Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Experian Sold Consumer Data to ID Theft Service

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Experian Sold Consumer Data to ID Theft Service

#71

Post by cptskippy »

usefulcat wrote: post #61
cptskippy wrote: post #52

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I'v…

I do the same thing (using unique email addresses) and over the years several such addresses have been aquired by spammers one way or another. Until recently, it was mainly smaller sites and businesses that this happened with. But I was quite surprised when I started getting spam at the unique address I gave to Dropbox.

I'm always disappointed when I receive SPAM from large online companies like that. SPAM on non-profit emails or from small businesses that probably use Outlook are no surprise but large IT related companies are disappointed.

I was pleasantly amused when I got an email from my congress man asking my specifically about my email address and wanting to know what was going on. We had a nice back and forth conversation about it and I had a greater appreciation for him as a result because I knew that a human was actually reading my emails. More than that, he was looking at the email address.

Re: Experian Sold Consumer Data to ID Theft Service

#72

Post by tedunangst »

unclebucknasty wrote: post #67
bullseye wrote: post #42

Earlier quoted context omitted.

> For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. If you want to improve your credit, finance those cars. Make payments for about 6 months and then…

> Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system. I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak mor…

Of course the credit-reporting bureaus profit tremendously by upholding the current system as it is.

This doesn't seem to follow. The credit bureau has incorrectly identified a responsible person and denied them a loan. No loan = no interest payments. How do they or the bank profit? People who deal solely in cash are the worst kind of (non) customer for the financial industry. Wouldn't the banks prefer (and pay for) accurate ratings over inaccurate ratings?

Re: Experian Sold Consumer Data to ID Theft Service

#73

Post by pdonis »

unclebucknasty wrote: post #67
bullseye wrote: post #42

Earlier quoted context omitted.

> For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. If you want to improve your credit, finance those cars. Make payments for about 6 months and then…

> Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system. I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak mor…

You're assuming that "credit-worthiness" == "financial responsibility", but they're not the same thing, because "credit" as it's used in our current economy is not the same as "credit" as you would think of it just using ordinary common sense.

When you get a loan for a car or a house or pretty much anything else, the bank is lending you money it doesn't actually have. (This is called "fractional-reserve banking" in order to confuse the uninitiated into thinking it is something abstruse, when it's actually very simple: I've just defined it in one sentence.) The cash that gets paid to the seller when you close on the loan is created on the spot (ultimately it comes from the Federal Reserve, at least in the US, which can print money on demand--actually it doesn't even have to "print" it since it's just electronic entries in accounting databases); it doesn't come from the bank's vaults.

So the bank doesn't really care whether or not you can pay back the loan; it makes its money on the "processing fees" at closing. The loan payments you make are going to third parties (in many cases, the bank sells your loan to a third party almost as soon as it's created), who are spreading the risk of default much more widely. (If you ask, "what happens when that risk isn't spread widely enough?", the answer is that you get an economic meltdown such as the one that happened in 2008.) But since the primary lender is making money on fees, it considers people "credit worthy" who generate fees: i.e., who take on debt. It does not like people who pay cash because that creates no debt and hence no fees.

Re: Experian Sold Consumer Data to ID Theft Service

#74

Post by vinhboy »

cptskippy wrote: post #52

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I'v…

Very interesting story. Do let us know how it turns out.

Re: Experian Sold Consumer Data to ID Theft Service

#75

Post by josephlord »

GFischer wrote: post #36
troyk wrote: post #10

Earlier quoted context omitted.

And they can sell what they call the "header" of your credit report without regulation (such as the FCRA). This info includes your name, address, ssn and dob. Or at least it did when I bought it in the 90's to build a service to find dead-beat dads. I've heard they are more restrictive on the SSN, but I also would bet that's the #1 data element for the ID thefters.

I don't understand why the U.S. is so opposed to a nationwide ID, and yet obviously need one, and end up treating other documents less suited to the task as one. Here in Uruguay (and almost everywhere else) we have a national ID number (Cédula de Identidad). It's not supposed to be secret (although it's not a great idea to divulge it freely). http://en.wikipedia.org/wiki/National_identification_number

An SSN is quite a good ID in that it should uniquely identify WHO is being discussed but it is a lousy authenticator to prove you ARE the person being discussed. Unfortunately in the US it seems to be regarded as a shared secret (between you, every credit reference agency, significant portions of the government, every bank you use, every employer you have and significant numbers of people working for all those groups) that they then use as authentication. What is needed is a separate authentication process.

Re: Experian Sold Consumer Data to ID Theft Service

#76

Post by kevinpet »

callmeed wrote: post #28
dangrossman wrote: post #23

Earlier quoted context omitted.

Actual bad decisions you made in the past are a valid reason not to risk underwriting a large loan to you. There are valid criticisms of the credit agencies, but that doesn't seem like one of them. If you want a mortgage and you feel you have a convincing reason a bank should risk entrusting you with their money despite a bad credit history, try an in-person appointment with a lender at a local credit union. Be prepa…

I don't disagree with you–but it can be frustrating to know you've improved both your responsibility and your earning power yet only be judged by the past. For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Small things like that annoy me about the agencies/system. Also, the median home price where we live is…

So you pay cash for everything, and somehow that demonstrates your ability to responsibly use credit?

Do you also assume that Mormons are experts on responsible social drinking?

Re: Experian Sold Consumer Data to ID Theft Service

#77

Post by icu »

Zenst wrote: post #37
icu wrote: post #22

Thanks cylo for the post. Sadly we can't seem to trust the credit agencies or Government agencies with data protection. We need a politician who will champion some sort of legal offence (Federal?) for digital data protection breaches whatever the industry/company (above anything that already exists) that will scare companies enough that they start taking digital identity seriously. Maybe that's a pipe dream but I get…

Agreed and I'm somewhat supprised (UK peep here) that no data protection act is in place. UK had first version of the act in 1984 (oh the ironic choice of dates, govermental humour maybe). With that I'm amazzed there is nothing in the USA, must be something beyond class action suits?

Having lived in the USA and the UK I've experienced the political contrasts. My gut feel is that the American political engagement, the way the media reports politics, and how people think as a result are to blame here.

So exactly what do I mean by that? Well for starters I believe that the American political structure doesn't lend itself easily to direct public scrutiny and transparency. I can't remember ever meeting an American politician except when it was in their best self interest... surprise, surprise right around election time. Barriers are set up making it difficult to get face-time with a Senator or a Governor. By comparison MPs (British Members of Parliament) are obliged to have open constituency meetings where a member of the public can arrange to speak to their MP face to face.

British politicians just seem more willing to me to engage with 'Joe Public.' For example, it would be beyond belief to hear that the US Vice President or some Governor of some state has a weekly call in radio talk show slot, yet Deputy Prime Minister Nick Clegg (kind of like the British Vice President) and Mayor of London Boris Johnson (who is more like a US Governor than a city Mayor) have regular weekly radio slot on LBC (a call in radio talk show) where they calls from ordinary citizens and sometimes take some intense heat.

Also understanding American politics outside of the likes of Fox and others (or what I would say is the "TV political bubble") is difficult. Sure there are some amazing publications one can read. The likes of the The Wall Street Journal, The New York Times, Time, The Economist, and Foreign Policy all spring to mind. However these publications are not for everyone and definitely not read by the masses.

In comparison, the Sun and other tabloids, manage to break politics down into bite-sized blurbs that focus on the important parts for the everyman. I believe that this allows Brit Joe Public to be regularly informed on politics and therefore more engaged. So well much could be said about how bad tabloids are, I think they provide a valuable public service keeping people informed and from time to time crucifying the odd politician or goading them to action.

If there was maybe more public political engagement, more willingness for politicians to be accountable and less special interests on capital hill maybe the average citizen would understand why data protection is important and feel they have the leverage on politicians to enact it.

Re: Experian Sold Consumer Data to ID Theft Service

#78

Post by unclebucknasty »

pdonis wrote: post #73
unclebucknasty wrote: post #67

Earlier quoted context omitted.

> Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system. I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak mor…

You're assuming that "credit-worthiness" == "financial responsibility", but they're not the same thing, because "credit" as it's used in our current economy is not the same as "credit" as you would think of it just using ordinary common sense. When you get a loan for a car or a house or pretty much anything else, the bank is lending you money it doesn't actually have. (This is called "fractional-reserve banking" in o…

>You're assuming that "credit-worthiness" == "financial responsibility"

No. I am saying that it doesn't, but should to a larger degree.

>This is called "fractional-reserve banking"

Yeah, I'm pretty well familiar with our banking system. No need for the Dr. Evil-style "laser" air quotes. It's not germane to this discussion in any event, as defaulted loans aren't good for the bank.

>So the bank doesn't really care whether or not you can pay back the loan;

Not true. Many banks/lenders actually service most of their non-real estate loans vs. selling them. Also, to the extent that they do sell loans, they care about credit-worthiness because higher quality loans fetch a higher price.

>(If you ask, "what happens when that risk isn't spread widely enough?", the answer is that you get an economic meltdown such as the one that happened in 2008.)

This is incorrect. In some ways, the problem was that they "spread the risk" too much. That is, the same loans were re-packaged and sold multiple times, creating insane leverage through exotic instruments (derivatives, CDOs, etc.) of little-to-no-intrinsic value. Had we simply seen a series of defaults, the systemic threat would have been greatly reduced. It was the leverage that created the real crisis.

Re: Experian Sold Consumer Data to ID Theft Service

#79

Post by icu »

ams6110 wrote: post #40
Zenst wrote: post #37

Earlier quoted context omitted.

Agreed and I'm somewhat supprised (UK peep here) that no data protection act is in place. UK had first version of the act in 1984 (oh the ironic choice of dates, govermental humour maybe). With that I'm amazzed there is nothing in the USA, must be something beyond class action suits?

I think protecting data is a hopeless goal. The penalties need to be for fraud, and the responsibility for identity verification needs to be the creditors. Hospital admissions and discharges used to be published every day in the paper. People used to have their social security number printed on their checks. Someone's birthday was a day of celebration, not a personal secret. I want to get back to a place where routin…

ams6110, I wish for a world where your quote "I want to get back to a place where routine facts about me do not need to be secret or something I worry about" were true.

However, pandora's box is open and we can never ever go back.

When you say, "The onus should be on anyone granting credit to verify that the person is who they claim to be" I couldn't agree more. This goes to the heart of my argument, you cannot trust those granting the credit. The invisible hand isn't working here. The only other option is to use fear to keep them in line... fear of a regulator that has teeth.

Re: Experian Sold Consumer Data to ID Theft Service

#80

Post by unclebucknasty »

tedunangst wrote: post #72
unclebucknasty wrote: post #67

Earlier quoted context omitted.

> Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement. This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system. I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak mor…

Of course the credit-reporting bureaus profit tremendously by upholding the current system as it is. This doesn't seem to follow. The credit bureau has incorrectly identified a responsible person and denied them a loan. No loan = no interest payments. How do they or the bank profit? People who deal solely in cash are the worst kind of (non) customer for the financial industry. Wouldn't the banks prefer (and pay for)…

If that denied person then goes off to build a credit profile by engaging in a series of other credit transactions, then the value of that customer grows tremendously for the credit bureau. Each debt becomes a part of his/her profile that can then be sold and re-sold. And each transaction generates revenue for the bureau as prospective new creditors pull the customer's credit. It's a self-serving system that benefits both the creditors and the bureaus. From the bureau's perspective, this is far more profitable than taking into consideration other factors to get just one loan decision "right".

And, this is the how we've been trained to "build credit", as evidenced by the grandparent's standard advice to improve credit by financing cars and paying them off over the months vs. paying in cash. This is how things work currently, and most people understand and follow that program, which suits the bureaus quite well.

>Wouldn't the banks prefer (and pay for) accurate ratings over inaccurate ratings?

This is not to say that the current approach is wholly inaccurate. It certainly can be one way to measure worthiness. I'm just saying that there are other approaches that are overlooked and, as it happens, the credit bureaus don't have much incentive to pursue those other approaches.

Post reply on HN