business), investment in compliance and data security, and the company’s exposure to regulatory changes. The credit reporting market is influenced by the overall health of consumer credit and the health of the economy, so watching credit delinquencies, loan growth, and economic forecasts helps frame expectations for Equifax. As with any company, Equifax shares trade at market prices set by supply and demand, and this profile describes the business rather than recommending any investment position.