3 ms·

> the best is to freeze your credit report A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thie

> the best is to freeze your credit report A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thieves already have all the info needed to unfreeze your credit?

dmoy 9y ago
Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.
bcarrell 9y ago
When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...
- ceejayoz 9y ago
  They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit. What do you want to bet it uses stuff like your SSN to verify?
  - lightbyte 9y ago
    For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id. [1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...
    - ceejayoz 9y ago
      Yeesh. > Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms. Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate. edit: Driver's license numbers were also leaked in some cases. Fun.
      - 3JPLW 9y ago
        Even worse: In a number of states, the DL number is deterministic based upon name and DOB. http://www.highprogrammer.com/alan/numbers/dl_us_shared.html http://www.highprogrammer.com/alan/numbers/dl_us_shared.html
        ConceptJunkie 9y ago
        I don't know if it's still the case, but Virginia used to your SSN as an ID. There was an opt-out for that, which I exercised about 25-30 years ago, so I don't know if that policy is still in place.
ovao 9y ago
There was no mention made that unfreeze PINs were leaked. When you freeze your report with the three CRAs, you are given an unlock code or PIN needed to unfreeze it.
- lightbyte 9y ago
  (At least for Equifax) you can get a new pin if you provide a basic form of identification. Guess what they accept? The very things that were stolen.
  - ovao 9y ago
    That's not clear from their help article about it [1], depending on what, in their definition, constitutes "proper identification forms": "If you lose the PIN that was issued to you when you added the Security Freeze to your credit file, you may request a new one in writing. Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms." [1]: https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

dmoy 9y ago

Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.

bcarrell 9y ago

When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...

ceejayoz 9y ago
They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit. What do you want to bet it uses stuff like your SSN to verify?
- lightbyte 9y ago
  For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id. [1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...
  - ceejayoz 9y ago
    Yeesh. > Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms. Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate. edit: Driver's license numbers were also leaked in some cases. Fun.
    - 3JPLW 9y ago
      Even worse: In a number of states, the DL number is deterministic based upon name and DOB. http://www.highprogrammer.com/alan/numbers/dl_us_shared.html http://www.highprogrammer.com/alan/numbers/dl_us_shared.html
      - ConceptJunkie 9y ago
        I don't know if it's still the case, but Virginia used to your SSN as an ID. There was an opt-out for that, which I exercised about 25-30 years ago, so I don't know if that policy is still in place.

ovao 9y ago

There was no mention made that unfreeze PINs were leaked. When you freeze your report with the three CRAs, you are given an unlock code or PIN needed to unfreeze it.

lightbyte 9y ago
(At least for Equifax) you can get a new pin if you provide a basic form of identification. Guess what they accept? The very things that were stolen.
- ovao 9y ago
  That's not clear from their help article about it [1], depending on what, in their definition, constitutes "proper identification forms": "If you lose the PIN that was issued to you when you added the Security Freeze to your credit file, you may request a new one in writing. Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms." [1]: https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...