9 ms·
Class Action Targets Experian over Account Security
- latchkey 4y agoI'm still waiting for my previous payout. https://news.ycombinator.com/item?id=32052378 https://news.ycombinator.com/item?id=32052378
- jmclnx 4y agoNice, I cannot wait until I get my 2.15 USD check :)
- thatguy0900 4y agoOr maybe even one year of credit monitoring!
- Justin_K 4y agoRight! Just fill out this form with your ssn, current name, address, phone and email and we'll start your free credit monitoring. (Thanks for the free updates to our db, which we may license or sell to our partners)
- _fat_santa 4y agoFree credit monitoring from the company that lost your info is like a court making a guy that ran into you while drunk your personal driver.
- reaperducer 4y agoI think I got something like $5 from a T-Mobile class action suit. But I did get ~$400 out of one of a Facebook class action, so sometimes it's worth joining.
- lynndotpy 4y agoThese $400 class-actions are more and more common nowadays. I personally know two people, two different settlements with huge corporations, who got a paycheck to that tune. You won't hear much about these because sharing the terms of the settlements usually break it. (Or so I'm told.)
- fortran77 4y agoThis is one company that should be sued until it's out of business. I hope this is a step in that direction. The fact that after a major leak, there's little protection in place to protect people from using this information to hijack accounts is extreme negligence.
- thayne 4y agoAnd then what? We're left with two other credit bureaus that aren't much better? Another company takes its place that isn't any better, or maybe is even worse?
- ghaff 4y agoOr you get a loan from the local S&L because you go to church with the loan officer or are otherwise an obviously upstanding local citizen. Before more industrialized lending, loaning money mostly came down to having relationships with the right people.
- gruez 4y agoThat itself has issues. If you're in a minority/ostracized group inequality is made worse by the fact you can't secure a loan for a house/car. Also people who are generally more outgoing/social (ie. more likely to be chummy with the local loan officer) get better loans, which is also unfair.
- ghaff 4y agoThat was basically my point.
- ClumsyPilot 4y agoSue all of them, have Zero left, and then we can live in peace
- junon 4y agoAbout time. Their security has been abysmal for ages it seems.
- thayne 4y agoIt's pretty unlikely this will do anything to improve that
- salawat 4y agoThere needs to be corporate death penalty at some point. I nominate Experian.
- markovbot 4y agoWhat would that entail? Do you think their investors, who have profited off the harm they've done, should face any repercussions?
- tomxor 4y agoThey should never be allowed to own or invest any business again, in part of full, for the rest of their lives (including as an indirect beneficiary via family or friends). On top of a hefty personal monetary penalty... bring them back down to the level of us filthy peasants so they can reap what they sow. This would help dissuade people from using companies as proxies to do evil things for profit without consequence. Since it puts you at high personal risk of burning your one lifetime chance at entrepreneurship. Or maybe fix capitalism somehow i duno (yes this is hard).
- vondur 4y agoIf the company is shut down, then they lose any investment that they've made in the company. Most investors have little knowledge of the day to day operations of a company.
- throwawaymaths 4y ago
- kylehotchkiss 4y agoI’m surprised these credit agencies haven’t found a way to require forced arbitration as a terms of service of possessing any of your data or giving it to a lender
- cptskippy 4y agoThat would require you consenting to their spying.
- reaperducer 4y agoIt's possible to consent by proxy. For example, if your employer uses ADP for payroll processing, you consent to ADP selling your wage and income history simply by working for that company. I can't imagine a job interview that would include, "Oh, by the way, if you take this job, we're going to let a multi-national megacorp know every penny you make, every two weeks, and sell that information for tracking, profiling, and advertising. Also, there's free coffee next to the men's room."
- gumby 4y agoSeems likely that nobody at your employer realizes this either.
- thayne 4y agoBecause you don't ever sign an agreement with them. They just collect your data from all the other entities you do business with. Your bank, your landlord, your employer, your credit card company, etc.
- paulgb 4y agoNot that they haven’t tried! Equifax snuck an arbitration agreement in the free credit monitoring they offered in the wake of their hack. They removed it after (understandable) uproar.
- sephamorr 4y ago"Identity theft" as a term has always struck me as a terrible description of what is happening. A bank falsely reporting to a credit agency that I am a debtor (when a criminal hands over some exclusively public information about me to get credit) seems like a slam-dunk definition of defamation. It meets the 4-part definition I'm aware of with (1) statement of fact (2) made to a 3rd party that (3) harms the reputation of the plaintiff while (4) acting negligently. (4) is of course the hardest to prove, but surely if all the information a bank asks to verify identity is in the public domain, that seems pretty clear to me.
- jliptzin 4y agoI had not thought about it that way, but that is incredibly astute.
- samwillis 4y agoBranding it as “identity theft” is a strategic move by the industry to attempt to move liability from themselves onto their customers, labelling them as the victim. The reality is in most cases it should be considered fraud against the business/bank/lender not the customer - they are the entity that has seen defrauded.
- noja 4y agohttps://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- indymike 4y agoIdentity theft is fraud that the lender failed to prevent.
- gruez 4y ago>Branding it as “identity theft” is a strategic move by the industry to attempt to move liability from themselves onto their customers, labelling them as the victim. Except nobody seriously thinks that if someone "stole" their identity, that they're on the hook for the fraudulent loans. The consumer is one of the victims here, in the sense that they have to go through the hassle to have the issue resolved.
- salawat 4y agoI'm less worried about the investors than the management. I'm fairly certain that due to the hands off nature of most American's investment choices, there's likely a bit of Experian in every portfolio out there. The main concern is to clearly, unambiguously demonstrate that the operation of a business that creates a data liability for the public, and failing to secure the data or ensure it's accuracy, will not be tolerated. Any management should be barred from management roles in similar ventures/verticals. The company assets should be liquidated, except for the data. That should be wiped. Their charter and documents of incorporation should be revoked. Whether investors end up getting paid back out of liquidation is moot. I'm fairly sure the alleged value of the company was entirely tied up in it's data, which if wiped, just leaves their in house software/operational structure, which as previoudly established, should be considered toxic in and of itself due to not being fit for operating in a manner concommitant with the task at hand. I feel for the employees, but there is a point where even you as an employee should be calling out management for not doing their job, and telling you to do yours poorly. My patience with corporate actors has grown increasingly short at an astonishing rate.
- 29athrowaway 4y agoThe Equifax breach was worse.
- MobileVet 4y agoThis. Equifax exposed 147 million identities. They should not exist today, but somehow that resulted in ‘free services’ for us instead. As was pointed out earlier, that just updated their database. Not only are we the product, but we can’t opt out. This industry is gross https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-... Edit: fixed autocorrect’s incorrect fix of Equifax name
- neodypsis 4y agoWhy can't people opt-out? Aren't there privacy laws that allow people control of their data? For instance, so that they can request to have a copy of all the data a given corporation has on them and to have them delete it as well?
- adgjlsfhk1 4y agonot in the US. GDPR gives those protections, but the US doesn't have equivalent ones.
- gingerlime 4y agoGDPR excludes some financial data. So I don’t know about Experian, but I don’t think you can opt out of your bank holding data even after you close your account. For example, Transferwise asked me to provide a copy of my passport or driving license. I asked why they keep it for 10 years after they identify me, and they pointed out to some extensive regulation (which I believe trumps the GDPR).
- ghaff 4y agoTo delete all the data, you'd be effectively be opting out of being able to get loans, credit cards, rentals, and perhaps at least some jobs. This probably isn't practical for a lot of people.
- mhb 4y agoIt sounds great, but the article would be better if it explained how the Fair Credit Reporting Act results in standing for a consumer to sue Experian. Maybe this is similar to libel? In a more reasonable world, the banks that rely on Experian would be suing Experian for facilitating fraud upon the bank.
- happyopossum 4y ago> the banks that rely on Experian would be suing Experian for facilitating fraud upon the bank. It's a racket, no doubt, but the banks won't be claiming fraud as long as there is sufficient value to them in the aggregate. An account hacked here or there is tolerable, but assessing and managing risk across the bank's entire customer base in aggregate is really the service that credit reporting agencies provide. And according to all the rich people who run the spreadsheets, it's paying off.
- TruthWillHurt 4y agoIf you ever tried integrating with their API(s), you'd want that company to be gone.
- enterthematrix 4y agoWe had a class action lawsuit before and what did it get: 1) hundreds of millions for corporate lawyers 2) almost nothing for everyone else Without functional market dynamics (ie actual competition), the class actual lawsuit doesn't actually influence Experience etc to do anything because they will always own the market, so they can continue to fuck people forever.
- echelon 4y ago> almost nothing for everyone else The Equifax class action lawsuit required you to fill out a form. Half a year later, they required you to fill out another form and then mail something in. If you forgot at any point, you'd not be entitled to your paltry settlement. The game is rigged.
- gruez 4y ago>the class actual lawsuit doesn't actually influence Experience etc to do anything because they will always own the market except as you admitted yourself, they had to pay "hundreds of millions for corporate lawyers." That seems at least somewhat of an incentive to step up security.
- pksebben 4y agonot a terribly significant dent, considering their pre tax profit is in the billions https://www.experianplc.com/media/latest-news/2022/full-year-results-fy22-180522/ https://www.experianplc.com/media/latest-news/2022/full-year...
- gruez 4y agoYeah but "hundreds of millions" can buy a lot of cybersecurity consultants. The shoplifting loss from a single store probably doesn't make much of a dent in a S&P 500 retailer's profit either, but they still spend money on loss prevention because it saves money on net.
- hackernewds 4y ago
- hardwaresofton 4y agoAt this point are class action suits even a reasonable way to penalize companies? Companies pay some small amount relative to profit so they can’t be sued by anyone in the class action again. It’s would be way more effective to sue them individually as costs are not the same for the customer versus the company legal protection. Once a single case is won it’s a rinse and repeat, no? Then lawyers could take the job pro bono knowing it will likely pay out (and what arguments to use).
- gruez 4y ago>Companies pay some small amount relative to profit so they can’t be sued by anyone in the class action again. That's not the case. If you think that you can get a better settlement perusing the case individually, you can opt out of the class action lawsuit.
- hardwaresofton 4y agoSorry what's not the case? I made two assertions in the quoted bit: - "small amount relative to profit" - "can't be sued by anyone in the class action" Most class action lawsuits levy penalties that are mostly inconsequential to companies in the long run -- in fact they just become part of the cost of doing business, and the market has realized this. There's never any danger, just a short term hit to already massive revenues, if that. Class action lawsuits are opt in, so if you've opted in and go through with it, you can't sue the company separately right? If you opt-out (after opting in) or refuse to opt-in in the first place, then you're right where you started... Being aggrieved in some way and looking for compensation. My point was that if you're looking for actual penalization of companies, class action lawsuits are basically fake justice that lawyers and businesses profit massively from. Remember when companies started removing forced arbitration because too many people started arbitrating and costs went through the roof? That's what I'm suggesting we do (it'd be great if there was a way to avoid overburden the public courts though).
- gruez 4y ago>My point was that if you're looking for actual penalization of companies, class action lawsuits are basically fake justice that lawyers and businesses profit massively from. Okay but what's the issue with this "fake justice" that you're describing? It seems pretty obvious that you take issue with class actions and are not simply describing how they work. If you don't think the settlement is fair, you're free to not participate in the class action and possibly seek your own justice through your own lawsuit. Otherwise you get the settlement which is better than the $0 you would have otherwise gotten without the class action. If you're the righteous type who knows you wouldn't sue but don't want them to get the satisfaction of settling you can opt out.
- olliej 4y agoI am counting down to another 12 months of "free credit monitoring", a nominally paid service which in any other case would be labelled extortion: give us money or we will defame you by publishing false information. Information that we know is so likely to be false we offer a paid "service" to tell you when we're defaming you.
- petilon 4y agoExperian is so powerful; you can be denied loans for buying a house if your Experian score is poor. You could have little leverage in negotiating a fair salary at your new job because Experian told your new employer what you are currently making. And you could even be denied medical care if your Experian score is poor. Private hospitals are now consulting a secret medical credit score from Experian before you even see a doctor. As a patient you do not have access to this score, nor can you see how it is generated. All you know is that you may be denied care, or receive different care, because of it. [2] [1] https://www.experian.com/consumer-information/employment-income-verification-services https://www.experian.com/consumer-information/employment-inc... [2] https://thetoolsweneed.com/poorly-secured-medical-credit-score-could-deny-you-care/ https://thetoolsweneed.com/poorly-secured-medical-credit-sco...
- gruez 4y ago>You could have little leverage in negotiating a fair salary at your new job because Experian told your new employer what you are currently making source? According to their site they only seem to "verify" incomes, rather than providing your dox to anyone who asks. [1] https://www.experian.com/consumer-information/employment-income-verification-services https://www.experian.com/consumer-information/employment-inc...
- petilon 4y agoIt is actually much worse than that. If your previous employer flags you as "not eligible for rehiring" then Experian is gonna tell that to your new employer: https://www.experian.com/blogs/employer-services/employment-verification-and-reference-checks-differences/ https://www.experian.com/blogs/employer-services/employment-...
- gruez 4y agoOkay but where does that leave my original question? The link you provided seems to suggest that employers can't dox you without your consent. In that case what experian provides isn't really different from your potential future employer asking for your w-2 from your previous job. >If your previous employer flags you as "not eligible for rehiring" then Experian is gonna tell that to your new employer: Isn't "eligible for rehire" or "would you hire this person again" a standard question to ask when checking references? It's certainly something that can work against you, but hardly something you can solely blame experian for enabling.
- axpy906 4y agoWow. These comments. I don’t think anyone likes oligopoly credit agencies. What’s an alternative?
- hn_version_0023 4y agoHave you seen Fight Club?