Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 347 posts

Re: It's still easy for anyone to become you at Experian

#21

Post by bee_rider »

alistairSH wrote: post #12
bee_rider wrote: post #11

Earlier quoted context omitted.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

100% agree, except the impersonated person is impacted when their credit score eventually gets screwed and they can no longer get loans themselves. So, in that regard, they are also a victim.

Although I think it is more accurate to call them a victim of something like slander by the credit agency, in that case. I mean, I’m not sure exactly what the laws are around slander, I wouldn’t be surprised if there was some cutout for cases in which the person actually believed the lies they were repeating, but if an organization represents itself as an expert in people’s trustworthiness it obviously has a heightened responsibility to verify what it is repeating.

Re: It's still easy for anyone to become you at Experian

#22

Post by pests »

How does Equifax or TransUnion handle the case where someone else creates the account before you do?

You try to sign up correctly, then it emails the fake persons email for permission? How does that make any sense.

"Hello scammer, John Doe would like to access his Equifax account. Do you want to give him permission?"

I agree the Experian way is not good either, but how is the above handled?

Re: It's still easy for anyone to become you at Experian

#23

Post by xmprt »

breadwinner wrote: post #14

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

> maintaining security is expensive

This might be somewhat true (it's certainly more expensive than not having security) but when your entire business is around making assurances based on people's identities, you'd assume that they'd put more effort into making their services secure. And if it's too expensive to do it securely, then maybe we should start to question whether such a service should even exist and deserves to store a lot of personal and private information.

Re: It's still easy for anyone to become you at Experian

#24

Post by civilized »

bee_rider wrote: post #11
civilized wrote: post #8

Earlier quoted context omitted.

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

I completely agree. But if I recall correctly, they've set up the law so that if they get duped, you're on the hook for whatever they got duped into giving the impersonator. That's the biggest problem.

Re: It's still easy for anyone to become you at Experian

#25

Post by ISL »

atrettel wrote: post #15
arciini wrote: post #2

Given there are 3 credit bureaus, is there a way to avoid having a credit score at one of the credit bureaus? I think that's a way that we as consumers could try to increase competition in the field. I did some Googling and it didn't seem like there's an easy option.

There is no way to opt out of credit reporting. Lenders report the information to the credit bureaus, typically all three of the big ones, so if you want no information reported, simply close all your credit cards and loans, etc. and place credit freezes on your credit reports. I don't think that "increased competition" will work here. We are not customers of the credit bureaus. We are the product. The customers are…

A statutory fine of $50k per compromised account would get the attention of the credit bureaus. (It might drive them out of business, but it sure would get their attention.)

Re: It's still easy for anyone to become you at Experian

#26

Post by jdsully »

bee_rider wrote: post #21
alistairSH wrote: post #12

Earlier quoted context omitted.

100% agree, except the impersonated person is impacted when their credit score eventually gets screwed and they can no longer get loans themselves. So, in that regard, they are also a victim.

Although I think it is more accurate to call them a victim of something like slander by the credit agency, in that case. I mean, I’m not sure exactly what the laws are around slander, I wouldn’t be surprised if there was some cutout for cases in which the person actually believed the lies they were repeating, but if an organization represents itself as an expert in people’s trustworthiness it obviously has a heighten…

Credit reporting agencies have immunity from slander claims unless you can prove malice.

Re: It's still easy for anyone to become you at Experian

#27

Post by Lacerda69 »

pests wrote: post #22

How does Equifax or TransUnion handle the case where someone else creates the account before you do? You try to sign up correctly, then it emails the fake persons email for permission? How does that make any sense. "Hello scammer, John Doe would like to access his Equifax account. Do you want to give him permission?" I agree the Experian way is not good either, but how is the above handled?

Do you need to sign up for any of these services? Sounds horrible all around to me (not from the US)

Re: It's still easy for anyone to become you at Experian

#29

Post by snthd »

breadwinner wrote: post #14

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

>The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

It's notable this issue (verification by SSN) doesn't affect GDPR-land - the GDPR has fines of up to 4% of global turnover.

Post reply on HN