38 ms·

How much rampant identity theft has to occur before our government admits that it's broken? Leaving things like credit ratings in the hands of 3 incompetent co

by steven2012 12y ago

How much rampant identity theft has to occur before our government admits that it's broken? Leaving things like credit ratings in the hands of 3 incompetent companies like Experian, Equifax and Transunion that control our livelihood is an affront to common decency. As a victim of identity theft, and as someone who took extreme measure to protect himself from identity theft before it occurred, I can tell everyone without a doubt that the only reason why you're not a victim of identity theft is because of random chance. There is no mechanism to protect yourself, and your information is readily available. The only reason why you haven't gotten your identity stolen is because the thieves simply haven't gotten to you yet. It's infuriating that these companies can get away with what is essential libel and not have anything done to them. I shredded all my mail, I haven't given any real information about me on any web site since 1997, never gave out any information about me willy-nilly including applying for too many credit cards, and I never fall for phishing attacks. And yet somehow I found myself victim of identity theft, and it took 2+ years to clean up, and it's still not over. Since so many web sites use Experian data to verify my identity, I've lost a lot of opportunity to get credit, loans, etc, because Experian has mixed my information with the fraudulent information, so I get answers to those automated question wrong. It's truly infuriating, and the system is completely broken, yet no one in government cares.

sachinag 12y ago
Lawyer up and sue. I'm assuming you're American because you referenced Experian. FCRA gives you two years.
- justin66 12y ago
  Or just camp out outside Experian's hq and try to destroy their headquarters using psionic powers. Concentrate really hard! Equal chances of success as suing them but considerably less expensive.
  - enraged_camel 12y ago
    >>Equal chances of success as suing them but considerably less expensive. Also considerably more likely to get you arrested, possibly with overwhelming force.
    - clem 12y ago
      Stop the unlawful use of police force against mutants!
    - TeMPOraL 12y ago
      > Also considerably more likely to get you arrested, possibly with overwhelming force. Which could possibly cause media attention and Internet outrage, so it still feels like a better option than suing.
  - PhasmaFelis 12y ago
    You're right. We should all just stay quiet and know our place.
  - ensignavenger 12y ago
    I didn't sue Experian, but I did sue a collection agency that was reporting an account that wasn't mine- their lawyer called and agreed to have everything removed. I didn't hire a lawyer myself, I filed Small Claims. While it was a pain, it didn't take long after filing the suit to get the record cleared up. If it happens again, I'm going to file suit much faster.
- teh_klev 12y ago
  Sadly we have to put up with Experian (and Equifax) in the UK as well. The third most popular agency being CallCredit which for me didn't even have a fraction of my credit history thus causing me severe difficulties when I was arranging a simple mobile phone contract! There needs to be better regulation of these outfits with regards to who gets this data and completeness of data.
  - linker3000 12y ago
    It is also very disconcerting that these credit rating companies offer a non-free service to help you improve your credit rating score. That seems pretty damn close to being like a protection racket.
    - teh_klev 12y ago
      And even when you do pay them they still can't get it right. My bank made a huge error after I separated from my ex-wife back in 2004. When we dissolved the joint account they updated all my addresses to her address and then maintained her as a "linked" person despite us having no financial ties or liabilities. It took months to fix the address thing and still ten years later I cannot get them to competently resolve the "being financially linked" data error. Sure this was a data provider that caused the problem and they should be responsible for fixing it. But in the end it became impossible to fix because there is no single department in the bank through which the credit record data is passed. Trying to work with the credit scoring agencies was futile because they just bounce you back to the data provider telling you to tell them to fix their data. It's like living the the world of Terry Gilliam's Brazil.
      - vidarh 12y ago
        It may be like living in Gilliam's Brazil, but we do actually have fairly good protections against this that can usually be used to break out of the bureaucratic nightmare: (this should be obvious, but just to be sure: IANAL) Send them a letter where you give them 1 month to resolve the problem, providing full documentation that you are divorced and point that as such the information is incorrect, and that under the Data Protection Act they are legally obliged to ensure incorrect personal information about you is amended or deleted. If you have past correspondence with them where they acknowledge the information is incorrect, then provide copies. Inform them that if the matter is not resolved, or they have contacted you to agree on how to resolve it, within 30 days, you will file a formal complaint with the Information Commissioner (ico.org.uk). Provide the same notification to the bank (ensure it is addressed to the legal department). The credit scoring agencies has a legal obligation under the Data Protection Act to ensure personal information is correct. This applies to all organizations subject to EU data protection rules (which is pretty much everyone with very limited exceptions). That the data comes from a third party is not an excuse if you have provided documentation that the information is wrong. (it may be reasonable that they refer you there first, but if you have tried to get the bank to fix it, and they've not, then it is not reasonable for them to continue to insist). Ultimately, if even the ICO can not get them to budge, go to a lawyer. Failure to rectify this information is blatant violation of the principles of the Data Protection Act, and you can get a court order to have the information corrected, and in some cases even require that they contact every recipient of the flawed information. In your case this is important. If either one of you goes bankrupt e.g. you risk the other ones credit score being ruined for about a decade. But frankly, in most cases a threat about a complaint to the ICO ought to be enough. If you've written a letter and complained to ICO, and they fail to correct the information, then a court case will be a walk in the park. Also note that in certain circumstances you may be due damages incurred as a result of the incorrect information. See: http://ico.org.uk/for_organisations/data_protection/the_guide/principle_6/correcting_inaccurate_personal_data http://ico.org.uk/for_organisations/data_protection/the_guid... A last consideration: The Data Protection Act also provides you with some means of insisting that certain types of decisions are not taken automatically, or to have automated decisions reconsidered. This provides you a fallback if e.g. you are often refused credit based on automated scoring based on the flawed data. You can notify the bank in advance in writing that you do not consent to automated decision making, and providing documentation of the divorce, or you can demand a manual reconsideration afterwards (and provide the same documentation).
lucb1e 12y ago
Exactly this. Why does the credit card system exist like this? Every time I mention it, people get all worked up about chargebacks and that it's not a big deal and all. Hey, I don't need to check my account whether I need to chargeback anything. If I need to pay people, I pay people, I don't give them the equivalent to a login.
jonnathanson 12y ago
I wish I had more upvotes to give you. Alas, I can give you only one. I was the victim of low-grade identity theft about 10 years ago, all stemming from a credit card number illicitly imprinted by someone at a restaurant. Shit spiraled from there, and it took me years to clean up the fallout. Dealing with the Big Three credit agencies was a process for which the word "Kafkaesque" somehow falls short of descriptive power. I've been caught in bureaucratic snafus at the DMV and the IRS, and in comparison, both of those processes were a walk in the park on a bright, sunny day. Our country is basically a consumerocracy, in which one's credit rating is more or less one's fate. If we're going to bestow that much power upon a three-member oligopoly, then we should demand much greater responsibility of its members.
- driverdan 12y ago
  > I was the victim of low-grade identity theft about 10 years ago, all stemming from a credit card number illicitly imprinted by someone at a restaurant. Shit spiraled from there, and it took me years to clean up the fallout. Can you explain this in more detail? I don't understand how a single stolen credit card can cause you years of problems.
  - jonnathanson 12y ago
    The thief made some small purchases that would have been comical if their consequences hadn't been so ridiculous and far reaching. For instance, he rented a video at Blockbuster (!) that he didn't return. Blockbuster attempted to contact "me" several times about the video, assessing various late fees, but never charging them to my card for some odd reason, until finally it sent a collections agency after me. This entire, petty drama went unbeknownst to me until it wound up on my credit rating. All over a fraudulently derived, $15 late fee at a freaking video rental place. Getting this incident wiped from my credit history took an elaborate and drawn-out series of phone calls, letters, forms, interviews, etc. Even then, a decent amount of damage had been done, and various reports had spawned other reports, and I was borked in countless derivative reports and company databases. I had to do some "rebuilding" (in the parlance of the credit companies) for a few years. And this was just one of several, roughly similar purchases that accrued in the system under my name. The irony is that a bolder thief, making bigger purchases and maxing out the card, would have caused less damage to me by catching everyone's attention in flagrante delicto.
dickinurass 12y ago
I'm in the same boat, I didn't figure out my identity was stolen until I was asked what color some car I owned was ( I'm a public transit owner in a large city) when doing a security screen the entire credit rating system is fucked
busterc 12y ago
[1]Identity theft is the number 1 complaint 14 years running according to FTC. To answer your first question: MOAR. Stories like yours make recovery policies, like [2]this, seem prudent. [3]My very first post on hacker news, 3.5 years ago, stirred ZERO discussion. "Identity theft is an enormous problem, so what are the solutions? Who's working on something that practically everybody who uses the internet should consider looking into?" [1]http://www.nbcnews.com/business/consumer/id-theft-tops-ftcs-consumer-complaint-list-n40356 http://www.nbcnews.com/business/consumer/id-theft-tops-ftcs-... [2]http://www.zanderins.com/idtheft/idtheft.aspx http://www.zanderins.com/idtheft/idtheft.aspx [3]https://news.ycombinator.com/item?id=2163006 https://news.ycombinator.com/item?id=2163006
- agirlduh 12y ago
  Identity Theft Shield through Kroll Advisory Solutions is the best program on the market. Nothing can prevent it but they are the best at putting the pieces back together after the breach has occurred.Take a look at http://www.legalshield.com/idt/amysosa http://www.legalshield.com/idt/amysosa Let me know what you think.
ataggart 12y ago
Perhaps a first step would be to stop referring to it as "identity theft". That phrase places you as the victim, thus implicitly any injury is yours to bear. The proper victims of the fraudsters are the businesses falling for it, thus those firms should be the ones on the losing end (instead of you). Perhaps if they had to bear the costs of fraud, those firms would care more about shoddy identity practices.
- PeterisP 12y ago
  Coincidentally, outside the US of A, where the fraud liability indeed lies with the defrauded business, "identity theft" is a much smaller problem, and isn't called as such.
  - dredmorbius 12y ago
    Pushing the liability to the bank rather than merchant would also be a huge step forward. Just so long as there's not a bailout back-door on that.

sachinag 12y ago

Lawyer up and sue. I'm assuming you're American because you referenced Experian. FCRA gives you two years.

justin66 12y ago
Or just camp out outside Experian's hq and try to destroy their headquarters using psionic powers. Concentrate really hard! Equal chances of success as suing them but considerably less expensive.
- enraged_camel 12y ago
  >>Equal chances of success as suing them but considerably less expensive. Also considerably more likely to get you arrested, possibly with overwhelming force.
  - clem 12y ago
    Stop the unlawful use of police force against mutants!
  - TeMPOraL 12y ago
    > Also considerably more likely to get you arrested, possibly with overwhelming force. Which could possibly cause media attention and Internet outrage, so it still feels like a better option than suing.
- PhasmaFelis 12y ago
  You're right. We should all just stay quiet and know our place.
- ensignavenger 12y ago
  I didn't sue Experian, but I did sue a collection agency that was reporting an account that wasn't mine- their lawyer called and agreed to have everything removed. I didn't hire a lawyer myself, I filed Small Claims. While it was a pain, it didn't take long after filing the suit to get the record cleared up. If it happens again, I'm going to file suit much faster.
teh_klev 12y ago
Sadly we have to put up with Experian (and Equifax) in the UK as well. The third most popular agency being CallCredit which for me didn't even have a fraction of my credit history thus causing me severe difficulties when I was arranging a simple mobile phone contract! There needs to be better regulation of these outfits with regards to who gets this data and completeness of data.
- linker3000 12y ago
  It is also very disconcerting that these credit rating companies offer a non-free service to help you improve your credit rating score. That seems pretty damn close to being like a protection racket.
  - teh_klev 12y ago
    And even when you do pay them they still can't get it right. My bank made a huge error after I separated from my ex-wife back in 2004. When we dissolved the joint account they updated all my addresses to her address and then maintained her as a "linked" person despite us having no financial ties or liabilities. It took months to fix the address thing and still ten years later I cannot get them to competently resolve the "being financially linked" data error. Sure this was a data provider that caused the problem and they should be responsible for fixing it. But in the end it became impossible to fix because there is no single department in the bank through which the credit record data is passed. Trying to work with the credit scoring agencies was futile because they just bounce you back to the data provider telling you to tell them to fix their data. It's like living the the world of Terry Gilliam's Brazil.
    - vidarh 12y ago
      It may be like living in Gilliam's Brazil, but we do actually have fairly good protections against this that can usually be used to break out of the bureaucratic nightmare: (this should be obvious, but just to be sure: IANAL) Send them a letter where you give them 1 month to resolve the problem, providing full documentation that you are divorced and point that as such the information is incorrect, and that under the Data Protection Act they are legally obliged to ensure incorrect personal information about you is amended or deleted. If you have past correspondence with them where they acknowledge the information is incorrect, then provide copies. Inform them that if the matter is not resolved, or they have contacted you to agree on how to resolve it, within 30 days, you will file a formal complaint with the Information Commissioner (ico.org.uk). Provide the same notification to the bank (ensure it is addressed to the legal department). The credit scoring agencies has a legal obligation under the Data Protection Act to ensure personal information is correct. This applies to all organizations subject to EU data protection rules (which is pretty much everyone with very limited exceptions). That the data comes from a third party is not an excuse if you have provided documentation that the information is wrong. (it may be reasonable that they refer you there first, but if you have tried to get the bank to fix it, and they've not, then it is not reasonable for them to continue to insist). Ultimately, if even the ICO can not get them to budge, go to a lawyer. Failure to rectify this information is blatant violation of the principles of the Data Protection Act, and you can get a court order to have the information corrected, and in some cases even require that they contact every recipient of the flawed information. In your case this is important. If either one of you goes bankrupt e.g. you risk the other ones credit score being ruined for about a decade. But frankly, in most cases a threat about a complaint to the ICO ought to be enough. If you've written a letter and complained to ICO, and they fail to correct the information, then a court case will be a walk in the park. Also note that in certain circumstances you may be due damages incurred as a result of the incorrect information. See: http://ico.org.uk/for_organisations/data_protection/the_guide/principle_6/correcting_inaccurate_personal_data http://ico.org.uk/for_organisations/data_protection/the_guid... A last consideration: The Data Protection Act also provides you with some means of insisting that certain types of decisions are not taken automatically, or to have automated decisions reconsidered. This provides you a fallback if e.g. you are often refused credit based on automated scoring based on the flawed data. You can notify the bank in advance in writing that you do not consent to automated decision making, and providing documentation of the divorce, or you can demand a manual reconsideration afterwards (and provide the same documentation).

lucb1e 12y ago

Exactly this. Why does the credit card system exist like this? Every time I mention it, people get all worked up about chargebacks and that it's not a big deal and all. Hey, I don't need to check my account whether I need to chargeback anything. If I need to pay people, I pay people, I don't give them the equivalent to a login.

jonnathanson 12y ago

I wish I had more upvotes to give you. Alas, I can give you only one. I was the victim of low-grade identity theft about 10 years ago, all stemming from a credit card number illicitly imprinted by someone at a restaurant. Shit spiraled from there, and it took me years to clean up the fallout. Dealing with the Big Three credit agencies was a process for which the word "Kafkaesque" somehow falls short of descriptive power. I've been caught in bureaucratic snafus at the DMV and the IRS, and in comparison, both of those processes were a walk in the park on a bright, sunny day. Our country is basically a consumerocracy, in which one's credit rating is more or less one's fate. If we're going to bestow that much power upon a three-member oligopoly, then we should demand much greater responsibility of its members.

driverdan 12y ago
> I was the victim of low-grade identity theft about 10 years ago, all stemming from a credit card number illicitly imprinted by someone at a restaurant. Shit spiraled from there, and it took me years to clean up the fallout. Can you explain this in more detail? I don't understand how a single stolen credit card can cause you years of problems.
- jonnathanson 12y ago
  The thief made some small purchases that would have been comical if their consequences hadn't been so ridiculous and far reaching. For instance, he rented a video at Blockbuster (!) that he didn't return. Blockbuster attempted to contact "me" several times about the video, assessing various late fees, but never charging them to my card for some odd reason, until finally it sent a collections agency after me. This entire, petty drama went unbeknownst to me until it wound up on my credit rating. All over a fraudulently derived, $15 late fee at a freaking video rental place. Getting this incident wiped from my credit history took an elaborate and drawn-out series of phone calls, letters, forms, interviews, etc. Even then, a decent amount of damage had been done, and various reports had spawned other reports, and I was borked in countless derivative reports and company databases. I had to do some "rebuilding" (in the parlance of the credit companies) for a few years. And this was just one of several, roughly similar purchases that accrued in the system under my name. The irony is that a bolder thief, making bigger purchases and maxing out the card, would have caused less damage to me by catching everyone's attention in flagrante delicto.

dickinurass 12y ago

I'm in the same boat, I didn't figure out my identity was stolen until I was asked what color some car I owned was ( I'm a public transit owner in a large city) when doing a security screen the entire credit rating system is fucked

busterc 12y ago

[1]Identity theft is the number 1 complaint 14 years running according to FTC. To answer your first question: MOAR. Stories like yours make recovery policies, like [2]this, seem prudent. [3]My very first post on hacker news, 3.5 years ago, stirred ZERO discussion. "Identity theft is an enormous problem, so what are the solutions? Who's working on something that practically everybody who uses the internet should consider looking into?" [1]http://www.nbcnews.com/business/consumer/id-theft-tops-ftcs-consumer-complaint-list-n40356 http://www.nbcnews.com/business/consumer/id-theft-tops-ftcs-... [2]http://www.zanderins.com/idtheft/idtheft.aspx http://www.zanderins.com/idtheft/idtheft.aspx [3]https://news.ycombinator.com/item?id=2163006 https://news.ycombinator.com/item?id=2163006

agirlduh 12y ago
Identity Theft Shield through Kroll Advisory Solutions is the best program on the market. Nothing can prevent it but they are the best at putting the pieces back together after the breach has occurred.Take a look at http://www.legalshield.com/idt/amysosa http://www.legalshield.com/idt/amysosa Let me know what you think.

ataggart 12y ago

Perhaps a first step would be to stop referring to it as "identity theft". That phrase places you as the victim, thus implicitly any injury is yours to bear. The proper victims of the fraudsters are the businesses falling for it, thus those firms should be the ones on the losing end (instead of you). Perhaps if they had to bear the costs of fraud, those firms would care more about shoddy identity practices.

PeterisP 12y ago
Coincidentally, outside the US of A, where the fraud liability indeed lies with the defrauded business, "identity theft" is a much smaller problem, and isn't called as such.
- dredmorbius 12y ago
  Pushing the liability to the bank rather than merchant would also be a huge step forward. Just so long as there's not a bailout back-door on that.