Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 347 posts

Re: It's still easy for anyone to become you at Experian

#161

Post by foob »

ISL wrote: post #25
atrettel wrote: post #15

Earlier quoted context omitted.

There is no way to opt out of credit reporting. Lenders report the information to the credit bureaus, typically all three of the big ones, so if you want no information reported, simply close all your credit cards and loans, etc. and place credit freezes on your credit reports. I don't think that "increased competition" will work here. We are not customers of the credit bureaus. We are the product. The customers are…

A statutory fine of $50k per compromised account would get the attention of the credit bureaus. (It might drive them out of business, but it sure would get their attention.)

For reference, Equifax leaked the personal information of 147 million people (myself included). Multiplying that by $50k is over 7 trillion dollars. In actuality, they were ordered to pay up to $700 million in total which works out to about $4-5 per person. I agree with you, but the gap between what you propose and the status quo is staggering.

Re: It's still easy for anyone to become you at Experian

#162

Post by [deleted] »

FireBeyond wrote: post #71
csharpminor wrote: post #52

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities The problem is that there is a very vocal segment that views such things as "government overreach" through to the literal mark of the devil. And then there are the challenges of issuing them. There are states (the same states, typically, who shut down voting locations in working class areas and defund their DMVs) who will fight tooth and…

[deleted]

Re: It's still easy for anyone to become you at Experian

#163

Post by toast0 »

fordholes wrote: post #114
WarOnPrivacy wrote: post #38

Earlier quoted context omitted.

> used to get a $100k loan from Ford Credit This sounds like it was used to get a vehicle - which are fairly trackable things. How did the ordeal unfold and conclude?

Same exact thing happened to me. I only dealt with the various credit agencies and Ford. And I had to make a police report to my local PD despite the crime occurring at a dealership across the country — the officer was very kind, and made clear that they would do literally nothing other than produce the case number I needed for the credit agencies. I wonder if Ford in particular is more susceptible? In any event, I’v…

Yeah, afaik, most Police won't do anything with this. My spouse's id was used to rent an Oakland luxury appartment in 2021, along with opening a credit union account and trying to open an amex. Thankfully amex called to check because there was already an account opened, and we were able to get the credit union account closed before it was usable, but the apartment complex seemed unable to do anything and Oakland PD didn't do anything other than acknowledge the report, they wouldn't return calls from our local PD either. IdentityTheft.gov is also a black hole.

Credit freezes are a joke, because if you have a person's credit report, you have enough information to cancel the freeze, even if you can't temporarily thaw it. Still, maybe it's better than nothing, so might as well. But it's then a pain if you need to interact with the credit system; some of the bureaux have such poor systems that your accounts will regularly not work; anyway, credit issuers don't tend to tell you what bureau they'll pull from until after they pull, so may as well unlock the big 3 before you do anything; and batch all your credit increase requests together.

Re: It's still easy for anyone to become you at Experian

#164

Post by pests »

xienze wrote: post #121
pests wrote: post #22

How does Equifax or TransUnion handle the case where someone else creates the account before you do? You try to sign up correctly, then it emails the fake persons email for permission? How does that make any sense. "Hello scammer, John Doe would like to access his Equifax account. Do you want to give him permission?" I agree the Experian way is not good either, but how is the above handled?

> How does Equifax or TransUnion handle the case where someone else creates the account before you I can speak for Experian. If you already registered the account, and someone else knows your SSN and the answers to the credit bureau security questions, then _they_ get to register your account. You as the person who originally registered will get an email that your email address changed. Supposedly the thinking is tha…

Thank you yes but isn't this the topic of the article we're commenting on?

Re: It's still easy for anyone to become you at Experian

#165

Post by judge2020 »

itissid wrote: post #156

https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had. 1. All your mortgage, credit inquiries and bank account names 2. All your previous addesses and perevious employers 3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US. 4. Dates of employment per employer, bonus, overtime, RSU comp Does Experian and Transunion h…

Salary/compensation is not actually provided via your credit report to companies who perform a hard inquiry. If you look at your annualcreditreport, that's exactly the data the inquirer receives, and it just has your start date and company.

Re: It's still easy for anyone to become you at Experian

#166

Post by baby_souffle »

pdonis wrote: post #141
csharpminor wrote: post #52

I’ve received two data breach notices in the past week, one from my healthcare provider and the other from the bank that holds my mortgage. In both instances they said to lock my credit, and provide free credit monitoring for a year. I find this egregiously insufficient to the point where I think we need more regulation in this space. They should provide lifelong credit monitoring and full insurance on any financial…

> We need DMVs to begin issuing IDs that are physical with digital capabilities, like credit cards. We need the equivalent of Apple/Android Pay for identity online. We need to mandate that banks support digital IDs. And we need strict enforcement for people who misuse a digital ID. And how will all this magically work online? Answer: you'll have to provide whatever digital secret gives you access, just the way you pr…

> Which means your digital secret will be in all the same online places where your SSN is now, vulnerable to the same kind of hacking. How does this fix anything?

Loads of ways to do digital attestation but they all involve some 3rd party being the trusted source of truth. Typically this would be the DMV or other government branch and at this point a few red flags start to go off: dmv isn't known for it's competence and I'm not really thrilled about them getting hit to confirm my identity for pornhub.

This is a REALLY hard problem to solve unless you take a "privacy must be sacrificed for the greater good" mentality.

Re: It's still easy for anyone to become you at Experian

#167

Post by rileymat2 »

fnordpiglet wrote: post #160
itissid wrote: post #156

https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had. 1. All your mortgage, credit inquiries and bank account names 2. All your previous addesses and perevious employers 3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US. 4. Dates of employment per employer, bonus, overtime, RSU comp Does Experian and Transunion h…

Yes, and no. I would note that they are definitely not alone and are much better scrutinized than the other data vendors you’ve never heard of that have much more detailed and person data about you. The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit. It’s also harder to get jobs and to rent. So while it’s creepy, at the very least you gain some demo…

“The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit.”

I think I generally agree that this is a reasonable service, however the main reason you can’t get credit without a credit history is these services exist that can provide credit history to lenders. It is bizarre to think that loans would not exist without these services.

Re: It's still easy for anyone to become you at Experian

#168

Post by namrog84 »

itissid wrote: post #159

FWIW 1. Freeze all your credit with experian, equifax and transunion 2. Opt out of them selling your info: https://consumerprivacy.experian.com/ https://myprivacy.equifax.com/opt-in-opt-out/personal-info https://service.transunion.com/dss/ccpa_optout.page

Did this earlier this year. Its super easy to do. And recently had to temporarily unfreeze everything to open an account. Also very easy.

All free. 1 of them tries to upsell hard but can do all for free. I think a law passed in 2019 ish forcing it to be free.

Re: It's still easy for anyone to become you at Experian

#169

Post by [deleted] »

itissid wrote: post #156

https://news.ycombinator.com/item?id=29834753 I was shocked to learn that last year about the level of detail they had. 1. All your mortgage, credit inquiries and bank account names 2. All your previous addesses and perevious employers 3. Your MONTHLY salary and combined comp per yer going back to 20XX when I came to the US. 4. Dates of employment per employer, bonus, overtime, RSU comp Does Experian and Transunion h…

[deleted]

Re: It's still easy for anyone to become you at Experian

#170

Post by judge2020 »

rileymat2 wrote: post #167
fnordpiglet wrote: post #160

Earlier quoted context omitted.

Yes, and no. I would note that they are definitely not alone and are much better scrutinized than the other data vendors you’ve never heard of that have much more detailed and person data about you. The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit. It’s also harder to get jobs and to rent. So while it’s creepy, at the very least you gain some demo…

“The credit agencies however offer you a real and valuable service. Without credit history it’s impossible to get credit.” I think I generally agree that this is a reasonable service, however the main reason you can’t get credit without a credit history is these services exist that can provide credit history to lenders. It is bizarre to think that loans would not exist without these services.

Loans did exist before credit, but it was almost always loans from friends/family or by providing a large down payment to the bank you wanted a loan from. You needed to be a known and upstanding member of the community to get a loan for anything substantial.

And technically, you can get many loans today without a credit score. For example, there are bank statement mortgage loans, but they have caveats like:

- you will go through manual underwriting and will likely need to show records of payment history on any existing debts, including utilities, insurance, rent, etc

- They will likely need the contact information for each one of your previous debts to verify it manually

- When they run a quote, you will typically be considered at the lowest credit score possible for that program - typically 620 for a conventional loan or 500 for FHA. This means you'll be getting the worst rate possible

- You'll likely need a 20% down payment, depending on if any of the PMI automated underwriting systems even give you a quote with such a low "fake" credit score. The lender might ask for more of a down payment depending on their own risk assessment.

- The lender (or whoever buys your loan) will report your new account to the bureaus, giving you a score.

Post reply on HN