Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myequifax.com Bypasses Credit Freeze Pin

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 206 posts

Re: Myequifax.com Bypasses Credit Freeze Pin

#51

Post by Robelius »

techsupporter wrote: post #30
techsupporter wrote: post #26

Earlier quoted context omitted.

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.-- They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years,…

Oh, and one more thing: This is the same bank that called me the other day to inquire about our application and--even though they called me--their representative got mad when I wouldn't give him the last four digits of both of our Social Security numbers and our dates of birth and Mother's Maiden Name / Security Answers from the application. When I pointed out that a) he called me and b) this is, quite literally, exa…

I had a similar issue with Chase calling me, as a follow up to fraudulent charges on my card. They were asking for basic identifying information, but I didn’t feel comfortable so I hung up.

I then called Chase and asked if it really was them that called, and they confirmed it was actually them. But then they also apoligized and resumed the previous call from where I hung up.

It was just nice to not be judged for being cautious.

Re: Myequifax.com Bypasses Credit Freeze Pin

#52

Post by rlucas »

athenot wrote: post #43
davchana wrote: post #34

Earlier quoted context omitted.

Yes, Indian Banks too check Signatures on anything submitted to them. I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees. Here in US I have seen policies in Stores saying we accept check, but we will onetime use t…

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate.

"Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC across states; standardized Delaware Chancery precedent; etc.

One reason I'm not a cryptocurrency or smart contracts believer is that the robust exception-handling backstop we have in the US is a mostly-invisible but super-valuable resource.

Re: Myequifax.com Bypasses Credit Freeze Pin

#53

Post by shawnz »

human wrote: post #42
shawnz wrote: post #8

Earlier quoted context omitted.

Except it doesn't address the problem at all. What happens when another negligent credit bureau pops up to replace it?

We should really work on making personal data transactions illegal. I can’t think of a single company that I would be happy to hear that they sold my data to third-party. These companies provide no additonal benefits. Equifax is the worst. You can call them and ask to buy lists of names, addresses and phone numbers of people matching certain financial criterias. Facebook would look dull in comparison if people knew t…

> These companies provide no additonal benefits.

They provide safety for lenders, which allows those lenders to offer you cheaper prices. Is that worth it? Not sure personally, but I don't think it's fair to say that they are totally without benefit.

Re: Myequifax.com Bypasses Credit Freeze Pin

#55

Post by acct1771 »

rlucas wrote: post #52
athenot wrote: post #43

Earlier quoted context omitted.

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times. That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount…

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate. "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work. Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC…

....and only all exists because people believe there's no alternative.

Re: Myequifax.com Bypasses Credit Freeze Pin

#56

Post by orky56 »

arcticbull wrote: post #12
hsk0823 wrote: post #9

Earlier quoted context omitted.

No one thinks this is actually secure, it's security theater. The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

For one payroll, I completely forgot to sign a set of checks for 40 employees. Not one employee came back and said their check did not clear. Scary world we live in.

Re: Myequifax.com Bypasses Credit Freeze Pin

#57

Post by komali2 »

Robelius wrote: post #51
techsupporter wrote: post #30

Earlier quoted context omitted.

Oh, and one more thing: This is the same bank that called me the other day to inquire about our application and--even though they called me--their representative got mad when I wouldn't give him the last four digits of both of our Social Security numbers and our dates of birth and Mother's Maiden Name / Security Answers from the application. When I pointed out that a) he called me and b) this is, quite literally, exa…

I had a similar issue with Chase calling me, as a follow up to fraudulent charges on my card. They were asking for basic identifying information, but I didn’t feel comfortable so I hung up. I then called Chase and asked if it really was them that called, and they confirmed it was actually them. But then they also apoligized and resumed the previous call from where I hung up. It was just nice to not be judged for bein…

That's pretty atypical for Chase - whenever I get a call from them, it's always something like "Please call the number on the back of your credit card to solve this issue."

Re: Myequifax.com Bypasses Credit Freeze Pin

#58

Post by koboll »

shawnz wrote: post #8
mumphster wrote: post #7

Earlier quoted context omitted.

Ok and...? Seems like a valid line of conversation to me.

Except it doesn't address the problem at all. What happens when another negligent credit bureau pops up to replace it?

They'll probably be less negligent if they're forced to see Equifax's head mounted on a pike. Metaphorically speaking.

Re: Myequifax.com Bypasses Credit Freeze Pin

#59

Post by orky56 »

asark wrote: post #39
dev1n wrote: post #4

Can we just shut down equifax already?

What we ought to do—to tie into the "let's break up Google" story also being discussed right now—is make collecting and hoarding data about people incredibly risky. A leak of any size should be a "your company is finished" event. Much collection should simply be outlawed or at least placed under strict user control, GDPR-style. It'd make the CRAs, various other financial institutions (credit card companies, banks), a…

It's the centralization, not the aggregation, that's the problem. If entities, even if under the umbrella of a single corporation, were organized based on datasets to aggregate this info, the risk and punishment could be commensurate.

Re: Myequifax.com Bypasses Credit Freeze Pin

#60

Post by css »

rlucas wrote: post #47
techsupporter wrote: post #37

Earlier quoted context omitted.

Oh, they use the exact same font. Fair enough; I'll add a disclaimer at the top but Ally did the same thing to me (same zodiac question).

The bank itself is probably not doing the KBA; they're buying and integrating a KBA dialogue solution from one of the vendors. So might be the same software / font / question bank at work.

Correct about the software most likely, but Discover uses FF-Meta [0] and Ally uses Lato [1]. They are admittedly quite similar.

[0] https://fonts.adobe.com/fonts/ff-meta

[1] https://fonts.google.com/specimen/Lato

Post reply on HN