Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 347 posts

Re: It's still easy for anyone to become you at Experian

#61

Post by Izkata »

barkerja wrote: post #46
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

Doesn't exactly work when they use your email to create an Apple iCloud account. It needed the actual iPhone it was connected to to complete the reset, I think I ended up getting it into a weird unusable state where neither of us could log in.

Re: It's still easy for anyone to become you at Experian

#62

Post by callalex »

NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I have had spotty success forwarding the confirmation email to security@{wherever the mail came from} explaining the situation. When that fails, you can look up the WHOIS information for their mail sending provider and contact their abuse@ inbox as well.

Re: It's still easy for anyone to become you at Experian

#63

Post by gchamonlive »

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf.

I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from them.

I contacted the local police and issued a boletim de ocorrência (which I am not quite sure how to translate) that describes the problem and how I was unable to apply countermeasures.

I am expecting fallout from this. I am really anxious about this whole situation and how I am utterly powerless in protecting my identity.

Re: It's still easy for anyone to become you at Experian

#64

Post by l33t7332273 »

callalex wrote: post #60
barkerja wrote: post #46

Earlier quoted context omitted.

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

Be careful, in the USA that is still a violation of the CFAA and US courts have proven themselves to be technically incompetent time and time again. People have been sent to prison under CFAA for using the “view source” button that’s available in every web browser.

Which case did someone go to prison for viewing the page’s source?

Re: It's still easy for anyone to become you at Experian

#65

Post by city41 »

theonemind wrote: post #3

Experian reminds me of enshittification, except it never had any interest in providing actual value to the general public to betray, so started off one step further along the process in a way. No individual in a personal capacity ever wanted to do business with Experian, like they wanted to buy an iPhone or something. You're introduced to the unpleasant fact of its existence at some point. They don't have anything yo…

Every time I log into experian.com, I am greeted with an offer to "upgrade" my account for $0.00. At the top is small text that says "Try Experian CreditWorks℠ Premium for 7 days for free, then pay just $24.99 each month†. You may cancel anytime if not satisfied."

First of all, $25/month for an Experian product? I can't possibly fathom how anything they provide can be worth even 1/100th of that. That price just absolutely blows my mind.

But worst of all, they proudly say it is $0.00 and have the pay button the most prominent. How many people get roped into this? They are just slime all the way down.

Re: It's still easy for anyone to become you at Experian

#66

Post by LoganDark »

ISL wrote: post #25
atrettel wrote: post #15

Earlier quoted context omitted.

There is no way to opt out of credit reporting. Lenders report the information to the credit bureaus, typically all three of the big ones, so if you want no information reported, simply close all your credit cards and loans, etc. and place credit freezes on your credit reports. I don't think that "increased competition" will work here. We are not customers of the credit bureaus. We are the product. The customers are…

A statutory fine of $50k per compromised account would get the attention of the credit bureaus. (It might drive them out of business, but it sure would get their attention.)

$50k seems at least four or five orders of magnitude too low to be of any concern to them

Re: It's still easy for anyone to become you at Experian

#67

Post by tmcz26 »

gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

[flagged]

Re: It's still easy for anyone to become you at Experian

#68

Post by jetbalsa »

l33t7332273 wrote: post #64
callalex wrote: post #60

Earlier quoted context omitted.

Be careful, in the USA that is still a violation of the CFAA and US courts have proven themselves to be technically incompetent time and time again. People have been sent to prison under CFAA for using the “view source” button that’s available in every web browser.

Which case did someone go to prison for viewing the page’s source?

I think they are talking about this case, it was thrown out.

https://www.theregister.com/2022/02/15/missouri_html_hacking...

Re: It's still easy for anyone to become you at Experian

#69

Post by narrator »

This all goes back to the social security not being changeable and morphing from some thing to claim benefits with to it being your universal password.

In contrast, I lost my drivers license and in order to get a new one I had to go the DMV in person and put my thumb print on a biometric scanner which pulls up my picture for the DMV person to look at before they authorize the request. I can also file an affidavit of identity theft with a police report attached and they will give me a new license and A NEW DRIVERS LICENSE NUMBER. The federal government trying to shoehorn an unconstitutional universal identity system into social security is the source of all this nonsense.

Re: It's still easy for anyone to become you at Experian

#70

Post by wildrhythms »

NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I was receiving somebody's water bill in my email addressed to someone in the Netherlands (apparently with a similar name). It contained their address, full name, details of their water bill... The email was in Dutch and I used Google Translate to make sense of it. It came from a no-reply so I couldn't just reply and say 'wrong customer', and there was no customer support email address to be found. I had to go to the company website and hunt down some kind of feedback form and begged them to fix this customer's email address. Eventually I stopped receiving the emails. I guess that company never even verifies email addresses. The company is called Oasen in case you're wondering, name and shame.
Post reply on HN