Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three Years in Identity Theft Hell

bloomberg.com

Post reply on HN
Print view View original

81–90 of 195 posts

Re: Three Years in Identity Theft Hell

#81

Post by r00fus »

ljoshua wrote: post #64
Exuma wrote: post #61

So how does one protect against this if freezing is useless because all that information was leaked anyway?

Freezing doesn't protect the information, but it does protect your credit account from being added to. Once frozen, you are almost in a 2FA scenario where creditors are required to request any new accounts or credit hits, and the credit agency is required to then obtain your approval using the private information only you (should) know.

That the credit agencies are allowed to charge you $10 (each - that's 3 + 1 smaller one) both for freezing and unfreezing your credit make me wonder if this leak was had an ahem unintended side effect of increasing revenues due to this activity.

143M accounts - lets just say 2% are rich/active enough to consider freezes. That's almost $3M over the course of say a week - for each such agency.

Re: Three Years in Identity Theft Hell

#82

Post by nvahalik »

I had my "identity" stolen by someone who tried to open accounts at local banks after somehow managing to swipe a copy of my drivers license (from our mail box, as far as we know) and seemingly only was able to rent a Uhaul in my name (unbeknownst to me until I tried to rent one to move).

The banks kicked him back and he tried forging checks from others (not me).

I filed the reports with the police. And checked my credit. Nothing serious happened as he seems to have been pretty much thwarted by most places he went.

But then he got caught when he was pulled over for having a brake light out.

All in all I suffered no real harm from this guy. Seems like for the most part the system works...

Re: Three Years in Identity Theft Hell

#83

Post by aianus »

user5994461 wrote: post #7
sillysaurus3 wrote: post #5

Earlier quoted context omitted.

Fixed, thanks. What do you feel are some sensible systems used by the rest of the world? One that's hopefully hard enough to break but easy enough not to cause massive hassles.

To confirm your identify: national ID card, passport or driver license. To confirm your income: Your yearly income tax sheet, a payslip or your contract of employment. There is really no reason whatsoever for credit check and background check agencies to exist. All they do is ask for these papers anyway.

Credit has little to do with income. I have over $70k in various credit lines and have never shown any proof of income whatsoever. I just name a number and they accept it (after checking my all-important credit score).

Re: Three Years in Identity Theft Hell

#84

Post by throwaway613834 »

interlocutor wrote: post #53
throwaway613834 wrote: post #44

Earlier quoted context omitted.

> And, if you happen to forget it, they will unlock it if you can cough up the very information supposedly compromised in the equifax leak anyway. Wait, what? Any more reading on this?

Here's the link to "obtain your forgotten or misplaced PIN". https://www.experian.com/ncaconline/freezepin And it says, "provide your e-mail address for faster delivery of your results."

Wow. This whole thing looks like a massive joke. Thanks for the link!

Re: Three Years in Identity Theft Hell

#85

Post by sillysaurus3 »

patio11 wrote: post #74
ljoshua wrote: post #64

Earlier quoted context omitted.

Freezing doesn't protect the information, but it does protect your credit account from being added to. Once frozen, you are almost in a 2FA scenario where creditors are required to request any new accounts or credit hits, and the credit agency is required to then obtain your approval using the private information only you (should) know.

Freezing doesn't protect the information, but it does protect your credit account from being added to. Going to take the liberty of adding to this because the imprecision might cause some people to develop a poor model of how financial institutions work: you don't have a "credit account." You have a few firms which have partial views of your "credit history", sourced by reports from some firms you've previously done…

I'm curious: say you freeze your credit and then take an action that should negatively affect your credit, e.g. skip out on paying a doctor. What happens? That's nearly identical to what a fraudster might do, except there is no fraudster.

How does the system differentiate between someone showing up and doing something in your name vs you actually showing up and doing something negative?

Re: Three Years in Identity Theft Hell

#86

Post by pwg »

Flammy wrote: post #63
matheweis wrote: post #41

Earlier quoted context omitted.

The pin code they will give you to unlock it is the date/time stamp of when you locked it. And, if you happen to forget it, they will unlock it if you can cough up the very information supposedly compromised in the equifax leak anyway.

FYI the latest Equifax press release (where it was announced 2 executives were being dismissed) had a small bulletpoint towards the end which said that pins would be randomly generated. Don't know if that change is live, however.

It is live. I froze mine last night after learning that equifax was waiving the fees (i.e., free) and the pin they returned was no longer the date/time of the freeze. It 'looked' reasonably random-ish, but looks can be deceiving in regards to randomness (http://dilbert.com/strip/2001-10-25).

Re: Three Years in Identity Theft Hell

#87

Post by rwallace »

> There’s a logic to the maze you have to run to expose fraudulent financial accounts. In an economic system where U.S. consumers carry $12.73 trillion in household debt, you shouldn’t be able to just call up, say “it wasn't me,” and leave thousands of dollars in obligations by the wayside.

Perhaps if it was easier to do that, there would be less of the predatory lending that created such a crippling burden of debt.

Re: Three Years in Identity Theft Hell

#88

Post by pwg »

sillysaurus3 wrote: post #85
patio11 wrote: post #74

Earlier quoted context omitted.

Freezing doesn't protect the information, but it does protect your credit account from being added to. Going to take the liberty of adding to this because the imprecision might cause some people to develop a poor model of how financial institutions work: you don't have a "credit account." You have a few firms which have partial views of your "credit history", sourced by reports from some firms you've previously done…

I'm curious: say you freeze your credit and then take an action that should negatively affect your credit, e.g. skip out on paying a doctor. What happens? That's nearly identical to what a fraudster might do, except there is no fraudster. How does the system differentiate between someone showing up and doing something in your name vs you actually showing up and doing something negative?

It works because nearly every institution that would "extend credit" relies on the reports from these agencies to decide to do so. So when they try to pull a report (for you or a fraudster) they get back "sorry, frozen" and that causes them to actually stop and try to actually verify the true identity of the person requesting the loan. If that is you (the proper owner) then you can 'unfreeze' for the purpose of obtaining the loan. If that is a fraudster, they will likely not have your pin's to do the unfreeze, so the bank/business says "no" to the request for money.

[edit: spelling]

Re: Three Years in Identity Theft Hell

#89

Post by pwg »

r00fus wrote: post #81
ljoshua wrote: post #64

Earlier quoted context omitted.

Freezing doesn't protect the information, but it does protect your credit account from being added to. Once frozen, you are almost in a 2FA scenario where creditors are required to request any new accounts or credit hits, and the credit agency is required to then obtain your approval using the private information only you (should) know.

That the credit agencies are allowed to charge you $10 (each - that's 3 + 1 smaller one) both for freezing and unfreezing your credit make me wonder if this leak was had an ahem unintended side effect of increasing revenues due to this activity. 143M accounts - lets just say 2% are rich/active enough to consider freezes. That's almost $3M over the course of say a week - for each such agency.

Which is why you (if you are a US citizen) should look up your congress critter's contact info and send all three of them a message that given this breach, they need to make freezes/unfreezes 100% free for everyone, for ever.

If enough folks write their congress critters asking for "make freeze/unfreezing free of change to everyone", maybe they will do something useful for once.

Re: Three Years in Identity Theft Hell

#90

Post by sillysaurus3 »

pwg wrote: post #88
sillysaurus3 wrote: post #85

Earlier quoted context omitted.

I'm curious: say you freeze your credit and then take an action that should negatively affect your credit, e.g. skip out on paying a doctor. What happens? That's nearly identical to what a fraudster might do, except there is no fraudster. How does the system differentiate between someone showing up and doing something in your name vs you actually showing up and doing something negative?

It works because nearly every institution that would "extend credit" relies on the reports from these agencies to decide to do so. So when they try to pull a report (for you or a fraudster) they get back "sorry, frozen" and that causes them to actually stop and try to actually verify the true identity of the person requesting the loan. If that is you (the proper owner) then you can 'unfreeze' for the purpose of obtai…

I suppose a doctor's office and the dentist are two of the rare exceptions. I can't think of any others.

(They generally don't ask for payments till the end.)

Post reply on HN