Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

131–140 of 347 posts

Re: It's still easy for anyone to become you at Experian

#131

My Experian was hijacked, unfrozen, and used to get a $100k loan from Ford Credit. Took me ages to clean up. Bastards.

The worst part of such an experience is that once you've reported a case of fraud on your credit report, if you at a later date want to open a new bank/credit/whatever account somewhere then you have to jump through ridiculous hoops, or will simply be denied outright because they won't believe that you're who you are since your PII was flagged in the past.

Re: It's still easy for anyone to become you at Experian

#133
post #67

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

[flagged]

Well I am from the fraud remuneration department of Brazil and know the person who pays out compensation for these crimes. Simply send me all your personal information and credit card details and I’ll make sure you get your appropriate payout.

Re: It's still easy for anyone to become you at Experian

#134

Of course, we aren’t the customers for these spying companies. But it is surprising that the total lack of security isn’t a deal-breaker for their actual customers. I mean if you can basically impersonate anybody using this service, what is the point of using it?

These accounts aren’t for the people who pay Experian money. Companies pay Experian money to access information about individuals; the only reason Experian even allows accounts for individuals is because they are mandated by law to allow things like credit freezes and the annual credit report. If they weren’t required, they wouldn’t do it at all. They have zero incentive to improve the experience or the security of i…

> Companies pay Experian money to access information about individuals

And your firm pays Experian/Equifax/etc. to GIVE information about you, e.g., automated employment verification.

Re: It's still easy for anyone to become you at Experian

#136

The best outcome is to have minor fraud (someone tried and failed to open an account in your name, or your name+address appears in a data dump somewhere) occur because then you can register a fraud alert and credit freeze in all the agencies which stops a lot of nonsense (random junk mail, risk of actual fraudulent accounts getting established) for a year or so by enforcing extra authentication steps. I wish I could…

Correct me if I’m wrong, but I’ve signed up for all 3 bureaus and enabled the credit freeze. My understanding, and experience years later, is that it is still frozen. I had to unfreeze a specific one last year for an auto loan.

Is there something else I’m missing that’s only temporary?

Re: It's still easy for anyone to become you at Experian

#137

Earlier quoted context omitted.

These accounts aren’t for the people who pay Experian money. Companies pay Experian money to access information about individuals; the only reason Experian even allows accounts for individuals is because they are mandated by law to allow things like credit freezes and the annual credit report. If they weren’t required, they wouldn’t do it at all. They have zero incentive to improve the experience or the security of i…

> Companies pay Experian money to access information about individuals And your firm pays Experian/Equifax/etc. to GIVE information about you, e.g., automated employment verification.

And Experian pays your company for the data through programs like The Work Number

Re: It's still easy for anyone to become you at Experian

#138

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities The problem is that there is a very vocal segment that views such things as "government overreach" through to the literal mark of the devil. And then there are the challenges of issuing them. There are states (the same states, typically, who shut down voting locations in working class areas and defund their DMVs) who will fight tooth and…

You've put forth an utter straw man. I am rationally against making government verification of identity stronger precisely because the existing identity systems have been pervasively abused with essentially no recourse. After there is a US equivalent of the GDPR that lets me prevent the surveillance industry, including the traditional financial surveillance industry, from unilaterally creating dossiers about me, then we can talk about better implementations of identity verification. Until then, that dumpster fire is the main thing holding back the surveillance industry from pushing identity verification for ever more routine things like opening online accounts or buying groceries.

Re: It's still easy for anyone to become you at Experian

#139

Earlier quoted context omitted.

But why can't people successfully sue for libel/slander/defamation by individuals when they give false damaging information about the individual to creditors?

Those types of suits generally hinge on proving malicious intent

Malicious intent is the standard for public figures. The vast majority of people in Experian’s database are not public figures.

Re: It's still easy for anyone to become you at Experian

#140

Earlier quoted context omitted.

Mine is first initial, somewhat-uncommon last name at gmail.com. Address acquired during the public beta back in 2004. I regularly get reminders for dental visits in Oklahoma, purchase orders for machinery in Germany, and course registrations for some person who works in my industry and was easily searchable online. It is not so intrusive to be problematic, and is mildly interesting.

I’ve made a few online “acquaintances” over the years as I’ve figured out the real email addresses for the people for whom I receive email at iCloud. We check in each time I forward something to them.

It can be fun to figure out how to contact your “acquaintances” the first time this happens. You can't really email them, can you?

I had it when someone (or likely his partner) with the same (somewhat uncommon!) firstname.lastname@gmail.com used my email. I started digging and it turned out we both were/are PhD students, just totally different fields. Must have something to do with the name. I was happy that via the faculty site I found his "real" email. Nearly send him a really weird post card, I had only his postal address...

Post reply on HN