27 ms·
Experian’s credit freeze security is still a joke
- tristanb 5y agoIt’s so incredibly frustrating as a victim of identity theft to have these fucktards give away my information without any form of care. I wish I had the means to sue them into oblivion.
- sneak 5y agoIt's important to remember that you aren't the victim of identity fraud: the banks are. The reframing of the banks being defrauded as the problem/theft of the "identity" of the name mentioned by the criminal when defrauding the bank is a pretty creative and slimy way of a bank de-risking themselves.
- matsemann 5y agoYes! A thousand times yes! Someone didn't steal my identity. Someone took money from you claiming to be me. That's a you problem, not a me problem.
- rwmj 5y ago> Someone took money from you and you didn't properly check who they were.
- tristanb 5y agoWonderful theoretically - but I wasted weeks of time trying to get them to even acknowledge a problem. I've called a bank informed someone opened a line of credit pretending to be me, and been told they will get back to me, whilst letting the debt grow. There is no sense of urgency. Its such a broken system.
- emrah 5y agoAside from the reported problem, Experian is the worst of the three. Freezing/unfreezing from the website doesn't seem to work, asks for all kinds of PII to be mailed in yikes! Yet it does work (so don't mail anything in!) Total mess and they seem to have little to no incentive to fix/improve anything
- kemonocode 5y agoI've been exposed to the ludicrous US credit system through my fiancee who was affected by the Experian hack, and frankly, I completely get anyone who wants to see it all torn down. I find it ludicrous there are three different credit bureaus and they all seem to be equally incompetent for something as critical as an attempt to summarize a perception of your trustworthiness into a neat little file.
- fukmbas 5y agoForget the freeze. Their credit protection is even more of a joke. Yeah the same one I've been offered a dozen times this year because of the breaches I've been apart of. We purchased a new car no questions asked. The credit pull should have triggered an alert but it didn't. Fuck this shit
- systemvoltage 5y agoCan startup shake up this tripoly - TransUnion, Equifax and Experian? I am curious, what are the hurdles? To imagine any other way is impossible - if it is year 2050, I can't imagine these 3 to keep holding Americans hostage. Edit: Changing from SV to startup.
- 0xbadcafebee 5y agoWhat makes you think a Silicon Valley company will result in a better outcome than a non-Silicon Valley company? There are a lot of people angry at Silicon Valley companies.
- systemvoltage 5y agoI mean broadly in the sense a startup that’s funded by YC. After all, we are on YC forums. It was an earnest question and not implying anything to do with what non-SV companies can and cannot do. That said, many startups from SV have shaken up the industry veterans. I was mostly interested in the roadblocks and challenges. Not really about which city and whom can solve this problem which is far less interesting to discuss.
- esrauch 5y agoSV companies tend to be better at account security then this.
- vkou 5y agoI can't imagine SV producing anything better. Remember - you're the product, not the customer of the credit agencies. You aren't a first party in that relationship - it's a service about you, not a service for you - which is why the agency's interests are not remotely aligned with yours. The only way to make it aligned with yours is through regulation, which forces your concerns to be taken into account. Unfortunately, in the valley, that's a dirty word.
- systemvoltage 5y agoI really regret posing this question with "SV". Forget about SV, I wanted to open up a discussion about why do we have just 3 agencies monitoring our credit history? Why are they privatized? What are the checks and balances to keep them incentivized?
- Buttons840 5y agoIt's important to realize that the credit monitoring services you can buy are provided by the credit companies. The same company, which may at times make false claims about you, is in possession of a service / technology they claim can detect those false claims. Why is it not libel when these companies make false claims about me? Especially when they advertise that they have the ability to detect such false claims? "Pay us and we will not make false claims about you" they say. "Pay us and we'll double check with you before making claims we believe to be suspicious about you."
- fedorareis 5y agoDisclaimer, I work at TransUnion but the following is based on my experience as a consumer. Since I’m seeing a lot of confusion about how credit reporting is done and how credit monitoring services work let me break it down a bit. Let's say you are getting a new credit card with Chase Bank. When you apply for that credit card Chase does a hard inquiry on your credit report to decide if you are elligible for that card and what credit limit they are going to give you. If they then issue you a card they then report to the credit bureaus that you opened a new line of credit with them and the limit on that line of credit. If you have credit monitoring you would get 2 notifications. You would get a notification that a hard inquiry was made on your credit report and a second saying a new line of credit was issued to you. The point of credit monitoring isn't for the bureau to catch mistakes but for you to be aware of activity that could negatively impact your credit score. The bureau has no way of knowing if something was legitimate or not since they only have the information that was reported to them. Credit monitoring does however let you know something major happened to your credit which means you now have the ability to respond to that knowledge. There are 2 important things to remember, all 3 credit bureaus are legally required to give you 1 free credit report per year at your request. You can get it online from https://www.annualcreditreport.com/index.action https://www.annualcreditreport.com/index.action or the FTC has instructions https://www.consumer.ftc.gov/articles/0155-free-credit-reports https://www.consumer.ftc.gov/articles/0155-free-credit-repor... if you want to request it by mail. I have heard a lot of people suggest that consumers should space out requesting the 3 free credit reports so they get one about every 4 months and use that as a form of credit monitoring. It isn't completely fullproof since lenders aren't required to report to all bureaus so something could show up on only 1 report and not the other 2. The second important thing to know is that bureaus are legally required to allow consumers to dispute items on their credit report. The FTC has a sample dispute letter you can use to file a dispute, but some if not all of the bureaus have ways to file disputes online. As someone else in this thread mentioned these disputes generally require some sort of evidence that the reported item is incorrect. So say I get a credit monitoring alert that says my address has changed because some creditor reported my information incorrectly. Regardless of any other steps I should get that resolved with the creditor because it will probably keep causing issues. But I could then file a dispute with the credit bureau(s) saying that the address is incorrect which would probably require a bill or something to prove my current address (similar to how some state DMVs prove you are a resident).
- EGreg 5y agoFunny, I just called to put a Fraud Alert on my credit report. I encourage everyone to do it - so this way reputable lenders are supposed to call you when they're trying to open an account in your name. An attacker would have to port your SIM card as well... However, all the information I was providing to set the alert, or remove it, is the exact information that any lender would receive on their application. The system if so horribly broken security-wise, I am shocked there aren't more accounts being opened left and right by people who got them from applications emailed to thousands of lenders over the years.
- sfink 5y agoNote that a Fraud Alert expires after a year, so you need to keep renewing it.
- YeBanKo 5y ago> I encourage everyone to do it - so this way reputable lenders are supposed to call you when they're trying to open an account in your name. Reputable lender is something like an honest car salesman. Often consumers deal with middlemen and brokers that aren’t bearing the cost of fraudulent transaction. Isn’t it what partially what caused financial crisis of 2008? Loans were given to people with no income and one, two or even three existing mortgages. Everyone’s incentive was to earn the commission and sell it further misrepresenting low grade bonds as high grade.
- EGreg 5y agoWell, I think the fair consumer reporting act (FCRA) criminalizes the act of opening an account in someone else's name without their permission and having done absolutely no due diligence. Maybe it's not criminal but you wouldn't be able to actually get them to pay the debt later. Am I wrong?
- YeBanKo 5y agoI am not sure what penalties are for such negligence, but in any case such fraud happens and a burden to correct or monitor is on the consumer.
- RcouF1uZ4gsC 5y ago> and were surprised to find that just one of the five multiple-guess questions they were asked after entering their address, Social Security Number and date of birth had anything to do with information only the credit bureau might know. And a lot more than the credit bureau know those two pieces of information. Honestly, the US really needs a government run public key ID service. The government in providing passports and drivers’ licenses is already doing identity verification. If along with your passport they would allow you to register a public key that people could use to verify your identity, it would be a huge help.
- dylan604 5y agoPassports are federal while driver licenses are issued through the state. If you're suggesting that the public key be linked to a passport, then I'm guessing quite a few states will oppose that on "state's rights" standing.
- lhnz 5y ago> The best part about this lax authentication process is > that one can enter any email address to retrieve the > PIN — it doesn’t need to be tied to an existing account > at Equifax. Also, when the PIN is retrieved, Equifax > doesn’t bother notifying any other email addresses > already on file for that consumer. Hang on, so the attacker doesn't even need to break into somebody's email account first, they can just guess the questions and put in their own email address?! This is insane.
- Jaygles 5y agoThe days of confirming a person's identity by testing their knowledge on the person's metadata are long past (if they ever existed in the first place). I don't know what the best solution to this will look like, or if society will ever try to implement one. A lot of people are against having a Federal ID. A private solution will have its own set of problems. The good news is, its the responsibility of the place that's issuing the credit to do due diligence of confirming an identity. If someone steals your private details and gets approved for a line of credit using them, life will suck for a bit while you sort it out, but you'll never actually owe that money (no matter what the debt collectors tell you).
- toomuchtodo 5y ago> I don't know what the best solution to this will look like, or if society will ever try to implement one. https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-solve-identity-once-and-for-all https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-... (“Federal IT Policy Recommendations: 2021-2024, 4. Solve Identity Once and for All”) (disclosure: I am not Bill, just running with their recommendations)
- Jaygles 5y agoThanks for linking me to this. From a high level it sounds pretty reasonable. The private sector likely wouldn't be able to implement an in-person verifying service at a national scale.
- dawnerd 5y agoMeanwhile, I can't get equifax to unfreeze my credit. Whatever answers they have on file are wrong and tell me to call - except you cant reach a human without answering those same questions. They've yet to respond to actual mail I've sent them too. Oh well, the other agencies unlock so it just takes a little talking whenever I need to run a credit check explaining equifax is jacked up.
- PascLeRasc 5y agoI had the same experience and could only unfreeze via the Equifax iOS app. Sorry this is happening.
- dylan604 5y agoTo me, the title is overly wordy: "Experian is still a joke"
- dredmorbius 5y agoThe punch line is the public, unfortunately.
- thatguy0900 5y ago"Finally, your basic consumer (read: free) account at Experian does not give users the option to enable any sort of multi-factor authentication that might help stymie some of these PIN retrieval attacks on credit freezes. Unless, that is, you subscribe to Experian’s heavily-marketed and confusingly-worded “CreditLock” service, which charges between $14.99 and $24.99 a month" It's great to see theyre taking the knowledge that being hacked doesn't matter and putting it to good use
- yhoneycomb 5y agoThe worst part is if you get a FREE credit report with them, they sign you up for this service without you knowing. I was paying $20/month for the bullshit for about a year before I finally caught in. It's a total scam. Did a google search and found MANY other people complaining about the same thing. Their whole company is a scam.
- MereInterest 5y agoIt certainly sounds like a form of extortion to me. "We have a large amount of personal information that can be used to take out loans in your name. We, and others like us, have repeatedly shown that these databases are not secure. They will remain insecure unless you pay us."
- deleted 5y ago[deleted]
- aeontech 5y agoExperian somehow has allowed _someone_ to reset my account username and email not once but twice in the past month. I'm, to put it mildly, not happy, and I've no confidence it's not going to get reset again tomorrow. Yes, I use a complex randomly generated password. They do send an email to your previous address on the account notifying you of the fact though, which is the one silver lining.
- Aeolun 5y agoThis whole system with credit scores is utterly broken in the US.
- PascLeRasc 5y agoI really, really wish I could opt out of having accounts with the big 3 credit bureaus. Freezes don’t appear to work - they usually say that I don’t have an active freeze whenever I go to lift one. Or their website is down entirely. Or they won’t let me get to the freeze section without clicking no on their paid monitoring services 8 times. For Transunion all I needed to lift a freeze was the last 4 of my SSN, so how does that help? I don’t want to have my information with these companies. Please let me not participate. It’s like every American was given a Chase Bank account at birth that we can’t close, it’s weird.
- AdamHede 5y agoI am a part of a small but passionate group in Denmark, who advocates for giving everyone an account in the national bank at birth. This account would be able to attach a featureless debit card (using our national standard payment system "DanKort"), and have the same interest rate as the national Bank (so for now, slightly negative). Employees of the national bank is already able to get accounts like this. So there is precedence. This is obviously not a particular attractive not sophisticated "product", but it is awfully hard to hurt yourself with, and will have all the functionality that allows you to function in a modern society. Make banking a choice, and force the banks to make sufficiently attractive products to convince me to participate willingly.
- alephu5 5y agoDiEM25 advocate for this and it's a great idea. I hope it happens in Denmark and that the rest of the world follows suit.
- sdoering 5y agoNo I know were the idea in Yannis Varoufakis' new books "Another Now" originated. Or were he proposed it as he is part of DiEM25. Actually quite some interesting thoughts within this book.
- mijamo 5y agoThe ECB is working on something like that actually.
- kome 5y agoamericans: why are you so addicted to credit ratings? ban them.
- RhysU 5y agoThey're useful. How else would you get on a plane with only a suitcase, land the equivalent of a Europe away, then buy a house from an ecosystem of people that you have never dealt with before? And not overpay for the privilege? For the next 30 years?
- KirillPanov 5y agoEasy: fill the suitcase with cash.
- soared 5y agoProvide (and get verified) bank statements and tax returns that prove your financial history, and then call some old landlords/lenders. Why would it be more complicated than that?
- astura 5y agoOk now companies will see there's a huge business need to streamline this process so a new company will come along and make agreements with lenders and landlords to centralize all that information for ease of access and, congratulations, you've just created a credit bureau.
- YeBanKo 5y agoWell, you essentially described credit history, which is what credit score is based on.
- jhgb 5y agoExcept one that is more secure, perhaps?
- 5y ago
- TechBro8615 5y agoMy favorite part of this system is when they give you a year of it as compensation for a data breach, saying it’s worth 12x its monthly fee (which they make up). That’s not even touching on the fact that their solution to losing your data is asking you for more of it. I’ve never been lucky enough to be compensated with such a service. But it wouldn’t surprise me if they were so helpful that they even auto-enroll you in another (paid) year at the end of your free trial! One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. Congress is apparently only interested in fighting over the issues that nobody can agree on. Don’t hold your breath for any progress fixing systems that anyone except a lobbyist can clearly point to as broken. The problems might get some attention if the corporate media chose to hype them, but guess who buys a bunch of advertisements on their news channels?
- martinflack 5y ago> One also wonders why reforming the credit bureaus is not a bipartisan concern in Washington. And one solution might be to simply create a statutory strict liability of $1000 per consumer per breach. The (possiblity of) class action lawsuits would do the rest to encourage correct behavior. (It might encourage cover-ups as well, but you could penalize that, and incentivize and protect whistleblowing and well-intentioned security research.)
- TechBro8615 5y agoI can’t wait to get 10 free years of credit monitoring!
- hcurtiss 5y agoI recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and another with a company that handles COBRA documentation post-termination. Both of these require the service providers hold some confidential information concerning our employees. Both contracts explicitly provided (i) they will not indemnify me for state/federal penalties if they fail to do their job, and (ii) the only remedies they would provide following their data breach is one year of credit monitoring. I told them that was crazy, and if there's a breach they need to indemnify me for all losses and liability, full stop. Both companies refused so I had our broker approach different companies. Those companies proposed contracts with the same terms and also refused to change them. As the employer here merely contracting with service providers, I can't even find contractors who will take this liability on. I would 100% support legislation that would impose on these bastards penalties for the losses associated with their data breaches or failure to provide the services they say they are going to provide. I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. And those who can efficiently provide secure services to me will get my business.
- lr4444lr 5y agoIf they mean that the InfoSec is a joke, okay fair enough, but a credit freeze itself is not a joke: it shifts more of the liability to the credit bureaus for allowing your record to be pulled, of in fact that does happen by a scammer. And they notify your device if you set up MFA.
- SocksCanClose 5y agoso my buddy just built this: https://www.veradan.com https://www.veradan.com
- mcalabr 5y agoThanks for the shout-out! I am one of the founders building veradan. For all the problems they still have, credit freezes are a huge step in the right direction. We all deserve better than this. I would love to talk more with anyone interested!
- screamingninja 5y ago> so my buddy just built this: https://www.veradan.com https://www.veradan.com > We help you store all your financial data, including your free credit reports, in your secure vault. When you control your data it's easy to make the right credit decisions and get access to the best offers. I think they meant that they want to store "a copy of" all my financial data. That's one more copy. How do I control my data in this scenario?
- mcalabr 5y agoThe credit freeze stops the agencies from sharing your credit report until you remove the freeze. We think this is a lot more control than you have without a freeze! This, and having a local copy of your data are both important steps we can all take now on the path to bigger changes.
- hbcondo714 5y agoWould anyone here be able to share their experience with freezing their children's credit? We wanted to do this when our kids were born but when reviewing each credit bureau's website, they are all asking to mail paper copies of SSN and birth certificates for each child in addition to the parents' SSN and birth certificates too. There doesn't appear to be any way to freeze a minor's credit online.
- hbcondo714 5y agoAnswering my own question: Children Credit Freeze Pages: • Equifax - https://assets.equifax.com/assets/personal/Minor_Freeze_Request_Form.pdf https://assets.equifax.com/assets/personal/Minor_Freeze_Requ... • Experian - https://www.experian.com/freeze/form-minor-freeze.html https://www.experian.com/freeze/form-minor-freeze.html • TransUnion - https://www.transunion.com/credit-freeze https://www.transunion.com/credit-freeze Source: https://www.nytimes.com/2018/12/28/your-money/credit-freeze-children.html https://www.nytimes.com/2018/12/28/your-money/credit-freeze-...
- coolspot 5y agoYou don’t need to. No one will give your toddler a credit line.
- iudqnolq 5y agoDo you know that, or are you assuming? Asking because I don't know if it's an issue but some basic google searches suggests it is. > Minors are attractive targets for identity theft. Because they’re young, they have clean credit reports, and most don't discover the theft until they reach adulthood. https://www.buzzfeednews.com/article/leticiamiranda/what-happens-when-your-parent-steals-your-identity https://www.buzzfeednews.com/article/leticiamiranda/what-hap...
- jfrunyon 5y ago> A security freeze essentially blocks any potential creditors from being able to view your credit file, unless you affirmatively unfreeze or thaw your file beforehand. I feel pretty sure they can probably pinky-promise that they really are inquiring about the right person and still do at least a soft inquiry.
- jfrunyon 5y agoMost of the times I've gotten the credit bureau-style security questions (for example, trying to get my credit reports, or trying to open a bank account), - Every single one is answerable by reference to my Facebook page and a few old area phonebooks [remember when most people used to list their name, phone number, and home address for the world to see? ah yes. good times.] - And they usually tell me I'm wrong, which would make me suspicious that I was a victim of identity theft, except that the answers I give usually match the data in the report I eventually receive.
- DanAtC 5y agoAs a resident of California can I invoke the CCPA and get my information deleted from Experian et al?
- azinman2 5y agoI put a pin on my account after the first Equifax leak. Recently I needed to unfreeze it, and discovered that upon creating a “my equifax” account that I was able to unfreeze it WITHOUT THE PIN. Ive complained to the FTC (including screenshots) but haven’t heard anything. It’s so unbelievably insane these companies are allowed to operate with such massive ramifications to society and individuals!
- myrandomcomment 5y agoWhen possible fill out the list of security questions with nonsense that you keep a record of/or understand the pattern of answers to. "What's your favorite sport?" "Potato". I fill them out, screenshot the form and keep that screenshot in an encrypted file that I keep backups of. Not even text searchable that way. Also completely ridiculous I have to do any of this.
- milofeynman 5y agoI just generate my security questions as multiple random words in my password manager. I used to just do random passwords but I had to spell the random password with symbols etc over the phone a few times and quit that
- myrandomcomment 5y agoOkay ready .. A & @ , c T a 1 7 nine. Ah what?
- 1970-01-01 5y agoThe massive and swift fines they face are the punchline.
- Covzire 5y agoWow, Experian is a total scumbag company.
- paul7986 5y agoTheir credit score is a racket ...my two other scores from other agencies are higher and very, very close to each other. Experian offers a boost product where you authorize them to monitor your electric bills, etc ..once I did ... gave them permission to do so my Experian credit rating went up to the same number (a point or two off) then the other two. What a racket!!!
- willhinsa 5y agoCredit scams and identity theft are a problem for us because right now the banks don't have to pay any cost of those mistakes. The most direct way to solve the problem of credit scams and identity theft is to put the onus on the bank who opened up the account incorrectly to assume responsibility for the debt, not on the person whose account details were spoofed to create the account. This is quite humorously illustrated by a "That Mitchell and Webb Sound" skit: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- TrackerFF 5y agoHere in Norway, we have this system called BankID - it's a signing system where you can sign documents, and it tends to work great. These days, you can pretty much sign _any_ documents, no mater how important, via the BankID authentication system. It's obviously also 2FA. But still, it does manage to get abused. Unfaithful relatives / spouses / colleagues / etc. can manage to get hold of your password and device, take out loans or buy stuff, and you're 100% in the jam for it. We get cases from time to time where people are basically held accountable for hundreds of thousands in credit/consumer debt, because someone used their signatures to take out those loans. And probably 99 / 100 times, they lose in court, against the banks. The banks will argue that if they were held responsible for such actions, the modern fast-tracked system would halt to a grind. It'd be like in the old days where you needed to show up in person, with all your financials, and carefully go through everything just to get a small-ish loan.
- allset_ 5y agoSeems like the ideal use case for a hardware-backed token to be issued to each citizen to hold a private key and use MFA (PIN) to unlock that.
- Ekaros 5y agoThe auth systems in nordics are step down from that, but it still doesn't help if that is stolen or your spouse steals it, takes look at pin and so on. It is really hard to fight against this sort of access.
- exabrial 5y agoI'm still waiting for the $150 Experian owes me for leaking my private info all over the internet, after hiring a music theory major as their chief information security officer. Luckily all the lawyers in the case are now driving Lamborghinis.