30 ms·

Hackers can use credit bureaus to dox nearly anyone in America

582 points by kmfrk 3y ago

hospitalJail 3y ago
Home address and phone number?!?! The horror! (Did people forget yellow pages existed?) I suppose email and SSN are yikes inducing but after a decade of having my email sold to the political parties, I don't treasure it. SSN? Haven't we moved beyond SSN for security purposes?
- bArray 3y ago
  I think that given all of this information, they could run a very convincing scam either against you, or a service you interact with. From what I can tell, SSN is still somehow considered a form of identification in the US. Edit: Commented too early.
  - hospitalJail 3y ago
    As much as WFH is a thing forever, whenever I do high stakes things, they require me to come in + show my drivers license. Seems like there are basically no exceptions when it comes to banking.
    - ethanbond 3y ago
      How might someone acquire a drivers license with your name on it? Having your SSN helps a lot!
    - landemva 3y ago
      > basically no exceptions when it comes to banking. That depends on your megabank. KYC and what staff will do over the phone is about relationships. I get things done over the phone at local credit unions and even mid-size regional banks. Banking and identity regulations allow a lot to happen, and your personal relationships make a difference. The back offices of mega-banks generally prevent personal service. Choose a different banker.
- karaterobot 3y ago
  Are you willing to provide your address and phone number in this thread, then? My guess is "no", but why not? Might other people not want their home address and phone number made public?
  - ehnto 3y ago
    When this discussion comes up, I think some people forget the context is online fraud. The attacker likely has other information on you, so a lookup service that helps them stitch it together with your real name and number is not good. The yellow pages is not a lookup service like that, it can't connect you from other information to a name and phone number, so having a book of names unlinked to the data you have gets you nowhere.
    - karaterobot 3y ago
      People also forget (or may not know, since they post-date the use of print telephone directories) that you could opt out of being in the Yellow Pages. You can't do that with credit headers, or even, practically speaking, with credit cards.
      - pessimizer 3y ago
        They also forget that it was the White Pages for personal listings, and the Yellow Pages for business listings.
        karaterobot 3y ago
        Fair point!
      - landemva 3y ago
        > or even, practically speaking, with credit cards. Yes you can opt out even with credit cards, and you can also do it for minor children in 5 easy steps: 1 clone your trust document 2 IRS.com and get TIN for trust 3 open trust savings account at bank 4 put funds in account 5 get the bank's 'secured credit card' offer in which they lock the funds If you quibble that a secured credit card is not a real credit card, then just get the debit card.
- ballenf 3y ago
  Every address you've lived at... frequently this plus a SSN is all you need to completely take over someone's identity.
- deleted 3y ago
  [deleted]
- lexlash 3y ago
  There are other services which rely on this header’s information for authentication (which of these addresses did you live at in 2021?) so for approximately $15, you can dramatically increase the effectiveness of an attack on those services. Unlisted numbers have been a white pages paid feature for a very long time. Very similar incentives in both directions compared to these headers, I’m sure. (Yellow pages were pay for inclusion, iirc.)
- OJFord 3y ago
  The criticism here should be that the starting point is 'name & state' (wouldn't 'doxing' normally be determining name/identity or more from believed-anonymous online interactions?) but otherwise yes whatever you think of how important it is that is doxing? But it's more than you cherry-picked anyway: > The file included the names and birth years of their relatives. It listed the target’s mobile phone numbers and provider, as well as personal email addresses. Finally, the file contained information from their drivers’ license, including its unique identification number. Plus 'sometimes' Social Security Number as you said.
- msla 3y ago
  > SSN? Haven't we moved beyond SSN for security purposes? No, the banks haven't, which means you haven't, bucko.
  - shadowgovt 3y ago
    Honestly, the shortest solution to these problems would be to reshape the law so that banks are 100% responsible for fraud. As in, if they open an account tied to somebody and it turns out to be tied to somebody else? 100% on them, the person who they were deceived into believing they were doing business with is fully protected by the law from any ramifications. Of course, this would completely change the risk model banks operate under and fundamentally reshape commerce as we know it. Thanks would become hypersensitive, all business would be conducted in person, banks would reserve the right to tie up your money for years if you couldn't prove who you were (think getting your Google account unlocked when Google suspects fraud, except now it's your money in the bank down the street...).
  - landemva 3y ago
    You haven't moved on because of your parents. SSN is voluntary. If parents would stop opting-in their babies into this data scheme, Americans could grow up without these numbers. After ominous threats about 'must choose name for baby' my wife and I left the hospital with our baby. Health insurer sent new member card with name 'baby girl' which worked great for all the follow-ups. And nobody from big government forced me to apply for SSN. We did get a passport (SSN on that application is optional) and travelled internationally before the first birthday. Most of this nonsense data collection is voluntary. More and more in life I say "No thank you" and move on. Many Americans get a warm blanket feeling by putting their children into voluntary data schemes.
    - msla 3y ago
      The only thing you are achieving is to add extra paperwork and hassle to your daughter's future when she later has a job or opens a bank account.
    - kccqzy 3y ago
      The only thing you are achieving is to add extra paperwork and hassle to your daughter's future when she later has a job or opens a bank account.
- pessimizer 3y ago
  > Home address and phone number?!?! The horror! (Did people forget yellow pages existed?) Are you absolutely sure that people who had real concerns about their privacy and safety allowed their phone number and address to be published in the book? Also, it was the White Pages, btw.
politician 3y ago
"...the target’s credit header. This is personal information that the credit bureaus Experian, Equifax, and TransUnion have on most adults in America via their credit cards. Through a complex web of agreements and purchases, that data trickles down from the credit bureaus to other companies who offer it to debt collectors, insurance companies, and law enforcement." ... "“Of all the entities that are the root cause of this data, “the credit bureaus are number one,” Shavell added. “They are the ones that should be subject to the strictest compliance and ultimately be held to a higher privacy standard by the federal government and by state governments than they are being,” he said." TLDR: People are using social engineering attacks to gain access to data brokers' tools that tap credit bureaus' profiles of everyone. There are no incentives for the companies in this supply chain to perform adequate due diligence before granting access to the data.
- WorldMaker 3y ago
  It isn't even social engineering because the credit bureaus are for-profit entities and want to sell any data they have to the highest bidder. Right now, the cost of a (subset of a) single user's data on the competitive market between the three terrible companies is roughly as low as $15. This isn't a "bug", it's a "feature" to these companies' profit models. It's maybe a bug in the American system that so much of this data is in the hands of for-profit companies running a race-to-the-bottom auction on it.
  - FireBeyond 3y ago
    It's even lower than that. It's $15 for a third party to purchase that information, and sell it to you at a profit to that middleman.
bluetidepro 3y ago
Has anyone ever used that DeleteMe [1] service the article mentions? It's not very cheap, and I'm wondering the value or if anyone has any first hand 2 cents on using it? [1]: https://joindeleteme.com/ https://joindeleteme.com/
- icepat 3y ago
  > Submit personal information for removal from search engines. This sounds very much like trusting a fox to guard the henhouse. When do they then do with the submitted personal information? Why should we trust that they will behave ethically with it? What happens if, and when, they have a data breach?
  - hk__2 3y ago
    > This sounds very much like trusting a fox to guard the henhouse. When do they then do with the submitted personal information? Why should we trust that they will behave ethically with it? What happens if, and when, they have a data breach? They have no incentive to behave incorrectly as all their business is based on trust. https://help.joindeleteme.com/hc/en-us/articles/8171184985235 https://help.joindeleteme.com/hc/en-us/articles/817118498523...
    - j-bos 3y ago
      Trust seems cheap when individuals often just close shop and move on.
    - icepat 3y ago
      Does not factor out data breaches. And "our business is based on trust" also has the caveat of "for now". What if they're bought out?
      - hk__2 3y ago
        > Does not factor out data breaches. And "our business is based on trust" also has the caveat of "for now". What if they're bought out? Then nobody knows. "What if?" works for litterally anything anywhere and nobody can respond to all of them, so I’m not sure what you’re expecting here.
deleted 3y ago
[deleted]
charcircuit 3y ago
Running background checks to dox people is a tale as old as time.
michaelt 3y ago
> “On the very rare occasion where we confirm misuse of TLOxp, we coordinate with law enforcement to help prosecute those responsible,” TransUnion added. This is categorically false. I've had transunion hand my entire credit report over to hackers who had nothing but public information, and transunion absolutely do not give a shit.
- tromp 3y ago
  I hope you can coordinate with law enforcement to help prosecute those at TransUnion responsible...
  - megabless123 3y ago
    law enforcement largely do not care either
    - e40 3y ago
      Largely? They give absolutely zero shits.
      - Consultant32452 3y ago
        They really enjoy laughing at you.
        dixie_land 3y ago
        So in a sense they do care :)
      - jmprspret 3y ago
        Put some of their names into these services. Cops, feds. Lookup some high-profile court cases, see if you can get names of witnesses. Now let's see if they care.
        wmf 3y ago
jhoelzel 3y ago
IMHO this is only going to get worse from here. There are piles of data that simply have not been categorized because noone cared enough about it. now a good llm will do that for you.
NelsonMinar 3y ago
Save you a click: the secret weapon is paying a criminal on a Telegram group $15 to dox someone. The article is mostly about where the doxxing services are getting their data, which changes. TransUnion's TLOxp is a popular service right now.
- nbaugh1 3y ago
  Wait, you mean the data that any random company can access when I apply for a credit card or job is also available to other people with money but don't care if I agree to it first?
  - Eisenstein 3y ago
    The article says that people pretend to be private investigators and the data companies don't confirm except 'remotely'.
    - alasdair_ 3y ago
      Why should private investigators be allowed this information at all? As the name implies they are private individuals.
      - alistairSH 3y ago
        From the article... TU (and the other credit bureaus) decided your PII can be sold without much regulation. Despite laws that require credit reports to have tighter controls. They just say "it's not a credit report; it's just PII" and poof they're magically in the clear.
      - deleted 3y ago
        [deleted]
      - anigbrowl 3y ago
        Because PIs are nominally regulated. It's a popular career with ex-cops who have investigative skills but are over the physical danger aspect of dealing with crime.
jedberg 3y ago
Just a reminder to never give private info to someone who calls you, even if they seem to have a lot of your private data already to "prove they are legit". Always call back on a number you look up, not one that they give you.
- rfonseca 3y ago
  Also, don't call from the same phone you received the call on, if on a landline. One time (I can't find the reference) scammers called from the bank, suggested the person called back to the number on their credit card. The person hung up, picked up, and the scammers had held the line, played a fake dial tone, and had someone else "pick up".
  - IIsi50MHz 3y ago
    In USA telephones, unless you timetravel to "party lines" (when sets of local numbers had the same line, so picking up while a call was in use allowed people to listen or join in), hanging up any one end of a line disconnects the call the departing user from the call. If the described scam happened, in should have required a simultaneous fault in the phone system. Or more likley, the scammer played a recorded sound of a disconnect+dialtone, which could tricker the target into dialing.
    - toast0 3y ago
      The time required for a good hangup might vary a little bit from exchange to exchange. I recall occasionally being able to transfer to different handsets hanging up one before picking up the other. But not to the extent reported in some anecdotes where one end can hold the call open indefinitely.
      - jjnoakes 3y ago
        This is definitely true. I remember being able to quickly press and release the hangup button on a single phone and if I was quick enough the other person would remain on the line. I don't recall exactly where the threshold was, but I believe it was around a half a second or so.
yessen 3y ago
There is a website (blockshopper.com) that scrapes and indexes real estate transaction data from counties that publish it. It’s easy and free to find someone’s address and doxx them. Their policy says that they only remove your data if you are a target of harassment, under court order or law enforcement officer.
- vGPU 3y ago
  In general, property tax and ownership data is public. You can somewhat increase your privacy by purchasing property under a business name, but business formation documents are also public for the most part. For example, I can go to the website of my county’s registrar and pull up the formation and renewal documentation of my LLC with just a last name. I don’t think you can effectively hide ownership of property without a shell corporation. The Corporate Transparency Act passed in 2021 requires you to provide ownership records to the treasury but I believe that ownership of the corporation can stay anonymous to the general public.
  - bombcar 3y ago
    It's doable, but the general consensus seems to be it's not worth doing - anyone who wants to dox you for the purposes of legal matters will get it anyway, and that's the biggest reason it's usually discussed. If you're just trying to keep yourself off the Internet, just change your name to John Smith or Michael Jackson.
  - tomwheeler 3y ago
    At least in the US, it's very common to for major assets (especially real estate), owned by a trust. Although a trust is different from a corporation in many ways, they're similar in that they are both legal entities distinct from the people involved (and can both have their own tax ID numbers, also distinct from those people). They're primarily created for estate planning purposes, but public records will typically show only the name of the trust, not the people who live there.
- josefresco 3y ago
  I tried it, it has no data from my zip.
lr1970 3y ago
Wrong approach. Person's identity and authentication should not be based on the immutable and public information like social security number, driver's license number, address history, etc. There are many ways such information can leak and when it does its stays there forever. We need a proper digital ID, certification and conflict resolution mechanisms. It would not be cheap but the alternatives are costlier in the long run.
- everdrive 3y ago
  I don’t disagree, but if we build a digital ID the free internet will finally be permanently dead.
  - Ylpertnodi 3y ago
    As I have taught my children: there are so many cameras around you are always being watched, or can be traced through cameras. As for the "free internet", I told my kids it's already fucking dead.
    - mrguyorama 3y ago
      The free internet died the second that Google bought doubleclick.
  - mptest 3y ago
    Don't zero knowledge maths give us a mechanism in theory to theoretically guarantee privacy and verity? In practice, I agree with your conclusion as the likely course of action.
    - xp84 3y ago
      100% possible technically, and some countries may have/may already have had success in this area. Sadly, at least according to our popular narrative, America was founded on the principle of extreme distrust of the government. Combine that with mass ignorance and a technological solution to these issues becomes impossible politically. We only even have SSL because no governments needed to be convinced to approve of it, and the list of operating system and browser vendors is so short that it became possible to essentially self-organize a set of generally-trusted root certificates.
darth_avocado 3y ago
Credit bureaus should be illegal. You can’t opt out of them and they take no responsibility in protecting you. How is it that every tech company has to abide by all kinds of rules re: PII, but they get to do whatever they like?
- lotsofpulp 3y ago
  It is a public subsidy to lenders so they can profit from lower costs of not having to do proper due diligence. If a lender claims you borrowed money, and they cannot conclusively prove it was you, it should be their problem and their problem alone. The fact that you have to prove you did not borrow money because a lender says your social security number was inputted into a form is a travesty.
  - mattnewton 3y ago
    ”identity theft” is the biggest pr win since “jaywalking”. Nothing has been stolen from me, I am still me. Someone claiming to have my credit history took money from a lender and they believed them.
    - bombcar 3y ago
      And somehow it's your problem.
    - darth_avocado 3y ago
      Identity theft is private companies not doing their jobs. Pretty much no other country has this problem because in order to get credit, you need to prove who you are by providing supporting documentation which is not easy to forge and it is the responsibility of the lender to verify the documentation. And if they don’t, it’s their problem, not yours.
      - nottorp 3y ago
        Also, in most other countries the government provides identity verification. In the form of government issued IDs and lately some governments even provide something digital. The US government doesn't provide that.
mcdonje 3y ago
"It's not a data breach if you collect money from the criminals for the data. Then it's a service offering." - Credit bureaus
m3kw9 3y ago
Make doxxing punishable by huge fines
- dghughes 3y ago
  Time in jail or prison puts more fear in people than a fine even a big fine.
  - willsoon 3y ago
    No if you have reading well your Machiavelli.
- ransackdev 3y ago
  “Punishable by fine means legal for a price”
throwawaaarrgh 3y ago
This stuff was apparent 20 years ago when PIs gave talks at hacker cons telling them all the legal ways you could get any information you ever wanted. If you Google around there are 500 online services (public companies, not hackers) to dig up private info for a small fee. I guess somebody just finally made a bot to make it easier. Articles like this read to a hacker like an article that door locks aren't secure.
- cj 3y ago
  I mean even whitepages.com surfaces and aggregates quite a bit of public data if you buy their $20 background check, and all you need is the person's phone number.
- dfxm12 3y ago
  On a tangential note, slightly less than 20 years ago I got a phone call from an ex of a girl I was seeing at the time telling me to back off. All he had to go on was my name and what college I went to. I asked him how he got my number, he said he used a service like you're describing. This has never been particularly hard for someone who was determined.
- ghaff 3y ago
  A lot of the deep web stuff has gone behind $20 or so paywalls so I haven't looked in a while. But, yeah, even 20 years ago it was obvious that by knowing very little about a person, especially if their name wasn't very common, you could find a huge amount of information about them.
rig666 3y ago
>$15 per search What chumps, just use https://freepeoplesearch.com https://freepeoplesearch.com Ya it has ads but out of all the hundreds of "free" sites it has actually the most amount of free information.
- JohnMakin 3y ago
  credit data is quite a bit more detailed than that.
- rootusrootus 3y ago
  Egads what an awful user experience. Slow, lots of ads, dumb questions. Just use http://truepeoplesearch.com http://truepeoplesearch.com if you want to stalk someone. More information, no built-in delays to make you think they're doing something hard, etc.
  - probably_wrong 3y ago
    Speaking of awful user experience... > Sorry, you have been blocked > You are unable to access truepeoplesearch.com > Why have I been blocked? > This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
deleted 3y ago
[deleted]
tptacek 3y ago
Drivers license ID numbers in many states are almost public: they're deterministically generated from basic personal information. You therefore can't use a drivers license ID number as a secure identifier anyways.
- hanniabu 3y ago
  They also provide social security numbers. What really sucks is you can't practice good hygiene and preemptively update your SSN periodically. You have to wait until your identity is stolen first.
- FireBeyond 3y ago
  > they're deterministically generated from basic personal information This used to be true, including in my state (Washington), but as of the last few years, I believe all states upon renewal of licenses now give you a non-deterministic license number.
  - tptacek 3y ago
    It's been a minute (I think I renew this year) but my driver license ID is still soundex-encoded.
    - kevinmchugh 3y ago
      My last name is soundex-encoded as the first 4 of my Illinois license, issued 18 months ago, but I don't recognize anything deterministic about the last 8
paul7986 3y ago
[dead]
everdrive 3y ago
Interestingly, you actually never get signed up for these credit services until you get a credit card. So all the things people tell you “build credit” (eg: pay your bills on time, pay your rent, etc.) don’t actually “do” anything. There’s no credit score to attach to them, so they just go off into the ether. I built credit a bit late in life and it was a struggle to get started. At this point, I kind of wish I’d just avoided building credit altogether. I wouldn’t be in any of these systems.
- stonogo 3y ago
  This isn't the case. You get signed up for these credit services when anyone makes reports about you to them. This can be, for example, your landlord. Paying rent does not indeed affect a credit score, but credit scores are separate products from credit reports. You have a right to your credit report annually, but you have no right to know your FICO (or other such) credit score; they're proprietary products. Basically, these companies will build profiles on anyone whose information gets reported to them, even if those profiles do not include a credit score.
- soared 3y ago
  Not having credit means you’ll never get a mortgage, auto loan, etc.
  - gnicholas 3y ago
    So if you don't anticipate needing a mortgage or car loan, could you get rid of credit cards and perhaps cut down your online footprint? The question is how you would pay for stuff — are debit cards just as bad? Cash is being phased out at some stores so that's not always an option. I guess you could load up my Apple Pay straight from your bank and use that instead of a credit card?
    - toast0 3y ago
      Debit cards are (typically) connected to a checking account, and most banks and credit unions use the credit reporting agency ChexSystems to check for a history of checking account infractions and report infractions there as well. However, accounts in good standing aren't typically reported. So once your account opening falls off the report, assuming you don't kite checks or overdraft, your report will be empty. I think overdrafts likely need to be frequent or left unresolved for a long enough time to get on your report too, but I'm not 100% sure. Some banks will run a credit report from other agencies while opening too, but if you don't ask for or refuse any credit cards offered, you should have an empty report from them, once everything falls off.
tennisflyi 3y ago
What information do they need to supply in the Telegram group? Edit: Name and state.
mindslight 3y ago
> Senator Ron Wyden told 404 Media in a statement that “These companies have demonstrated that they can't control who has access to their data products. The government needs to stop these companies from packaging and selling our personal information, and the senior executives that put profit over national security and Americans' safety should be punished accordingly.” I'm amazed that the quote from a politician is the most even handed substantive part of this article. The rest of the article is essentially scaremongering a misguided narrative around "criminals" gaining access to surveillance databases, when the real problem is the uncontrollable and unaccountable surveillance databases existing in the first place. The US desperately needs a port of the GDPR to give us data subjects the rights to control and prevent dossiers being kept on us.
hairofadog 3y ago
It's definitely worth taking the time to set up a credit freeze with the three big agencies (Experian, TransUnion, Equifax). Initially setting it up is a pain in the butt and is rage-inducing, as you have to provide a bunch of personal data when the whole problem in the first place is that they're careless with your data. However, once you've got it set up, it's very easy to freeze and unfreeze them. Just keep all the URLs, usernames, and passwords in a secure note somewhere, and any time you need to apply for credit, unfreeze them for a day or a week. I used to have all sorts of identity theft problems (people taking out credit in my name) but freezing my credit has solved it. Experian: https://www.experian.com/freeze/center.html https://www.experian.com/freeze/center.html TransUnion: https://www.transunion.com/credit-freeze https://www.transunion.com/credit-freeze Equifax: https://www.equifax.com/personal/credit-report-services/credit-freeze/ https://www.equifax.com/personal/credit-report-services/cred... I truly hate these companies but holding my nose and going through the process was worthwhile and I'd recommend it to anyone.
- WirelessGigabit 3y ago
  15 character max password at TransUnion... How outdated is their system? And none of the 3 allow MFA via something else than text/email.
- scrumlord 3y ago
  [dead]
- TheFreim 3y ago
  I've never taken on any debt in my life, would I still need to do this or an I fine since I've never initialized anything in the first place?
  - hairofadog 3y ago
    That's a really good question that I don't know the answer to. I would guess that they have a file on you somehow – Utility bills? Landlords checking your credit? But I'm not confident enough to know what would be the best thing to do in that scenario.
gruez 3y ago
>A short while later, the bot spat out a file containing every address that person had ever lived at in the U.S., all the way back to their college dorm more than a decade earlier. The file included the names and birth years of their relatives. It listed the target’s mobile phone numbers and provider, as well as personal email addresses. Finally, the file contained information from their drivers’ license, including its unique identification number. All of that data cost $15 in Bitcoin. The bot sometimes offers the Social Security number too for $20. Other than SSN, I don't find most of the information listed very concerning. Addresses, phone numbers, emails are semi-public anyways, considering that you hand them out anytime you make a purchase online. I'm not sure what bad stuff you can do with a drivers license id. Date of birth/relatives seems like something that can be sourced from public records (eg. voter roll). I'd prefer it if there weren't a telegram bot that dispenses all this for $15, but it's not exactly super privileged either.
rejectfinite 3y ago
[dead]
brm 3y ago
I can use a couple free searches to dox nearly anyone in America...
standardUser 3y ago
The cat has been out of the bag for a while. We need legal changes to how personal information is used after it has been acquired. It doesn't make sense any longer for it to be so easy to open lines of credit or otherwise apply stolen info.
- Joeri 3y ago
  Other countries have national ID cards that must be presented to get credit. If there is no universal and secure way to prove you are you then identity can always be stolen. No amount of duct taping the credit system can fix that.
  - standardUser 3y ago
    Printing a physical ID for everyone seems like an outdated solution. I'd sooner support biometric hardware on every connected device.
    - Sohcahtoa82 3y ago
      > I'd sooner support biometric hardware on every connected device. Ah yes, biometrics, the password that you can't change and you leave behind everywhere you go and on everything you touch. Cloning a fingerprint is trivial. They're not secure.
      - standardUser 3y ago
        Face and iris are additional options. I'd be shocked if there weren't more than those in production at this point. You know what's really trivial? Buying a fake ID.
hedora 3y ago
That whole industry needs to be banned. Courts should record loan defaults, and make that information available to creditors. Nothing else should be in the report. Lenders already require independent verification of income and (for mortgages) monthly expenses. The rest of the information that’s in your report and that is used to compute your credit score seems to be there to force people to get credit cards and to perpetuate systemic racism.
hsuduebc2 3y ago
What a dystopia. I guess I never appreciated GDPR as it deserve.
nuancebydefault 3y ago
When I read all this, I can't help but thinking that Europe is doing better in this respect. Policies like GDPR help to prevent such large scale personal data collection and hence abuse. Also, things like scores and rankings to get a loan/mortgage are not what I ever experienced. The procedure basically is, you take your last 3 salary slips and shop a few banks. You take the one with the lowest rent. Done. After all, you sign a document that states that the bank might sell your property if you do not pay off (for quite some months) Or do I see it wrong?
deleted 3y ago
[deleted]
happytiger 3y ago
It’s time for a Privacy Bill of Rights, and to eliminate credit systems that operate without explicit permission of the individual.
patrickrafferty 3y ago
Here is another thing I despise about these Credit Bureaus. Ive walked into Commercial Real Estate brokerages where every single broker had a license to a credit bureau - with many of the junior brokers using it daily to look up real estate owners to call their mobile phones. Obviously TLO knows theres no way a huge chunk of the CRE brokerage industry should be in their product on a daily basis if they were actually using a GLBA compliant use case... and they look the other way and find a way to monetize. You really dont need to go digging in some dark corner of the internet to obtain this information... you can walk in through the front door
imadierich 3y ago
[dead]
crossroadsguy 3y ago
I am from India and the credit bureau world here is Kafkaesque. Even to get the attention of a credit bureau you’ve to be their paid customer. A new loan in your name which didn’t even turn up in your dream? They helpfully tell you to contact the org that issued the loan. A card that’s not yours? Nope, not your problem. You can’t even tell them to delete your data altogether even if you’re fine working zero credit history. Even to get your own data that they got without your informed consent you’ve pay! There seem to be no venue! And suddenly one day I realise there’s yet another credit bureau and they have all my data! Amazing! Their infra even feels so sketchy that you kinda know it can be hacked the moment someone tries. As for freezing as some suggest, unfreezing is even worse. Besides it just doesn’t protect in case of data breach in any shape or form. This is one field where I hope government regulates deep and hard into their collective bottom.
__MatrixMan__ 3y ago
Somewhere in the neighborhood zero knowledge proofs and homophobic encryption is a way to evaluate creditworthiness predicates on data that's encrypted and in the open without revealing the underlying details. Let's use math to obsolete FICO and shut down these parasites.
nocsi 3y ago
The more you use your own identity, the more possibilities there are for an attacker to compromise you. So ideally.. don’t use credit. But even criminals need credit too, so they craft synthetic identities and use these as proxies to operate in, without ever using their real identity. The entire system is broken, and at this point you’re better off joining the criminals in using synthetic identities too.
derelicta 3y ago
I've had friends who got swatted very recently, and I wouldnt be surprised if the ones responsible for it went through that sort of services.
oakhaven 3y ago
In Finland, you can get credit data of a person from official source (or service resellers) for ~9 EUR. You need to know their social security number though. It's used by landlords (private and corporate) to vet potential tenants. Not sure if there's a telegram bot for that yet :D
leahgwinn9 3y ago
[dead]

582 points by kmfrk 3y ago

Home address and phone number?!?! The horror! (Did people forget yellow pages existed?) I suppose email and SSN are yikes inducing but after a decade of having my email sold to the political parties, I don't treasure it. SSN? Haven't we moved beyond SSN for security purposes?

bArray 3y ago
I think that given all of this information, they could run a very convincing scam either against you, or a service you interact with. From what I can tell, SSN is still somehow considered a form of identification in the US. Edit: Commented too early.
- hospitalJail 3y ago
  As much as WFH is a thing forever, whenever I do high stakes things, they require me to come in + show my drivers license. Seems like there are basically no exceptions when it comes to banking.
  - ethanbond 3y ago
    How might someone acquire a drivers license with your name on it? Having your SSN helps a lot!
  - landemva 3y ago
    > basically no exceptions when it comes to banking. That depends on your megabank. KYC and what staff will do over the phone is about relationships. I get things done over the phone at local credit unions and even mid-size regional banks. Banking and identity regulations allow a lot to happen, and your personal relationships make a difference. The back offices of mega-banks generally prevent personal service. Choose a different banker.
karaterobot 3y ago
Are you willing to provide your address and phone number in this thread, then? My guess is "no", but why not? Might other people not want their home address and phone number made public?
- ehnto 3y ago
  When this discussion comes up, I think some people forget the context is online fraud. The attacker likely has other information on you, so a lookup service that helps them stitch it together with your real name and number is not good. The yellow pages is not a lookup service like that, it can't connect you from other information to a name and phone number, so having a book of names unlinked to the data you have gets you nowhere.
  - karaterobot 3y ago
    People also forget (or may not know, since they post-date the use of print telephone directories) that you could opt out of being in the Yellow Pages. You can't do that with credit headers, or even, practically speaking, with credit cards.
    - pessimizer 3y ago
      They also forget that it was the White Pages for personal listings, and the Yellow Pages for business listings.
      - karaterobot 3y ago
        Fair point!
    - landemva 3y ago
      > or even, practically speaking, with credit cards. Yes you can opt out even with credit cards, and you can also do it for minor children in 5 easy steps: 1 clone your trust document 2 IRS.com and get TIN for trust 3 open trust savings account at bank 4 put funds in account 5 get the bank's 'secured credit card' offer in which they lock the funds If you quibble that a secured credit card is not a real credit card, then just get the debit card.
ballenf 3y ago
Every address you've lived at... frequently this plus a SSN is all you need to completely take over someone's identity.
deleted 3y ago
[deleted]
lexlash 3y ago
There are other services which rely on this header’s information for authentication (which of these addresses did you live at in 2021?) so for approximately $15, you can dramatically increase the effectiveness of an attack on those services. Unlisted numbers have been a white pages paid feature for a very long time. Very similar incentives in both directions compared to these headers, I’m sure. (Yellow pages were pay for inclusion, iirc.)
OJFord 3y ago
The criticism here should be that the starting point is 'name & state' (wouldn't 'doxing' normally be determining name/identity or more from believed-anonymous online interactions?) but otherwise yes whatever you think of how important it is that is doxing? But it's more than you cherry-picked anyway: > The file included the names and birth years of their relatives. It listed the target’s mobile phone numbers and provider, as well as personal email addresses. Finally, the file contained information from their drivers’ license, including its unique identification number. Plus 'sometimes' Social Security Number as you said.
msla 3y ago
> SSN? Haven't we moved beyond SSN for security purposes? No, the banks haven't, which means you haven't, bucko.
- shadowgovt 3y ago
  Honestly, the shortest solution to these problems would be to reshape the law so that banks are 100% responsible for fraud. As in, if they open an account tied to somebody and it turns out to be tied to somebody else? 100% on them, the person who they were deceived into believing they were doing business with is fully protected by the law from any ramifications. Of course, this would completely change the risk model banks operate under and fundamentally reshape commerce as we know it. Thanks would become hypersensitive, all business would be conducted in person, banks would reserve the right to tie up your money for years if you couldn't prove who you were (think getting your Google account unlocked when Google suspects fraud, except now it's your money in the bank down the street...).
- landemva 3y ago
  You haven't moved on because of your parents. SSN is voluntary. If parents would stop opting-in their babies into this data scheme, Americans could grow up without these numbers. After ominous threats about 'must choose name for baby' my wife and I left the hospital with our baby. Health insurer sent new member card with name 'baby girl' which worked great for all the follow-ups. And nobody from big government forced me to apply for SSN. We did get a passport (SSN on that application is optional) and travelled internationally before the first birthday. Most of this nonsense data collection is voluntary. More and more in life I say "No thank you" and move on. Many Americans get a warm blanket feeling by putting their children into voluntary data schemes.
  - msla 3y ago
    The only thing you are achieving is to add extra paperwork and hassle to your daughter's future when she later has a job or opens a bank account.
  - kccqzy 3y ago
    The only thing you are achieving is to add extra paperwork and hassle to your daughter's future when she later has a job or opens a bank account.
pessimizer 3y ago
> Home address and phone number?!?! The horror! (Did people forget yellow pages existed?) Are you absolutely sure that people who had real concerns about their privacy and safety allowed their phone number and address to be published in the book? Also, it was the White Pages, btw.

politician 3y ago

"...the target’s credit header. This is personal information that the credit bureaus Experian, Equifax, and TransUnion have on most adults in America via their credit cards. Through a complex web of agreements and purchases, that data trickles down from the credit bureaus to other companies who offer it to debt collectors, insurance companies, and law enforcement." ... "“Of all the entities that are the root cause of this data, “the credit bureaus are number one,” Shavell added. “They are the ones that should be subject to the strictest compliance and ultimately be held to a higher privacy standard by the federal government and by state governments than they are being,” he said." TLDR: People are using social engineering attacks to gain access to data brokers' tools that tap credit bureaus' profiles of everyone. There are no incentives for the companies in this supply chain to perform adequate due diligence before granting access to the data.

WorldMaker 3y ago
It isn't even social engineering because the credit bureaus are for-profit entities and want to sell any data they have to the highest bidder. Right now, the cost of a (subset of a) single user's data on the competitive market between the three terrible companies is roughly as low as $15. This isn't a "bug", it's a "feature" to these companies' profit models. It's maybe a bug in the American system that so much of this data is in the hands of for-profit companies running a race-to-the-bottom auction on it.
- FireBeyond 3y ago
  It's even lower than that. It's $15 for a third party to purchase that information, and sell it to you at a profit to that middleman.

bluetidepro 3y ago

Has anyone ever used that DeleteMe [1] service the article mentions? It's not very cheap, and I'm wondering the value or if anyone has any first hand 2 cents on using it? [1]: https://joindeleteme.com/ https://joindeleteme.com/

icepat 3y ago
> Submit personal information for removal from search engines. This sounds very much like trusting a fox to guard the henhouse. When do they then do with the submitted personal information? Why should we trust that they will behave ethically with it? What happens if, and when, they have a data breach?
- hk__2 3y ago
  > This sounds very much like trusting a fox to guard the henhouse. When do they then do with the submitted personal information? Why should we trust that they will behave ethically with it? What happens if, and when, they have a data breach? They have no incentive to behave incorrectly as all their business is based on trust. https://help.joindeleteme.com/hc/en-us/articles/8171184985235 https://help.joindeleteme.com/hc/en-us/articles/817118498523...
  - j-bos 3y ago
    Trust seems cheap when individuals often just close shop and move on.
  - icepat 3y ago
    Does not factor out data breaches. And "our business is based on trust" also has the caveat of "for now". What if they're bought out?
    - hk__2 3y ago
      > Does not factor out data breaches. And "our business is based on trust" also has the caveat of "for now". What if they're bought out? Then nobody knows. "What if?" works for litterally anything anywhere and nobody can respond to all of them, so I’m not sure what you’re expecting here.

deleted 3y ago

[deleted]

charcircuit 3y ago

Running background checks to dox people is a tale as old as time.

michaelt 3y ago

> “On the very rare occasion where we confirm misuse of TLOxp, we coordinate with law enforcement to help prosecute those responsible,” TransUnion added. This is categorically false. I've had transunion hand my entire credit report over to hackers who had nothing but public information, and transunion absolutely do not give a shit.

tromp 3y ago
I hope you can coordinate with law enforcement to help prosecute those at TransUnion responsible...
- megabless123 3y ago
  law enforcement largely do not care either
  - e40 3y ago
    Largely? They give absolutely zero shits.
    - Consultant32452 3y ago
      They really enjoy laughing at you.
      - dixie_land 3y ago
        So in a sense they do care :)
    - jmprspret 3y ago
      Put some of their names into these services. Cops, feds. Lookup some high-profile court cases, see if you can get names of witnesses. Now let's see if they care.
      - wmf 3y ago

jhoelzel 3y ago

IMHO this is only going to get worse from here. There are piles of data that simply have not been categorized because noone cared enough about it. now a good llm will do that for you.

NelsonMinar 3y ago

Save you a click: the secret weapon is paying a criminal on a Telegram group $15 to dox someone. The article is mostly about where the doxxing services are getting their data, which changes. TransUnion's TLOxp is a popular service right now.

nbaugh1 3y ago
Wait, you mean the data that any random company can access when I apply for a credit card or job is also available to other people with money but don't care if I agree to it first?
- Eisenstein 3y ago
  The article says that people pretend to be private investigators and the data companies don't confirm except 'remotely'.
  - alasdair_ 3y ago
    Why should private investigators be allowed this information at all? As the name implies they are private individuals.
    - alistairSH 3y ago
      From the article... TU (and the other credit bureaus) decided your PII can be sold without much regulation. Despite laws that require credit reports to have tighter controls. They just say "it's not a credit report; it's just PII" and poof they're magically in the clear.
    - deleted 3y ago
      [deleted]
    - anigbrowl 3y ago
      Because PIs are nominally regulated. It's a popular career with ex-cops who have investigative skills but are over the physical danger aspect of dealing with crime.

jedberg 3y ago

Just a reminder to never give private info to someone who calls you, even if they seem to have a lot of your private data already to "prove they are legit". Always call back on a number you look up, not one that they give you.

rfonseca 3y ago
Also, don't call from the same phone you received the call on, if on a landline. One time (I can't find the reference) scammers called from the bank, suggested the person called back to the number on their credit card. The person hung up, picked up, and the scammers had held the line, played a fake dial tone, and had someone else "pick up".
- IIsi50MHz 3y ago
  In USA telephones, unless you timetravel to "party lines" (when sets of local numbers had the same line, so picking up while a call was in use allowed people to listen or join in), hanging up any one end of a line disconnects the call the departing user from the call. If the described scam happened, in should have required a simultaneous fault in the phone system. Or more likley, the scammer played a recorded sound of a disconnect+dialtone, which could tricker the target into dialing.
  - toast0 3y ago
    The time required for a good hangup might vary a little bit from exchange to exchange. I recall occasionally being able to transfer to different handsets hanging up one before picking up the other. But not to the extent reported in some anecdotes where one end can hold the call open indefinitely.
    - jjnoakes 3y ago
      This is definitely true. I remember being able to quickly press and release the hangup button on a single phone and if I was quick enough the other person would remain on the line. I don't recall exactly where the threshold was, but I believe it was around a half a second or so.

yessen 3y ago

There is a website (blockshopper.com) that scrapes and indexes real estate transaction data from counties that publish it. It’s easy and free to find someone’s address and doxx them. Their policy says that they only remove your data if you are a target of harassment, under court order or law enforcement officer.

vGPU 3y ago
In general, property tax and ownership data is public. You can somewhat increase your privacy by purchasing property under a business name, but business formation documents are also public for the most part. For example, I can go to the website of my county’s registrar and pull up the formation and renewal documentation of my LLC with just a last name. I don’t think you can effectively hide ownership of property without a shell corporation. The Corporate Transparency Act passed in 2021 requires you to provide ownership records to the treasury but I believe that ownership of the corporation can stay anonymous to the general public.
- bombcar 3y ago
  It's doable, but the general consensus seems to be it's not worth doing - anyone who wants to dox you for the purposes of legal matters will get it anyway, and that's the biggest reason it's usually discussed. If you're just trying to keep yourself off the Internet, just change your name to John Smith or Michael Jackson.
- tomwheeler 3y ago
  At least in the US, it's very common to for major assets (especially real estate), owned by a trust. Although a trust is different from a corporation in many ways, they're similar in that they are both legal entities distinct from the people involved (and can both have their own tax ID numbers, also distinct from those people). They're primarily created for estate planning purposes, but public records will typically show only the name of the trust, not the people who live there.
josefresco 3y ago
I tried it, it has no data from my zip.

lr1970 3y ago

Wrong approach. Person's identity and authentication should not be based on the immutable and public information like social security number, driver's license number, address history, etc. There are many ways such information can leak and when it does its stays there forever. We need a proper digital ID, certification and conflict resolution mechanisms. It would not be cheap but the alternatives are costlier in the long run.

everdrive 3y ago
I don’t disagree, but if we build a digital ID the free internet will finally be permanently dead.
- Ylpertnodi 3y ago
  As I have taught my children: there are so many cameras around you are always being watched, or can be traced through cameras. As for the "free internet", I told my kids it's already fucking dead.
  - mrguyorama 3y ago
    The free internet died the second that Google bought doubleclick.
- mptest 3y ago
  Don't zero knowledge maths give us a mechanism in theory to theoretically guarantee privacy and verity? In practice, I agree with your conclusion as the likely course of action.
  - xp84 3y ago
    100% possible technically, and some countries may have/may already have had success in this area. Sadly, at least according to our popular narrative, America was founded on the principle of extreme distrust of the government. Combine that with mass ignorance and a technological solution to these issues becomes impossible politically. We only even have SSL because no governments needed to be convinced to approve of it, and the list of operating system and browser vendors is so short that it became possible to essentially self-organize a set of generally-trusted root certificates.

darth_avocado 3y ago

Credit bureaus should be illegal. You can’t opt out of them and they take no responsibility in protecting you. How is it that every tech company has to abide by all kinds of rules re: PII, but they get to do whatever they like?

lotsofpulp 3y ago
It is a public subsidy to lenders so they can profit from lower costs of not having to do proper due diligence. If a lender claims you borrowed money, and they cannot conclusively prove it was you, it should be their problem and their problem alone. The fact that you have to prove you did not borrow money because a lender says your social security number was inputted into a form is a travesty.
- mattnewton 3y ago
  ”identity theft” is the biggest pr win since “jaywalking”. Nothing has been stolen from me, I am still me. Someone claiming to have my credit history took money from a lender and they believed them.
  - bombcar 3y ago
    And somehow it's your problem.
  - darth_avocado 3y ago
    Identity theft is private companies not doing their jobs. Pretty much no other country has this problem because in order to get credit, you need to prove who you are by providing supporting documentation which is not easy to forge and it is the responsibility of the lender to verify the documentation. And if they don’t, it’s their problem, not yours.
    - nottorp 3y ago
      Also, in most other countries the government provides identity verification. In the form of government issued IDs and lately some governments even provide something digital. The US government doesn't provide that.

mcdonje 3y ago

"It's not a data breach if you collect money from the criminals for the data. Then it's a service offering." - Credit bureaus

m3kw9 3y ago

Make doxxing punishable by huge fines

dghughes 3y ago
Time in jail or prison puts more fear in people than a fine even a big fine.
- willsoon 3y ago
  No if you have reading well your Machiavelli.
ransackdev 3y ago
“Punishable by fine means legal for a price”

throwawaaarrgh 3y ago

This stuff was apparent 20 years ago when PIs gave talks at hacker cons telling them all the legal ways you could get any information you ever wanted. If you Google around there are 500 online services (public companies, not hackers) to dig up private info for a small fee. I guess somebody just finally made a bot to make it easier. Articles like this read to a hacker like an article that door locks aren't secure.

cj 3y ago
I mean even whitepages.com surfaces and aggregates quite a bit of public data if you buy their $20 background check, and all you need is the person's phone number.
dfxm12 3y ago
On a tangential note, slightly less than 20 years ago I got a phone call from an ex of a girl I was seeing at the time telling me to back off. All he had to go on was my name and what college I went to. I asked him how he got my number, he said he used a service like you're describing. This has never been particularly hard for someone who was determined.
ghaff 3y ago
A lot of the deep web stuff has gone behind $20 or so paywalls so I haven't looked in a while. But, yeah, even 20 years ago it was obvious that by knowing very little about a person, especially if their name wasn't very common, you could find a huge amount of information about them.

rig666 3y ago

>$15 per search What chumps, just use https://freepeoplesearch.com https://freepeoplesearch.com Ya it has ads but out of all the hundreds of "free" sites it has actually the most amount of free information.

JohnMakin 3y ago
credit data is quite a bit more detailed than that.
rootusrootus 3y ago
Egads what an awful user experience. Slow, lots of ads, dumb questions. Just use http://truepeoplesearch.com http://truepeoplesearch.com if you want to stalk someone. More information, no built-in delays to make you think they're doing something hard, etc.
- probably_wrong 3y ago
  Speaking of awful user experience... > Sorry, you have been blocked > You are unable to access truepeoplesearch.com > Why have I been blocked? > This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

deleted 3y ago

[deleted]

tptacek 3y ago

Drivers license ID numbers in many states are almost public: they're deterministically generated from basic personal information. You therefore can't use a drivers license ID number as a secure identifier anyways.

hanniabu 3y ago
They also provide social security numbers. What really sucks is you can't practice good hygiene and preemptively update your SSN periodically. You have to wait until your identity is stolen first.
FireBeyond 3y ago
> they're deterministically generated from basic personal information This used to be true, including in my state (Washington), but as of the last few years, I believe all states upon renewal of licenses now give you a non-deterministic license number.
- tptacek 3y ago
  It's been a minute (I think I renew this year) but my driver license ID is still soundex-encoded.
  - kevinmchugh 3y ago
    My last name is soundex-encoded as the first 4 of my Illinois license, issued 18 months ago, but I don't recognize anything deterministic about the last 8

paul7986 3y ago

[dead]

everdrive 3y ago

Interestingly, you actually never get signed up for these credit services until you get a credit card. So all the things people tell you “build credit” (eg: pay your bills on time, pay your rent, etc.) don’t actually “do” anything. There’s no credit score to attach to them, so they just go off into the ether. I built credit a bit late in life and it was a struggle to get started. At this point, I kind of wish I’d just avoided building credit altogether. I wouldn’t be in any of these systems.

stonogo 3y ago
This isn't the case. You get signed up for these credit services when anyone makes reports about you to them. This can be, for example, your landlord. Paying rent does not indeed affect a credit score, but credit scores are separate products from credit reports. You have a right to your credit report annually, but you have no right to know your FICO (or other such) credit score; they're proprietary products. Basically, these companies will build profiles on anyone whose information gets reported to them, even if those profiles do not include a credit score.
soared 3y ago
Not having credit means you’ll never get a mortgage, auto loan, etc.
- gnicholas 3y ago
  So if you don't anticipate needing a mortgage or car loan, could you get rid of credit cards and perhaps cut down your online footprint? The question is how you would pay for stuff — are debit cards just as bad? Cash is being phased out at some stores so that's not always an option. I guess you could load up my Apple Pay straight from your bank and use that instead of a credit card?
  - toast0 3y ago
    Debit cards are (typically) connected to a checking account, and most banks and credit unions use the credit reporting agency ChexSystems to check for a history of checking account infractions and report infractions there as well. However, accounts in good standing aren't typically reported. So once your account opening falls off the report, assuming you don't kite checks or overdraft, your report will be empty. I think overdrafts likely need to be frequent or left unresolved for a long enough time to get on your report too, but I'm not 100% sure. Some banks will run a credit report from other agencies while opening too, but if you don't ask for or refuse any credit cards offered, you should have an empty report from them, once everything falls off.

tennisflyi 3y ago

What information do they need to supply in the Telegram group? Edit: Name and state.

mindslight 3y ago

> Senator Ron Wyden told 404 Media in a statement that “These companies have demonstrated that they can't control who has access to their data products. The government needs to stop these companies from packaging and selling our personal information, and the senior executives that put profit over national security and Americans' safety should be punished accordingly.” I'm amazed that the quote from a politician is the most even handed substantive part of this article. The rest of the article is essentially scaremongering a misguided narrative around "criminals" gaining access to surveillance databases, when the real problem is the uncontrollable and unaccountable surveillance databases existing in the first place. The US desperately needs a port of the GDPR to give us data subjects the rights to control and prevent dossiers being kept on us.

hairofadog 3y ago

It's definitely worth taking the time to set up a credit freeze with the three big agencies (Experian, TransUnion, Equifax). Initially setting it up is a pain in the butt and is rage-inducing, as you have to provide a bunch of personal data when the whole problem in the first place is that they're careless with your data. However, once you've got it set up, it's very easy to freeze and unfreeze them. Just keep all the URLs, usernames, and passwords in a secure note somewhere, and any time you need to apply for credit, unfreeze them for a day or a week. I used to have all sorts of identity theft problems (people taking out credit in my name) but freezing my credit has solved it. Experian: https://www.experian.com/freeze/center.html https://www.experian.com/freeze/center.html TransUnion: https://www.transunion.com/credit-freeze https://www.transunion.com/credit-freeze Equifax: https://www.equifax.com/personal/credit-report-services/credit-freeze/ https://www.equifax.com/personal/credit-report-services/cred... I truly hate these companies but holding my nose and going through the process was worthwhile and I'd recommend it to anyone.

WirelessGigabit 3y ago
15 character max password at TransUnion... How outdated is their system? And none of the 3 allow MFA via something else than text/email.
scrumlord 3y ago
[dead]
TheFreim 3y ago
I've never taken on any debt in my life, would I still need to do this or an I fine since I've never initialized anything in the first place?
- hairofadog 3y ago
  That's a really good question that I don't know the answer to. I would guess that they have a file on you somehow – Utility bills? Landlords checking your credit? But I'm not confident enough to know what would be the best thing to do in that scenario.

gruez 3y ago

>A short while later, the bot spat out a file containing every address that person had ever lived at in the U.S., all the way back to their college dorm more than a decade earlier. The file included the names and birth years of their relatives. It listed the target’s mobile phone numbers and provider, as well as personal email addresses. Finally, the file contained information from their drivers’ license, including its unique identification number. All of that data cost $15 in Bitcoin. The bot sometimes offers the Social Security number too for $20. Other than SSN, I don't find most of the information listed very concerning. Addresses, phone numbers, emails are semi-public anyways, considering that you hand them out anytime you make a purchase online. I'm not sure what bad stuff you can do with a drivers license id. Date of birth/relatives seems like something that can be sourced from public records (eg. voter roll). I'd prefer it if there weren't a telegram bot that dispenses all this for $15, but it's not exactly super privileged either.

rejectfinite 3y ago

[dead]

brm 3y ago

I can use a couple free searches to dox nearly anyone in America...

standardUser 3y ago

The cat has been out of the bag for a while. We need legal changes to how personal information is used after it has been acquired. It doesn't make sense any longer for it to be so easy to open lines of credit or otherwise apply stolen info.

Joeri 3y ago
Other countries have national ID cards that must be presented to get credit. If there is no universal and secure way to prove you are you then identity can always be stolen. No amount of duct taping the credit system can fix that.
- standardUser 3y ago
  Printing a physical ID for everyone seems like an outdated solution. I'd sooner support biometric hardware on every connected device.
  - Sohcahtoa82 3y ago
    > I'd sooner support biometric hardware on every connected device. Ah yes, biometrics, the password that you can't change and you leave behind everywhere you go and on everything you touch. Cloning a fingerprint is trivial. They're not secure.
    - standardUser 3y ago
      Face and iris are additional options. I'd be shocked if there weren't more than those in production at this point. You know what's really trivial? Buying a fake ID.

hedora 3y ago

That whole industry needs to be banned. Courts should record loan defaults, and make that information available to creditors. Nothing else should be in the report. Lenders already require independent verification of income and (for mortgages) monthly expenses. The rest of the information that’s in your report and that is used to compute your credit score seems to be there to force people to get credit cards and to perpetuate systemic racism.

hsuduebc2 3y ago

What a dystopia. I guess I never appreciated GDPR as it deserve.

nuancebydefault 3y ago

When I read all this, I can't help but thinking that Europe is doing better in this respect. Policies like GDPR help to prevent such large scale personal data collection and hence abuse. Also, things like scores and rankings to get a loan/mortgage are not what I ever experienced. The procedure basically is, you take your last 3 salary slips and shop a few banks. You take the one with the lowest rent. Done. After all, you sign a document that states that the bank might sell your property if you do not pay off (for quite some months) Or do I see it wrong?

deleted 3y ago

[deleted]

happytiger 3y ago

It’s time for a Privacy Bill of Rights, and to eliminate credit systems that operate without explicit permission of the individual.

patrickrafferty 3y ago

Here is another thing I despise about these Credit Bureaus. Ive walked into Commercial Real Estate brokerages where every single broker had a license to a credit bureau - with many of the junior brokers using it daily to look up real estate owners to call their mobile phones. Obviously TLO knows theres no way a huge chunk of the CRE brokerage industry should be in their product on a daily basis if they were actually using a GLBA compliant use case... and they look the other way and find a way to monetize. You really dont need to go digging in some dark corner of the internet to obtain this information... you can walk in through the front door

imadierich 3y ago

[dead]

crossroadsguy 3y ago

I am from India and the credit bureau world here is Kafkaesque. Even to get the attention of a credit bureau you’ve to be their paid customer. A new loan in your name which didn’t even turn up in your dream? They helpfully tell you to contact the org that issued the loan. A card that’s not yours? Nope, not your problem. You can’t even tell them to delete your data altogether even if you’re fine working zero credit history. Even to get your own data that they got without your informed consent you’ve pay! There seem to be no venue! And suddenly one day I realise there’s yet another credit bureau and they have all my data! Amazing! Their infra even feels so sketchy that you kinda know it can be hacked the moment someone tries. As for freezing as some suggest, unfreezing is even worse. Besides it just doesn’t protect in case of data breach in any shape or form. This is one field where I hope government regulates deep and hard into their collective bottom.

__MatrixMan__ 3y ago

Somewhere in the neighborhood zero knowledge proofs and homophobic encryption is a way to evaluate creditworthiness predicates on data that's encrypted and in the open without revealing the underlying details. Let's use math to obsolete FICO and shut down these parasites.

nocsi 3y ago

The more you use your own identity, the more possibilities there are for an attacker to compromise you. So ideally.. don’t use credit. But even criminals need credit too, so they craft synthetic identities and use these as proxies to operate in, without ever using their real identity. The entire system is broken, and at this point you’re better off joining the criminals in using synthetic identities too.

derelicta 3y ago

I've had friends who got swatted very recently, and I wouldnt be surprised if the ones responsible for it went through that sort of services.

oakhaven 3y ago

In Finland, you can get credit data of a person from official source (or service resellers) for ~9 EUR. You need to know their social security number though. It's used by landlords (private and corporate) to vet potential tenants. Not sure if there's a telegram bot for that yet :D

leahgwinn9 3y ago

[dead]