Credit Karma to launch free ID monitoring following Equifax hack | Hacker News Reader

Credit Karma to launch free ID monitoring following Equifax hack

reuters.com

65 pointsersnyder131 comments

We need to get rid of this whole industry. Our credit should be frozen by default and approved only via the method of our choice, not something we have to pay to do. We should be able to view our credit report anytime we want. There is still plenty left for a business model for the credit bureaus.

Another idea would be to deregulate the industry (is credit reporting not free speech?) but add a lot more teeth to libel laws.

That still puts the onus of correcting issues on the public (must sue a large, well-lawyered corporation to rectify incorrect information), and it has a lot of knock-on effects (loose libel laws seem like a very bad thing for a free press).

Libel laws are a terrible idea; there's a reason the US has a special law against extra-territorial enforcement of UK libel law.

Why do we have to deregulate first?

Just libel? What about slander and RICO?

While admirable, it's going to take incremental steps to get there. Please ask your representative (if you live in the US) to co-sponsor or support Elizabeth Warren's FREE Act and Equal Employment for All Act:

"I Introduced the Freedom from Equifax Exploitation (FREE) Act with Senator Brian Schatz. Our bill gives you more control of your data. Companies like Equifax make billions selling access to your data without your consent, then charge you if you want to stop them. It's nuts. The FREE Act lets you freeze – and unfreeze – access to your credit file at no cost. It's like a free Do Not Call list for your credit data. The idea behind our bill is simple: Equifax doesn't pay you when they sell your data. You shouldn't have to pay them to stop selling it."

"I also reintroduced the Equal Employment for All Act to prevent employers from asking job applicants for their credit histories. Credit reports are already riddled with errors. The Equifax hack will make it worse. Inaccurate reports shouldn't hurt your job chances. Bad credit doesn’t make you a bad employee. Workers should compete on the merits, not on their credit scores."

https://www.facebook.com/senatorelizabethwarren/posts/847975...

Press Release: https://www.warren.senate.gov/?p=press_release&id=1837

Bill Text (Warning: PDF) https://www.warren.senate.gov/files/documents/2017_09_15_Fre...

EDIT: GET INVOLVED!

The concept of frozen credit itself is wrong. Creditors need to positively identify those seeking to open new accounts or access existing accounts with a more rigorous process.

Which is to say that in the absence of a government identity verification service, you really shouldn't be able to open a new account without showing up to a branch office in person. That would at least limit identity theft to those that bear some physical resemblance to you. If they could also take cheek-swab DNA samples directly from the applicant, establish shared secrets, and exchange cryptography certificates at that time, that would be great.

The procedure should really be predicated on the possibility that they would later have to prove conclusively in court that the account-opener and the defendant are actually the same person.

> The procedure should really be predicated on the possibility that they would later have to prove conclusively in court that the account-opener and the defendant are actually the same person.

Why is it not already this way? If a credit reporting agency falsely alleges that you have a history of failing to repay your debts (when in reality the person failing to pay is actually a scammer who has no relationship with you whatsoever) and that false allegation negatively impacts your ability to obtain a new credit line in the future, isn't that libel? Why aren't credit reporting agencies already being sued left and right as it is under existing law?

If a company wants to make it their job to determine the credit-worthiness of individuals, then shouldn't they be required to make sure that information is accurate or face libel charges?

> Why is it not already this way?

Because the credit industry can afford better lobbyists and lawyers than you.

A normal, rational person would indeed know that to be libel, but US treats damage to reputation differently from Europe. I'm not a lawyer, but I think in the US you have to prove the allegation was false, that they knew it was false when making it, and that the false statement actually caused you harm.

The businesses in the industry establish the reasonable norms for knowing when something is false. The CRAs say they trust the creditors to report accurate information, and the creditors say they trust the CRAs to match reports to the correct records. They both point at the identity thief as the true culprit.

But you can't sue them, because they used your name, and no one knows who they really are. Essentially, it's a blame-shifting shell game that only holds up because of the massive amount of money flowing through the industry.

> Why aren't credit reporting agencies already being sued left and right as it is under existing law?

Too Big To Fail, I think. They did eventually get sued for "robo-sigining", although personally I think everyone who ordered their staff to participate in it should have been jailed for perjury. http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-...

Awesome to get all the attention. We've been working on this product for a bit, with everybody worried about this in a timely way we thought we'd push it out soon, and some social attention is great as launch is right around the corner. CK brought some evolution to free credit score years ago, last year we brought it to tax, and this year we start on the ID monitoring space. The hope is the same credit karma promise and package (always free, monitor the data, notify you if an issue comes up, give context on how to fix it, and try to help people make progress) works in this space. We're hiring a few more senior full stack engineers for the team and if you are interested in identity monitoring, dark web monitoring, data security, batch processing, and helping people we'd love to have you. Feel free to hit me up via email matt _at_ creditkarma.com.

So, in essence, Credit Karma is going to use ID monitoring as a lead gen tool for their affiliate/ad business model.

Will be interesting to see how LifeLock responds.

LifeLock has been running ads for several days now making fun of these services. The tagline is something like "What good is monitoring credit fraud if they don't stop it too" and then showing a character such as a security guard in a bank robbery saying "Oh, I don't stop robberies, I just monitor them. You're being robbed."

I think Equifax, Transunion, and Experion should be blocked from accessing a person's information unless they explicitly authorized by the person.

There needs to be more transparency into the storing of personal information and the whole process of credit scoring an individual for the purposes of the borrowing they wish to do. This is a service that should be free. Why should people be paying to access their own information? That's just weird. The lenders are the ones who should be financing the credit scoring industry.

Have you read any of those credit card or loan applications you've been signing? You are authorizing them access to your information.

As a long-time user of Credit Karma, I'm curious if anyone knows anything damning about the company that could change my mind about using them for nearly all my personal finances?

As long as you understand their business model, that's pretty much it. With Credit Karma you are the product--they monetize your data for ads and affiliate offers, and potentially have deals with data brokers (although I can't easily confirm if that is the case or not).

But so far I haven't had issues as long as I ignore the offers. Kind of like Mint--the service is valuable enough that the value of the data I'm providing is worth it for me.

Do they give out your data to other parties who then spam you, or do they just show you offers on their own site?

Only to show offers on their site. There are some old Reddit AMAs where they discuss it.

FWIW I found a bunch of them:

[0]: 2 years ago - https://www.reddit.com/r/IAmA/comments/2qq95l/i_am_the_found...

[1]: 1 year ago - https://www.reddit.com/r/IAmA/comments/3zh78n/im_ken_lin_fou...

[2]: 9 months ago - https://www.reddit.com/r/IAmA/comments/5ha7sg/im_kenneth_lin...

What are the cons of using Credit karma? I'm fine with them showing me as many ads as they want on their own site. But I'm not sure I want them giving over my address and phone number to other parties who can then send as much spam as they want. Anyone have extensive experience using then, or knows all the fine print?

> We won't sell or rent your personal information to third parties for marketing purposes. That includes your credit report and credit score.

Not for marketing purposes, but for other purposes?

Isn't the exact point of a credit service that they sell your personal information (credit history) to companies to use for the purpose of extending credit?

Not 3rd parties, but their business model is based on affiliate payment from the banks/credit companies they recommend to you based on your data.

Wait, so the general idea is to now trust them (for some reason) to handle your personal information properly? This seems like they are preying upon folks who do not know any better.

They are not a data broker. With them you are much closer to a client than a product (they are ad funded). It is better than the status quo, but I agree it is just a band aid on a broken system.

I think the bigger problem is trusting yet another company to store your personal data securely. The less info out in the wild, the smaller chance of it falling into the wrong hands.

Next week Credit Karma could just as well be on the front page of the news for being hacked.

Anyone else get a pop up that says "congratulations! You're visitor X and winner of..."? Pretty bad for Reuters if someone can inject JavaScript into their site.

Credit Karma should not be trusted in any way shape or form

Read their ToS and privacy policy. Your data WILL be mined & your data be sold to marketers and third parties.

They are in this business of providing you "free" services, where you give up extremely valuable (otherwise inaccessible) financial data to marketers

Read the small print with credit karma. A friend told me to use it, but after reading their terms I said no way. They basically sell your info to other companies. Which should be obviois if you realize they need to make money some how.

Reply on news.ycombinator.com