Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's still easy for anyone to become you at Experian

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 347 posts

Re: It's still easy for anyone to become you at Experian

#91

Post by tmcz26 »

gchamonlive wrote: post #82
wildrhythms wrote: post #75

Earlier quoted context omitted.

How does this fraud work? They buy the goods, and provide the seller some random individual's (your) identity?

I have no idea. There are, however, many official invoices (notas fiscais) being issue in my name. I believe there might also be fraudulent credit cards issued in my name that ate being used, or something like that, which would explain the physical retailers not questioning the purchase. That is why I am expecting fallout from this.

You can check any credit card issued on your name in Banco Central’s Registrato page[0]. Credit card, loans, etc.

However, HIGHLY unlikely they issue a card in your name and purchase stuff in your name online. If they have a card with them, they’ll go to physical stores and leave with the product with them immediately.

Typically (as I said above) they have purchased a stolen CC number online and are using it until it gets blocked or run out of balance/limit.

In any case, there’s zero fallout for you, the victim. These retailers are used to this (0,5% of transactions turn into fraud), so they’ll eventually figure out it’s fraud and they know it wasn’t you. They know you’re a victim too.

[0] https://registrato.bcb.gov.br/registrato/

Edit with the link

Re: It's still easy for anyone to become you at Experian

#92

Post by baz00 »

NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

I can beat that on annoyance level at least. I still get postal junk mail for Mr Qwe Rty after I put it in a test form when I was a contractor in 2005. This got onto a database somewhere and was sold to someone and I just get junk mail galore!

Re: It's still easy for anyone to become you at Experian

#93

Post by [deleted] »

callalex wrote: post #60
barkerja wrote: post #46

Earlier quoted context omitted.

Given it is your email that is being used, that should allow for you to take over the account(s)? I'd submit a password reset, change the password, then just allow the account to live a dormant life. That of course doesn't make it any less annoying, but it would at least stop an actor from using an account that is associated to your email.

Be careful, in the USA that is still a violation of the CFAA and US courts have proven themselves to be technically incompetent time and time again. People have been sent to prison under CFAA for using the “view source” button that’s available in every web browser.

[deleted]

Re: It's still easy for anyone to become you at Experian

#94

Post by throwaway54_56 »

throwaway914 wrote: post #59
throwaway54_56 wrote: post #45

Earlier quoted context omitted.

I get these every so often and I'm curious what you mean my ignore at your own peril. My approach has been to ignore it and assume they will realize their mistake and reregister.

OP said so: The functionality of the account is usually partially or mostly available to an unverified email.

Yes, but I don't understand what problem that poses for him. After he verifies the incorrect email address, they have full functionality.

Re: It's still easy for anyone to become you at Experian

#95

Post by [deleted] »

NikolaNovak wrote: post #37

I am still livid on a weekly basis when some strangers create an account for a service using my email address (non-maliciously, usually); I get a "verification" email; and I can only choose "YES, Please verify", or ignore at my peril. From tiny little mom-and-pop shops, to FAANG giants, nobody is giving me the opportunity to say "NO that's NOT me!". And though it's a "verification" email, typically account is usable…

[deleted]

Re: It's still easy for anyone to become you at Experian

#96

Post by jessriedel »

Implicated wrote: post #85
happytiger wrote: post #83

How is Experian not sued out of existence for their total failure to protect their customers? I just don’t understand what law allows organizations that compromise large portions of entire societies to continue.

We're not the customer, we're the product.

But why can't people successfully sue for libel/slander/defamation by individuals when they give false damaging information about the individual to creditors?

Re: It's still easy for anyone to become you at Experian

#97

Post by ajmurmann »

nyokodo wrote: post #7
bee_rider wrote: post #6

Of course, we aren’t the customers for these spying companies. But it is surprising that the total lack of security isn’t a deal-breaker for their actual customers. I mean if you can basically impersonate anybody using this service, what is the point of using it?

> what is the point of using it? Plausible deniability allowing them to push as much significant risk of identity theft onto consumers instead of themselves where it should be.

Even the term "identity theft" needs to go. My identity wasn't stolen! I'm still the same person. The bank got tricked by a scammers and somehow the bank tries to make that my fault.

Edit: Imagine this the other way around! Grandma gets scammed by someone pretending to be her bank. So the bank's identity got stolen. So now the real bank needs to fix it, provide more proof of identity to all customers and jump through all kinds of hoops to not owe grandma crazy amounts of money.

Re: It's still easy for anyone to become you at Experian

#98

Post by coldcode »

nilamo wrote: post #74

I still find it infuriating that the punitive settlement for giving away extremely sensitive information was only... $34.34 per person impacted. Why even have laws or fines if they're so toothless?

That's the point. Politicians get paid (donated, contributed, whatever) to vote businesses' laws to benefit the business, not you. Toothless laws make a good sound bite but do nothing to help you.

Re: It's still easy for anyone to become you at Experian

#99

Post by fedorareis »

jessriedel wrote: post #96
Implicated wrote: post #85

Earlier quoted context omitted.

We're not the customer, we're the product.

But why can't people successfully sue for libel/slander/defamation by individuals when they give false damaging information about the individual to creditors?

Those types of suits generally hinge on proving malicious intent
Post reply on HN