Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 347 posts

Re: It's still easy for anyone to become you at Experian

#11

Post by bee_rider »

civilized wrote: post #8
bee_rider wrote: post #6

Of course, we aren’t the customers for these spying companies. But it is surprising that the total lack of security isn’t a deal-breaker for their actual customers. I mean if you can basically impersonate anybody using this service, what is the point of using it?

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party.

I know it is pedantic but it is important to keep in mind because dumping the need to seek redress on the uninvolved third party is ridiculous, so we shouldn’t use language that plays into that point of view.

Re: It's still easy for anyone to become you at Experian

#12

Post by alistairSH »

bee_rider wrote: post #11
civilized wrote: post #8

Earlier quoted context omitted.

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

100% agree, except the impersonated person is impacted when their credit score eventually gets screwed and they can no longer get loans themselves. So, in that regard, they are also a victim.

Re: It's still easy for anyone to become you at Experian

#13

Post by toomuchtodo »

bee_rider wrote: post #11
civilized wrote: post #8

Earlier quoted context omitted.

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

It’s identity fraud frankly. Hold consumers harmless and put the burden on the industry (if you did not have an high identity assurance you’re on the hook for costs and losses) and this problem evaporates. Also outlaw credit monitoring and identity theft insurance.

Re: It's still easy for anyone to become you at Experian

#14

Post by breadwinner »

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

Re: It's still easy for anyone to become you at Experian

#15

Post by atrettel »

arciini wrote: post #2

Given there are 3 credit bureaus, is there a way to avoid having a credit score at one of the credit bureaus? I think that's a way that we as consumers could try to increase competition in the field. I did some Googling and it didn't seem like there's an easy option.

There is no way to opt out of credit reporting. Lenders report the information to the credit bureaus, typically all three of the big ones, so if you want no information reported, simply close all your credit cards and loans, etc. and place credit freezes on your credit reports.

I don't think that "increased competition" will work here. We are not customers of the credit bureaus. We are the product. The customers are lenders and other people who need your information. From the lenders' perspective, this is all working out fine, largely because the onus for "identity theft" is placed on members of the public as individuals rather than on lenders to accurately verify applicants' identities before extending credit. As many people have pointed out before, "identity theft" is a misnomer designed to pass the buck onto individuals. Ideally, it should be the lenders' responsibility to prevent criminals from misusing your information and to make things right whenever a criminal tries to use your information fraudulently, but right now the onus is placed on individuals.

A better solution would be to have higher standards for identity verification by lenders. That would shift the burden onto lenders to actually verify people's identity before extending credit. Some lenders actually do a pretty good job of verifying people's identities before extending credit in my experience, while others just seem to accept the information given uncritically (as far as I can tell!). High industry-wide standards should help solve this (either voluntarily or mandated by law).

Re: It's still easy for anyone to become you at Experian

#16

Post by kagakuninja »

bee_rider wrote: post #11
civilized wrote: post #8

Earlier quoted context omitted.

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

The banks aren't the only victims. The person has had their credit rating damaged, and may even be on the hook for fraudulent charges made in their name.

Re: It's still easy for anyone to become you at Experian

#18

Post by IggleSniggle »

arciini wrote: post #2

Given there are 3 credit bureaus, is there a way to avoid having a credit score at one of the credit bureaus? I think that's a way that we as consumers could try to increase competition in the field. I did some Googling and it didn't seem like there's an easy option.

The problem is that we are not the consumers. They receive our data from all the companies we do business with. You would have to figure out on a case by case basis all ties relating to the credit bureau. Probably if you never got a credit card and never took out a loan, you would be somewhat protected from their "research."

Re: It's still easy for anyone to become you at Experian

#19

Post by toomuchtodo »

breadwinner wrote: post #14

The fundamental issue here is that maintaining security is expensive, and it is cheaper to just deal with occasional hacks. The only solution is to make hacks extremely expensive to the companies that get hacked — through fines as well as lawsuits by victims of identity theft.

It is not that expensive. It is a couple pennies per pull (of a credit report/file) for somebody seeking identity proofing to use knowledge based authentication (the usual “where did you live, are these trade lines you?”). It is $1.50-$2.00 per proofing attempt with the government credential using ID.me or stripe identity. The problem is that no one is incentivized to slightly increases costs to reduce fraud because the burden falls on consumers instead, and credit reporting agencies don’t want to see their moat and revenue stream cannabalized. Bit of a public good Innovator’s Dilemma.

TLDR A better national digital identity story makes this problem go away.

(responsible for customer IAM including identity proofing at a fintech, doing some lift for Login.gov independently as a citizen activist)

Re: It's still easy for anyone to become you at Experian

#20

Post by rzzzt »

bee_rider wrote: post #11
civilized wrote: post #8

Earlier quoted context omitted.

If identity theft were to get so common that the data became statistically unreliable, we would be long past the point that even Congress would feel compelled to do something about it.

There’s no such thing as identity theft, it is impossible to steal an identity, the person still has their identity. It is impersonation. The victim is the entity that has fallen for the impersonation (likely a bank, etc), the perpetrator is the one who did the impersonation, and the impersonated person is just some uninvolved third party. I know it is pedantic but it is important to keep in mind because dumping the…

A classic Mitchell & Webb sketch: https://youtu.be/-c57WKxeELY
Post reply on HN