4 ms·

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/identity_thief_is_unfreezing_my_credit_f

A real-life attack based on this kind of hole was discussed at https://www.reddit.com/r/personalfinance/comments/ay7aoy/identity_thief_is_unfreezing_my_credit_freeze/ https://www.reddit.com/r/personalfinance/comments/ay7aoy/ide... : someone says that an identity thief who knows all their knowledge-based question answers (because they have a copy of a credit report, no doubt) keeps somehow removing the freeze and committing more fraud.

astura 8y ago
Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you associated with?, my ex-roommate as one of the answers. Makes sense to connect us if we had the same address at the same time. -Which of the following people are/were you associated with?, my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together. Which town did/does [person] live in? Where [person] was my husband's brother. Of course, useless if everyone still lives in their hometown. I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports. The entire concept of KBA is flawed and pretty shitty all around.
- mfoy_ 8y ago
  > my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together Yikes. Where did they get that from? I wonder if they also collected tons of info from FaceBook like it seems everyone else has.
  - astura 8y ago
    This was around... Oh... 8-9 years ago and I'm still trying to figure it out. It's honestly bothered me since then. I just really want to know how they connected us. I'm not mad they did, I just want to know how. We never had an insurance policy together or anything else like that either.
    - simantel 8y ago
      Did you list them as the beneficiary of any retirement accounts or insurance policies, or maybe as an emergency contact somewhere that reports to credit bureaus?
      - astura 8y ago
        Emergency contact, that's possible... Beneficiary, certainly not, I was in college, broke as fuck, and living on student loans, didn't have any sort of assets to speak of (besides a $900 car), no retirement accounts or insurance policies (besides the minimum liability insurance required by the state).
    - kbenson 8y ago
      It could have come from the other side. If they listed your address for something (because she didn't want to list their own, or for any number of reasons), they could possibly determine that you lived together from that. Or some database got mixed up and used some shipping address for something they ordered to your residence as a home address. Having them associate you with them isn't all that weird. What's weird is that they get this information from random sources and use it for verification without verifying it's actually accurate first. That's just bonkers.
- noirbot 8y ago
  I once had a nightmare set of one where I was setting things up over the phone and had to do KBAs, and asked me who held my Auto Loan. A. Who has my loan has changed since I got it originally. B. The options they gave were (Names changed) Wachovia, Ally Bank, Ally Bank Inc, Ally Bank of New York, where the original lender was Wachovia, and I know it got sold to Ally at some point. I literally have no way to know which one of these they think is correct. At least 2 of them were correct at some point, depending on how up-to-date the data was, and the last three were indistinguishable, even when looking at my actual statements for my loan... So I failed out of my KBAs 4 straight times because they kept giving different variants of the same question, just with different sets of answers, until I could venn diagram out which one must be right because it was the only one that came up in all 4.
  - astura 8y ago
    They really are piss poor low hanging fruit level of effort. I once I got a question asking which car I owned with four answers and I had owned two cars listed... Then, of course, what if you get a question about your sister when she's toxic and you've cut her out of your life. Or even just naturally lost touch with her over the years.
  - lscotte 8y ago
    I had something like this happen to me while getting a phone plan. I have great credit, and was working for a well known silicon valley tech company with great pay, but because I couldn't remember the exact month I started a job over 25 years ago, I could only get a prepay plan. It was almost amusing.
  - wool_gather 8y ago
    The TransUnion questions in particular seem to have a reputation online for being confusingly unanswerable. I've been presented with sets where not one of the available answers was correct, and I had no idea what they expected of me. Of course I "failed", twice in a row.
- Klathmon 8y ago
  Here's a fun one for you! When I was a kid I was briefly a ward of the court. During that time, I had an official address that was not where I actually lived, and somehow the credit bureaus got ahold of that information. So whenever I need to answer the suite of questions for identity verification, if I get the "which of these places have you lived", there's a good chance I won't know the answer, because I was a kid and never actually lived there. So when that happens, I guess at one of the addresses, inevitably get it wrong, fail my own identity verification process, and need to jump through a ton of hoops to either re-try the process and hope I don't get that question, or verify my identity another way.
  - cbhl 8y ago
    Does that address show up when you request your credit report by mail? It should be free (apart from postage).
    - deleted 8y ago
      [deleted]
- macNchz 8y ago
  >I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports. I've had online car insurance instant-quote systems show me a list including both my current and previously owned cars with just a name and address, so that's encouraging that it's being used as a critical authentication measure.
- bscphil 8y ago
  I've never taken out a loan of any kind, so 90% of the time the answer to all KBA questions is "none of the above". That's aside from the fact that Equifax's site has never worked right for me anyway, and doesn't accept my information. Never been able to pull my report online from them. The other two major agencies work fine.

astura 8y ago

Some KBA questions don't show up on your credit report, that being said, they can still be guessed with some certainty if you know the person. Some examples either me or my husband have gotten: -What month was [person] born? [person] was my mom and one option was "I don't know [person]." Luckily they didn't ask the date, because I don't know that, but I do know the month. -Which of the following people are/were you associated with?, my ex-roommate as one of the answers. Makes sense to connect us if we had the same address at the same time. -Which of the following people are/were you associated with?, my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together. Which town did/does [person] live in? Where [person] was my husband's brother. Of course, useless if everyone still lives in their hometown. I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports. The entire concept of KBA is flawed and pretty shitty all around.

mfoy_ 8y ago
> my ex as one of the answers. This one baffled me because we never lived together and never had a bank account or loan together Yikes. Where did they get that from? I wonder if they also collected tons of info from FaceBook like it seems everyone else has.
- astura 8y ago
  This was around... Oh... 8-9 years ago and I'm still trying to figure it out. It's honestly bothered me since then. I just really want to know how they connected us. I'm not mad they did, I just want to know how. We never had an insurance policy together or anything else like that either.
  - simantel 8y ago
    Did you list them as the beneficiary of any retirement accounts or insurance policies, or maybe as an emergency contact somewhere that reports to credit bureaus?
    - astura 8y ago
      Emergency contact, that's possible... Beneficiary, certainly not, I was in college, broke as fuck, and living on student loans, didn't have any sort of assets to speak of (besides a $900 car), no retirement accounts or insurance policies (besides the minimum liability insurance required by the state).
  - kbenson 8y ago
    It could have come from the other side. If they listed your address for something (because she didn't want to list their own, or for any number of reasons), they could possibly determine that you lived together from that. Or some database got mixed up and used some shipping address for something they ordered to your residence as a home address. Having them associate you with them isn't all that weird. What's weird is that they get this information from random sources and use it for verification without verifying it's actually accurate first. That's just bonkers.
noirbot 8y ago
I once had a nightmare set of one where I was setting things up over the phone and had to do KBAs, and asked me who held my Auto Loan. A. Who has my loan has changed since I got it originally. B. The options they gave were (Names changed) Wachovia, Ally Bank, Ally Bank Inc, Ally Bank of New York, where the original lender was Wachovia, and I know it got sold to Ally at some point. I literally have no way to know which one of these they think is correct. At least 2 of them were correct at some point, depending on how up-to-date the data was, and the last three were indistinguishable, even when looking at my actual statements for my loan... So I failed out of my KBAs 4 straight times because they kept giving different variants of the same question, just with different sets of answers, until I could venn diagram out which one must be right because it was the only one that came up in all 4.
- astura 8y ago
  They really are piss poor low hanging fruit level of effort. I once I got a question asking which car I owned with four answers and I had owned two cars listed... Then, of course, what if you get a question about your sister when she's toxic and you've cut her out of your life. Or even just naturally lost touch with her over the years.
- lscotte 8y ago
  I had something like this happen to me while getting a phone plan. I have great credit, and was working for a well known silicon valley tech company with great pay, but because I couldn't remember the exact month I started a job over 25 years ago, I could only get a prepay plan. It was almost amusing.
- wool_gather 8y ago
  The TransUnion questions in particular seem to have a reputation online for being confusingly unanswerable. I've been presented with sets where not one of the available answers was correct, and I had no idea what they expected of me. Of course I "failed", twice in a row.
Klathmon 8y ago
Here's a fun one for you! When I was a kid I was briefly a ward of the court. During that time, I had an official address that was not where I actually lived, and somehow the credit bureaus got ahold of that information. So whenever I need to answer the suite of questions for identity verification, if I get the "which of these places have you lived", there's a good chance I won't know the answer, because I was a kid and never actually lived there. So when that happens, I guess at one of the addresses, inevitably get it wrong, fail my own identity verification process, and need to jump through a ton of hoops to either re-try the process and hope I don't get that question, or verify my identity another way.
- cbhl 8y ago
  Does that address show up when you request your credit report by mail? It should be free (apart from postage).
  - deleted 8y ago
    [deleted]
macNchz 8y ago
>I've also been asked about the previous cars I've owned, which are from DMV and insurance databases, not credit reports. I've had online car insurance instant-quote systems show me a list including both my current and previously owned cars with just a name and address, so that's encouraging that it's being used as a critical authentication measure.
bscphil 8y ago
I've never taken out a loan of any kind, so 90% of the time the answer to all KBA questions is "none of the above". That's aside from the fact that Equifax's site has never worked right for me anyway, and doesn't accept my information. Never been able to pull my report online from them. The other two major agencies work fine.