Why Equifax credit monitoring may not be enough