Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 347 posts

Re: It's still easy for anyone to become you at Experian

#151

Post by NoMoreNicksLeft »

marcosdumay wrote: post #34
jdsully wrote: post #26

Earlier quoted context omitted.

Credit reporting agencies have immunity from slander claims unless you can prove malice.

So you've found the problem. If they are immune from the crime, they won't stop practicing it.

My understanding is that in most cases, slander/libel is never a crime anyway.

It's merely a tort (wrong). It never rises to the level of a crime. The few instances/places where slander is a crime in the US (historically or otherwise) are very problematic and subject to abuse.

Perhaps this specific kind of slander should be criminal, but it might be the only kind that should be. Not only would you need to justify that philosophically, but somehow convince legislators to make it that way (at the federal level, I should think).

It'd be a tough journey.

Re: It's still easy for anyone to become you at Experian

#152

Post by heavyset_go »

caminante wrote: post #134
cortesoft wrote: post #57

Earlier quoted context omitted.

These accounts aren’t for the people who pay Experian money. Companies pay Experian money to access information about individuals; the only reason Experian even allows accounts for individuals is because they are mandated by law to allow things like credit freezes and the annual credit report. If they weren’t required, they wouldn’t do it at all. They have zero incentive to improve the experience or the security of i…

> Companies pay Experian money to access information about individuals And your firm pays Experian/Equifax/etc. to GIVE information about you, e.g., automated employment verification.

And your employer feeds their payroll into Experian and its partners so it can then resell that information.

Re: It's still easy for anyone to become you at Experian

#153

Post by everybodyknows »

toomuchtodo wrote: post #19
breadwinner wrote: post #14

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

It is not that expensive. It is a couple pennies per pull (of a credit report/file) for somebody seeking identity proofing to use knowledge based authentication (the usual “where did you live, are these trade lines you?”). It is $1.50-$2.00 per proofing attempt with the government credential using ID.me or stripe identity. The problem is that no one is incentivized to slightly increases costs to reduce fraud because…

ID.me supports hardware 2FA, including Yubikey.

Re: It's still easy for anyone to become you at Experian

#154

Post by 9991 »

kagakuninja wrote: post #16
bee_rider wrote: post #11

Earlier quoted context omitted.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

The banks aren't the only victims. The person has had their credit rating damaged, and may even be on the hook for fraudulent charges made in their name.

> The person has had their credit rating damaged

This is called libel. This person is a victim of a crime the credit reporting agency committed.

Re: It's still easy for anyone to become you at Experian

#155

Post by stackskipton »

FireBeyond wrote: post #71
csharpminor wrote: post #52

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities The problem is that there is a very vocal segment that views such things as "government overreach" through to the literal mark of the devil. And then there are the challenges of issuing them. There are states (the same states, typically, who shut down voting locations in working class areas and defund their DMVs) who will fight tooth and…

Feds could also do it using Passport card and DoD does it with CAC cards so Federal government knows how to do this.

Re: It's still easy for anyone to become you at Experian

#156

Post by itissid »

https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had.

1. All your mortgage, credit inquiries and bank account names

2. All your previous addesses and perevious employers

3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US.

4. Dates of employment per employer, bonus, overtime, RSU comp

Does Experian and Transunion have that too, and can we block that as well?

Re: It's still easy for anyone to become you at Experian

#157

Post by NikolaNovak »

NikolaNovak wrote: post #130
throwaway54_56 wrote: post #45

Earlier quoted context omitted.

I get these every so often and I'm curious what you mean my ignore at your own peril. My approach has been to ignore it and assume they will realize their mistake and reregister.

There's any number of risk scenarios, assign likelihood as you will : * owner of account doesn't pay, service sells the debt to collection agency, and they come after you because it matches your email and profile. * owner of account subscribes to something unsavoury or does something illicit, which is now traceable to you * given email is a big part of the incredibly ridiculous and overly pervasive tracking economy a…

To make it less general and more specific

Over years, I've received peoples private medical bills; been subscribed to dating sites of various degrees of sketchiness; my email has been used to register with government agencies in countries of various degrees of sketchiness too; signed up for gaming, gambling, Crypto, banking, nft, investing, and so on - many things where my comfort level for mistakes and mistaken identity and Confusion and incorrect systems of record, is lower than "some kiddie signed me up for blizzard.net" :-/

Re: It's still easy for anyone to become you at Experian

#158

Post by jandrese »

WarOnPrivacy wrote: post #38
cynicauliflower wrote: post #33

My Experian was hijacked, unfrozen, and used to get a $100k loan from Ford Credit. Took me ages to clean up. Bastards.

> used to get a $100k loan from Ford Credit This sounds like it was used to get a vehicle - which are fairly trackable things. How did the ordeal unfold and conclude?

Most likely the perpetrator immediately sold the vehicle, leaving yet another victim in their wake.

Re: It's still easy for anyone to become you at Experian

#160

Post by fnordpiglet »

itissid wrote: post #156

https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had. 1. All your mortgage, credit inquiries and bank account names 2. All your previous addesses and perevious employers 3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US. 4. Dates of employment per employer, bonus, overtime, RSU comp Does Experian and Transunion h…

Yes, and no. I would note that they are definitely not alone and are much better scrutinized than the other data vendors you’ve never heard of that have much more detailed and person data about you.

The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit. It’s also harder to get jobs and to rent. So while it’s creepy, at the very least you gain some demonstrable advantage and benefit.

The data brokers and vendors however collect without your permission or knowledge, compile much deeper profiles of you as a human being and what you do and enjoy, along with these other details, and sell it for a profit you never get a share of.

Perhaps one day we will have a functioning legislative branch and from it will come a real privacy bill. I’m hopeful it’ll be better informed than the EU ones by taking lessons learned. But I hope for a lot of stuff, like world peace and cures for cancer.

Post reply on HN