Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 347 posts

Re: It's still easy for anyone to become you at Experian

#81

Post by elif »

barkerja wrote: post #46
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

For Experian accounts, doing a password reset requires an SMS or phone call code.

The only mechanism you have to alert the person usurping your email identity that there is an issue is to trigger the phone call verification 3 times per day, preferably around 4am.

If you call the phone support, it will give you robots until playing a pre-recorded message telling you to physically mail a legal request including copies of your ID etc.

Re: It's still easy for anyone to become you at Experian

#82

Post by gchamonlive »

wildrhythms wrote: post #75
gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

How does this fraud work? They buy the goods, and provide the seller some random individual's (your) identity?

I have no idea. There are, however, many official invoices (notas fiscais) being issue in my name. I believe there might also be fraudulent credit cards issued in my name that ate being used, or something like that, which would explain the physical retailers not questioning the purchase. That is why I am expecting fallout from this.

Re: It's still easy for anyone to become you at Experian

#84

Post by esquivalience »

supertofu wrote: post #79
NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I frequently get emails intended for someone who has my same email handle, but with the extension "@googlemail.com" instead of "@gmail.com". I know a lot about them. I know their shipping address in the UK. I know that they order inexpensive club attire, online Dominoe's delivery, and have a specific gym membership. I am shocked that Google offers no way to disentangle my email address from this person's. A more mali…

My understanding was that the two domains are equivalent. The following sites seem to confirm my understanding. Are you sure it isn't you?

https://support.google.com/mail/thread/125577450/gmail-and-g...

https://www.quora.com/What-is-the-difference-between-gmail.c...

https://www.gmass.co/blog/domains-gmail-com-googlemail-com-a...

Re: It's still easy for anyone to become you at Experian

#85

Post by Implicated »

happytiger wrote: post #83

How is Experian not sued out of existence for their total failure to protect their customers? I just don’t understand what law allows organizations that compromise large portions of entire societies to continue.

We're not the customer, we're the product.

Re: It's still easy for anyone to become you at Experian

#86

Post by toomuchtodo »

elif wrote: post #81
barkerja wrote: post #46

Earlier quoted context omitted.

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

For Experian accounts, doing a password reset requires an SMS or phone call code. The only mechanism you have to alert the person usurping your email identity that there is an issue is to trigger the phone call verification 3 times per day, preferably around 4am. If you call the phone support, it will give you robots until playing a pre-recorded message telling you to physically mail a legal request including copies…

File an FTC and CFPB compliant. Only regulators will light a fire. Experian isn't going to do anything due to consumer complaints, as the consumer's credit file is the product. Let someone from Compliance have to email the product owner about it, and the complaint starts the clock ticking.

https://reportfraud.ftc.gov/

https://www.consumerfinance.gov/complaint/

https://www.youtube.com/watch?v=9CWbc6pekd8&t=1310s ("We have a complaint database, we collect information, and are always eager for information" -- FTC Chair Lina Khan at Y Combinator)

Re: It's still easy for anyone to become you at Experian

#87

Post by tmcz26 »

wildrhythms wrote: post #75
gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

How does this fraud work? They buy the goods, and provide the seller some random individual's (your) identity?

Stolen ID from one person (ID, name, sometimes using the real person’s email and phone, sometimes creating fake yet similar emails like wildrhythms2@yahoo.com), someone else’s stole credit card number, and a drop address to receive and reship (sometimes deliver direct to the purchaser of the fraud item).

Typically the item is resold for half the price and it’s spoken for. It’s not like they buy to resell later. If they make the fraud they already have a buyer

Re: It's still easy for anyone to become you at Experian

#90

Post by ciropantera »

wildrhythms wrote: post #75
gchamonlive wrote: post #63

Maybe this is why for the past few weeks I am receiving countless emails from major retailers like Casas Bahia or Americanas and even Magazine Luiza with purchase confirmation listing several smartphones and notebooks whose invoice bare my name and cpf. I tried contacting every retailer. Only Magazine Luiza seem to have acknowledged the fraud and issued a warning but to no avail, as I am still receiving invoices from…

How does this fraud work? They buy the goods, and provide the seller some random individual's (your) identity?

Something similar happened to me once. You need a valid CPF number (something like a ssn) to create an account on most webshops in Brazil, so fraudsters will use stolen ones. They then proceed to purchase stuff with stolen CCs
Post reply on HN