4 ms·

“When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other insti

“When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs.” It’s not like we have a choice. Every such business participates. I suppose it’s possible to avoid credit reporting by not having a bank account or utilities or a job, but that’s not a very practical way for most people to live. I don’t see the point in blaming banks instead of credit reporting agencies. They’re all part of one big system that works together. All parts of the system make it the way it is. It’s no more sensible to try to blame an individual component of the system than it is to debate whether to blame a murderer’s hands or his legs.

g051051 7y ago
You need to put the blame where it lies. CRAs simply aggregate data. They aren't the ones that grant credit. If someone opens a CC in your name, it wasn't the CRA that did it. So blame the bank or CC company for not sufficiently verifying identity. Think about how the process works. A criminal goes online and applies for a CC, using your personal information. The CC company goes to a CRA to check credit worthiness. The CRA says "Sure, mikeash is a responsible person who pays his debts on time". The CC company says "Great!" and hands the criminal an account in your name. It's the CC company that didn't do the due diligence to verify that it was really you. However, since the Equifax hack and the resulting backlash, the CRAs have started offering much greater consumer control to consumers. Equifax has a free service that allows you to keep your information locked and actually notify you in real time when a request is made, that you can block or allow as you wish. Basically 2FA for credit. If the other CRAs don't have that service, they soon will.
- mikeash 7y ago
  CRAs could insist on positive verification of identity before they tell anyone about my credit history. If they did, they’d fix the problem. Because they don’t, they assis in abuses. Why would I not consider them to share the blame?
  - g051051 7y ago
    I don't say they shouldn't share the blame. But simply telling a bank that you pay your bills on time isn't related to establishing identity. "Does mikeash pay his bills on time?" "Yes, mikeash pays his bills on time" "Good! Let me open this account for John Smith".
    - mikeash 7y ago
      You literally said that I need to put the blame where it lies and that it lies with the banks. A third party I’ve never interacted with gives out my private information without first asking for my permission. This is a crucial step in a common pattern of fraud. If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud. They are fully aware of all of this, and continue with business as usual anyway. How is any of this ok?
      - g051051 7y ago
        > A third party I’ve never interacted with gives out my private information without first asking for my permission. But they don't give out private information. They don't get anything but some aggregate data about how well you pay your bills. I.E. how many accounts are open, how many have been paid late in the last 30 days, etc. > If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud. That is now possible with the two CRAs: TransUnion: https://www.transunion.com/product/transunion-credit-protection https://www.transunion.com/product/transunion-credit-protect... Equifax: https://www.equifax.com/personal/products/credit/credit-lock-alert/ https://www.equifax.com/personal/products/credit/credit-lock... Experian and Innovis: I didn't see anything similar, but I'd be shocked if it wasn't imminent for them as well.
        mikeash 7y ago
        Of course it’s private information. It’s certainly not public record. It’s possible with two of them. Great. Let me know when it’s mandatory for all of them.

g051051 7y ago

You need to put the blame where it lies. CRAs simply aggregate data. They aren't the ones that grant credit. If someone opens a CC in your name, it wasn't the CRA that did it. So blame the bank or CC company for not sufficiently verifying identity. Think about how the process works. A criminal goes online and applies for a CC, using your personal information. The CC company goes to a CRA to check credit worthiness. The CRA says "Sure, mikeash is a responsible person who pays his debts on time". The CC company says "Great!" and hands the criminal an account in your name. It's the CC company that didn't do the due diligence to verify that it was really you. However, since the Equifax hack and the resulting backlash, the CRAs have started offering much greater consumer control to consumers. Equifax has a free service that allows you to keep your information locked and actually notify you in real time when a request is made, that you can block or allow as you wish. Basically 2FA for credit. If the other CRAs don't have that service, they soon will.

mikeash 7y ago
CRAs could insist on positive verification of identity before they tell anyone about my credit history. If they did, they’d fix the problem. Because they don’t, they assis in abuses. Why would I not consider them to share the blame?
- g051051 7y ago
  I don't say they shouldn't share the blame. But simply telling a bank that you pay your bills on time isn't related to establishing identity. "Does mikeash pay his bills on time?" "Yes, mikeash pays his bills on time" "Good! Let me open this account for John Smith".
  - mikeash 7y ago
    You literally said that I need to put the blame where it lies and that it lies with the banks. A third party I’ve never interacted with gives out my private information without first asking for my permission. This is a crucial step in a common pattern of fraud. If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud. They are fully aware of all of this, and continue with business as usual anyway. How is any of this ok?
    - g051051 7y ago
      > A third party I’ve never interacted with gives out my private information without first asking for my permission. But they don't give out private information. They don't get anything but some aggregate data about how well you pay your bills. I.E. how many accounts are open, how many have been paid late in the last 30 days, etc. > If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud. That is now possible with the two CRAs: TransUnion: https://www.transunion.com/product/transunion-credit-protection https://www.transunion.com/product/transunion-credit-protect... Equifax: https://www.equifax.com/personal/products/credit/credit-lock-alert/ https://www.equifax.com/personal/products/credit/credit-lock... Experian and Innovis: I didn't see anything similar, but I'd be shocked if it wasn't imminent for them as well.
      - mikeash 7y ago
        Of course it’s private information. It’s certainly not public record. It’s possible with two of them. Great. Let me know when it’s mandatory for all of them.