Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 347 posts

Re: It's still easy for anyone to become you at Experian

#121

Post by xienze »

pests wrote: post #22

How does Equifax or TransUnion handle the case where someone else creates the account before you do? You try to sign up correctly, then it emails the fake persons email for permission? How does that make any sense. "Hello scammer, John Doe would like to access his Equifax account. Do you want to give him permission?" I agree the Experian way is not good either, but how is the above handled?

> How does Equifax or TransUnion handle the case where someone else creates the account before you

I can speak for Experian. If you already registered the account, and someone else knows your SSN and the answers to the credit bureau security questions, then _they_ get to register your account. You as the person who originally registered will get an email that your email address changed.

Supposedly the thinking is that they want to make it impossible for someone to truly be locked out of accessing their own Experian account, so they just let you do these stealth registrations as long as you can answer all the security questions. Clearly they need a better solution.

Re: It's still easy for anyone to become you at Experian

#122

Post by tmcz26 »

rescbr wrote: post #116
gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

I've been on a similar situation once, this is what I did, and I think you're on the right path. > I tried contacting every retailer. Try to reach out to the ombudsman (ouvidoria) and explain your case. Even if they don't actually solve the problem, you documented that you tried to friendly resolve the issue. > I am expecting fallout from this. Very worst case scenario, the retailers will send the fraudulent invoices…

If it’s a purchase using Credit Card, absolutely zero chance of going to collections. That’s not how it works. There’s no legal footing for collections and they are not in the habit of creating legal headaches for themselves.

If however it’s a credit purchase (personal loan, crediário, etc) then it might go to collections, then this advice works.

Online purchases though are 80% credit card and 15% Pix/Boleto so it’s unlikely they got a loan just to buy stuff. If they can get a loan, they’ll get the cash itself and run.

Edit: on a Credit Card transaction the burden of evidence is on the merchant. THEY have to prove it was you.

Re: It's still easy for anyone to become you at Experian

#123

Post by supertofu »

esquivalience wrote: post #84
supertofu wrote: post #79

Earlier quoted context omitted.

I frequently get emails intended for someone who has my same email handle, but with the extension "@googlemail.com" instead of "@gmail.com". I know a lot about them. I know their shipping address in the UK. I know that they order inexpensive club attire, online Dominoe's delivery, and have a specific gym membership. I am shocked that Google offers no way to disentangle my email address from this person's. A more mali…

My understanding was that the two domains are equivalent. The following sites seem to confirm my understanding. Are you sure it isn't you? https://support.google.com/mail/thread/125577450/gmail-and-g... https://www.quora.com/What-is-the-difference-between-gmail.c... https://www.gmass.co/blog/domains-gmail-com-googlemail-com-a...

I'm pretty sure I don't have an alter ego who lives in the UK ;) The shipping address and accounts opened by this person are very obviously not mine.

I live in NY.

Re: It's still easy for anyone to become you at Experian

#124

Post by supertofu »

vultour wrote: post #80
supertofu wrote: post #79

Earlier quoted context omitted.

I frequently get emails intended for someone who has my same email handle, but with the extension "@googlemail.com" instead of "@gmail.com". I know a lot about them. I know their shipping address in the UK. I know that they order inexpensive club attire, online Dominoe's delivery, and have a specific gym membership. I am shocked that Google offers no way to disentangle my email address from this person's. A more mali…

Was there a period where you could register those separately? My old google account receives emails for both domains.

There must have been, else I wouldn't be in this situation.

Re: It's still easy for anyone to become you at Experian

#125

Post by schleck8 »

cynicauliflower wrote: post #33

My Experian was hijacked, unfrozen, and used to get a $100k loan from Ford Credit. Took me ages to clean up. Bastards.

Not a lawyer but this just screams legal action. Their systems clearly aren't sufficiently secure to prevent large scale fraud

Re: It's still easy for anyone to become you at Experian

#126

Post by schleck8 »

ycombinatornews wrote: post #109

There’s a petition on resistbot now to get some legislative eyes on this issue https://resist.bot/petitions/PONADR

I'm seeing this for the first time given I'm not from the US, but its reach seems limited https://resist.bot/petitions

In Germany there is Campact for example which usually crosses 200K signatures per petition, if something like this doesn't exist in the US then I think someone with money should create it or promote an existing solution like OpenPetition to enough recurring signers

https://en.wikipedia.org/wiki/Campact

Re: It's still easy for anyone to become you at Experian

#127

Post by NikolaNovak »

barkerja wrote: post #46
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

I've been tempted. But

1. That exposes me to MORE involvement with this service, not less, and potentially legal culpability. Risk may be small but impact is large and benefit is neglible, so math doesn't work out for me.

2. It requires MORE effort on my part. For a poor design and error made by not me.

If it were once every 5 years, maybe.

When it's weekly, it's just an annoyance.

Sometimes when I'm really angry, I just write to their gdpr or compliance officer with a stern better and links to various sections of the law and their obligations. Doesn't accomplish much but makes me feel better :-)

But overall, it's a systemic issue, and given we are on hacker news, I'd say it's OUR systemic issue caused by us :-/

Re: It's still easy for anyone to become you at Experian

#128

Post by rescbr »

tmcz26 wrote: post #122
rescbr wrote: post #116

Earlier quoted context omitted.

I've been on a similar situation once, this is what I did, and I think you're on the right path. > I tried contacting every retailer. Try to reach out to the ombudsman (ouvidoria) and explain your case. Even if they don't actually solve the problem, you documented that you tried to friendly resolve the issue. > I am expecting fallout from this. Very worst case scenario, the retailers will send the fraudulent invoices…

If it’s a purchase using Credit Card, absolutely zero chance of going to collections. That’s not how it works. There’s no legal footing for collections and they are not in the habit of creating legal headaches for themselves. If however it’s a credit purchase (personal loan, crediário, etc) then it might go to collections, then this advice works. Online purchases though are 80% credit card and 15% Pix/Boleto so it’s…

Tell this to MercadoPago. Once I did a chargeback on a fraudulent gift card purchase and months later they sent this debt to collections - they didn't report it to the credit agencies, though. It resolved pretty fast once I escalated the issue to the ombudsman.

There's no legal footing, but they will try.

Re: It's still easy for anyone to become you at Experian

#129

Post by benlivengood »

The best outcome is to have minor fraud (someone tried and failed to open an account in your name, or your name+address appears in a data dump somewhere) occur because then you can register a fraud alert and credit freeze in all the agencies which stops a lot of nonsense (random junk mail, risk of actual fraudulent accounts getting established) for a year or so by enforcing extra authentication steps.

I wish I could put a permanent fraud alert on my credit accounts, but would probably have to hire a lawyer or something.

Re: It's still easy for anyone to become you at Experian

#130

Post by NikolaNovak »

throwaway54_56 wrote: post #45
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I get these every so often and I'm curious what you mean my ignore at your own peril. My approach has been to ignore it and assume they will realize their mistake and reregister.

There's any number of risk scenarios, assign likelihood as you will :

* owner of account doesn't pay, service sells the debt to collection agency, and they come after you because it matches your email and profile.

* owner of account subscribes to something unsavoury or does something illicit, which is now traceable to you

* given email is a big part of the incredibly ridiculous and overly pervasive tracking economy and profiling of the interwebs, your profile will now be even more annoying then before and be associated with things you don't want them to be.

Etc. Or just, to your point, one day they'll realize their mistake and be mad at YOU (because people aren't generally good at taking responsibility :) and now it's a thing.

I should mention I have a dozen email accounts of various degrees of protectiveness. Thia happens, annoyingly, to my most private address that I have never ever once used for business or signed up for anything, only for friends and family. So among everything else I'm peeved that my pristine email and identity is being polutted by other crap.

And again... The reason this frustrates me, is this should.not.be.and.issue in any sane world. If you're sending verification email it should have a No option. Anything else is grossly neglible or evil or both.

Post reply on HN