Live data from Hacker News

Interview with the Guy Who Tried to Frame Me for Heroin Possession

krebsonsecurity.com

31–40 of 95 posts

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#31
post #5

I'm not sure it's possible to "give" inaccurate information to Equifax.

I work at one of the big 3 credit bureaus so thought I’d chime in - It is entirely possible to report inaccurate information to the bureaus. Although more often than not it’s on accident, not malicious. Additionally bureaus collect a lot of information from other sources. Some public some private. It’s possible for these datasets to be error prone themselves. There are however official procedures for disputing/correc…

> There are however official procedures for disputing/correcting errors in reporting and in my experience they do a pretty good job of validating everything (as that’s literally the business they’re in)

Anecdotally, I can't agree with this.

I'm six months in to trying to convince Equifax that I exist. Apparently they accidentally registered me as dead in their system, which has caused background checks on me, like when I registered my ABN, to fail. Turns out there are a number of government systems that have been outsourced to them.

They have twice manually intervened, and twice their automated processes have "corrected" their information and relisted me as deceased. And getting a manual intervention is a lot of complaints, and a lot of escalations.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#32
post #29
post #23

Earlier quoted context omitted.

I'll do no such thing. Someone else made a mistake and therefore I have to pay a lawyer to fix it? It's not a legitimate debt, but it goes to show how anyone can put anything in anyone's file and these information brokers will suck it up and pass it around without even the most basic sanity checks. The FCRA was a good start but an American GDPR would be better.

You have avenues open to you. Is it fair? No, but since when is life always fair? Don't cut off your nose to spite your face.

opting out of the entire credit system isn't really cutting off your nose. it is quite nice.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#33
post #16

Earlier quoted context omitted.

I work at one of the big 3 credit bureaus so thought I’d chime in - It is entirely possible to report inaccurate information to the bureaus. Although more often than not it’s on accident, not malicious. Additionally bureaus collect a lot of information from other sources. Some public some private. It’s possible for these datasets to be error prone themselves. There are however official procedures for disputing/correc…

Our son (10 yo) had a delinquent medical bill for reasons we don't understand. The creditor can't tell us who sent the bill because we aren't the named party and I'll be damned if I put him on the phone with them, because he is a minor. So, we're at an impasse and no one can tell us anything. Someone managed to get his name and address and did not realize he was a minor. Brilliant system you have!

https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r... is a comprehensive guide to dealing with debts that you don't owe.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#34
post #16

Earlier quoted context omitted.

I work at one of the big 3 credit bureaus so thought I’d chime in - It is entirely possible to report inaccurate information to the bureaus. Although more often than not it’s on accident, not malicious. Additionally bureaus collect a lot of information from other sources. Some public some private. It’s possible for these datasets to be error prone themselves. There are however official procedures for disputing/correc…

Our son (10 yo) had a delinquent medical bill for reasons we don't understand. The creditor can't tell us who sent the bill because we aren't the named party and I'll be damned if I put him on the phone with them, because he is a minor. So, we're at an impasse and no one can tell us anything. Someone managed to get his name and address and did not realize he was a minor. Brilliant system you have!

yardie says> So, we're at an impasse and no one can tell us anything.*

This is not true. And the system works fine. But you'll have to do some work (write a few letters and maybe a bit more). Here's how:

0. Open a chronological paper file. Copies of all correspondence with dates clearly marked/stamped will go into this file. Put the file into a file cabinet: put a copy of every letter, note or form, including the creditors' initial complaint, into it in time order. Also put notes about any phone conversations into it. Put dates on everything.

1. Talk to your local police department and, with your son, file a report with them if possible. They'll view it as a waste of time but it helps by putting you on "the right side of the law." Do it just to have a police report on file locally.

2. Have your son write a letter to the creditor (not the credit bureau) explaining that your son is a minor, the debt is not his, he did not purchase the item and asking them to remove the invalid entry from his credit report. Add a page with your adult names and signatures explaining that he is your legal son. Send those two letters along with a copy of the chronological file to the the creditor, all via registered mail if you're paranoid.

3. Wait. They _will_ respond. Usually they'll cave at this point. Sometimes they'll call and ask that a police report be filed in _their_ jurisdiction (usually by phone) or some such. Do what they ask within reason. Make sure they (creditor, police) send you copies of everything. Follow up if they don't.

4. Wait. _They_ (the creditors, NOT you) should, after brief investigation, notify the credit bureau to remove the item from your son's credit report. If they don't do so within a few months, send follow-up second and third letters if necessary, reminding them.

5. If you get no response from the creditor after two months, copy the chronological file and send it via registered mail to the credit bureau adding a cover letter explaining that you have exhausted the legal means of redress with the creditors and they have refused to respond appropriately. Ask the credit bureau to investigate the creditor's item on your son's credit report.

This sounds like a lot of trouble but it really isn't and it would be a great lesson for you son, since it shows how most of the world works.

Correction involves loosely-coupled organizations and persons. Nothing in this happens at Internet speed. Each contact must have the situation explained from the beginning. It teaches a person how to order events in time, how to narrate a story consistently and how to be patient.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#35
post #16

Earlier quoted context omitted.

Our son (10 yo) had a delinquent medical bill for reasons we don't understand. The creditor can't tell us who sent the bill because we aren't the named party and I'll be damned if I put him on the phone with them, because he is a minor. So, we're at an impasse and no one can tell us anything. Someone managed to get his name and address and did not realize he was a minor. Brilliant system you have!

yardie says> So, we're at an impasse and no one can tell us anything.* This is not true. And the system works fine. But you'll have to do some work (write a few letters and maybe a bit more). Here's how: 0. Open a chronological paper file. Copies of all correspondence with dates clearly marked/stamped will go into this file. Put the file into a file cabinet: put a copy of every letter, note or form, including the cre…

It's obscene that this burden falls on these folks because someone else falsely used this kid's name. The police report should be filed against the collection agency and the credit bureau, for fraud.[0] We may not have debtor's prisons anymore, but we certainly have guilty-by-default for finance.

> it shows how most of the world works.

It certainly does, but not in the way you meant. :/

[0]I'm aware this is not legally possible; I mean "should" in a moral sense.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#36
post #2

I wonder how much of his personal information was gleaned from "respectable" American companies like Lexis-Nexis, Equifax, and Transperian? I'm sure they gave everything and medical history for the price of a few coins. I have no respect for companies that don't respect my privacy. And I make it a habit of giving them as much useless, inaccurate information as possible.

> And I make it a habit of giving them as much useless, inaccurate information as possible.

How do you do this? (Specifically, with the companies you mentioned.)

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#37
post #27
post #23

Earlier quoted context omitted.

I'll do no such thing. Someone else made a mistake and therefore I have to pay a lawyer to fix it? It's not a legitimate debt, but it goes to show how anyone can put anything in anyone's file and these information brokers will suck it up and pass it around without even the most basic sanity checks. The FCRA was a good start but an American GDPR would be better.

You shouldn't need a lawyer, but it may require a couple hours of time (but not all at once). The next time they call, tell them that the person they are looking for is a minor and you are their guardian and because of that you are required to speak on their behalf. Immediately inform them that all further communication must be done in writing and that you are requesting that they validate the debt in writing. They a…

+1 to this -- and I'll add that you can find decent sample legally-phrased "f••• off, idiots" letters on the web (they should cite a specific U.S. law that establishes the two requirements mentioned: communication in writing, and verification of the debt on demand -- I can't recall the law's citation number off the top of my head).

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#38
post #26

Damn. It does seem that stupid mistakes took him down. Revealing too much about himself on his forum. I mean, if he'd been careful, compromise of that forum would have revealed nothing about him. And for Dog's sake, using the same password on low- and high-security accounts! Of course, the real story could be hidden through parallel construction. But on it's face, this does support the argument that it's stupid mista…

>Damn. It does seem that stupid mistakes took him down.

One possibility on the "cautionary lessons for the rest of us" front is a classic bit of wisdom about asymmetric adversarial situations: the other party only needs to get lucky once. There is a fundamental challenge of scale and time for any entity or individual that tries to run something dealing with persistent antagonists over long time periods, it just plain becomes hard to keep track of it all without further infrastructure systems in place. And its also hard for any single human to stay in the zone persistently, we're not really wired that way, hence the need for non-human support structures.

And that in turn is the same challenge for any business dealing with significant organic growth, criminal or not, it's the classic "that TOTALLY TEMPORARY one-off excel spreadsheet someone made 15 years ago now runs hundreds of millions of dollars" issue. It's hard to know ahead what will be important and sticky or not, even if experience helps. And it's hard to decide how to allocate limited resources too. Infrastructure you build helps you scale properly in the future, but it doesn't do anything for you right now, you might not even know you could need it. And overbuilding upfront might mean there is no tomorrow to worry about anyway.

It's a tough nut, though fortunately it's one area that is probably worse on the black side of things since there is less room for recovery from mistakes. Maybe it's one of the structural forces that can help encourage law abiding behavior, legit companies can mess up badly but still potentially recover if there is enough meat to them, whereas a total opsec break for criminals can mean the end of the enterprise.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#39
post #29

Earlier quoted context omitted.

You have avenues open to you. Is it fair? No, but since when is life always fair? Don't cut off your nose to spite your face.

opting out of the entire credit system isn't really cutting off your nose. it is quite nice.

I don't believe that to be true but, in this case, it's a parent opting their ten year old out of it. The point is that this can be resolved to their benefit. Instead, they would rather scream about it being unfair. No one cares; the only people who get hurt will be them.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#40
post #2

I wonder how much of his personal information was gleaned from "respectable" American companies like Lexis-Nexis, Equifax, and Transperian? I'm sure they gave everything and medical history for the price of a few coins. I have no respect for companies that don't respect my privacy. And I make it a habit of giving them as much useless, inaccurate information as possible.

Well, they were specifically posting a branded Accurint report for Krebs in the lampeduza (IIRC) thread.
Post reply on HN