Equifax Breach Fallout: Your Salary History
krebsonsecurity.com
krebsonsecurity.com
It sounds like companies can easily use this to collude against employee wages and benefits.
The real issue is some people suck at negotiation and past salaries will tell companies that.
If I have a guardian who pays my rent so that i can take 6months to high ball offers to finally find a job that will pay me a high wage does that mean I'm 'better' at negotiating?
It hardly is THAT hard to get some competing offers. And if you can't be bothered, I guess you don't really want it anyway?
Interviews scheduled during work hours, already working multiple jobs, burnout, lack of openings in your field
> It hardly is THAT hard to get some competing offers. And if you can't be bothered, I guess you don't really want it anyway?
This sentiment signals bias
Competing offers? For what? Serving coffee? Washing dishes? DBA? CTO?
If you offer anyone with a job more money my guess is 100% would take the extra cash, so just because they fail to find, or look, for more cash how does it imply they 'don't really want it anyway'?
While your sentiments are presumably bias-free?
What I meant by signalling bias was I felt the gp was allowing bias about the issue cloud reasoning as to the nuance of the issue
If my comment seemed to imply that I deny nuance then I failed to communicate my point
Which was: sometimes pay is a result of other factors other than either a want or pure negotiation
Thanks, I think that's a much better criticism of the original argument
For existing jobs? Inertia is probably a factor there, as well as fear of the unknown. When you've got something to loose it's different than having nothing to loose.
In my experience, that is not how it plays out.
Candidate A is living at home with his parents in some kind of GP paradise, able to give 100% of his time to interviewing.
Candidate B is working a stable but not fulfilling job, and interviewing on his lunch break / evening / morning to make it work.
Candidate B is going to be perceived as the higher value candidate, and all else being equal get more offers. Some of this is a value bias. You interview A and go "wow, he's not working now, I wonder what is wrong with him?"... you interview B and go "wow, he is a stable guy that can hold a job, he seems a slightly better fit".
Thinking that interviewing is some kind of magic trivia question that you need to devote full time study to is silly. Perhaps some jobs are like that, but I am not sure I would want to work there.
Now at 70% a 10% raise might not seem like a huge deal as your still under market, but it only takes 7 of those to double your salary. And a 15-20% pay raise to jump to the next job is hardly unreasonable. Do those every ~3 years and you will massive difference inside a decade.
Remember, the median salary is just that people really do get paid more than it.
I have been on interviews where this is part of a boiler plate release/waiver for a background check, prior to receiving an offer letter, and on the same form, you are made to list prior employers, and fill in the salary box for each.
And if you don't like it, good luck taking legal action, right? Whether something is legal or illegal, most people lack the resources to even entertain the idea of challenging legality.
The only path that seems to effectively buffer this practice is working with recruiting agencies, which do a better job of negotiating, but do still collect this information. And although recruiters might only be capable of telling you whether you have real leverage for your salary demands, whether the recruiter is being paid by you or the employer is a clue as to who they're working for.
Hint: if you aren't paying them out of pocket, recruiters aren't actually working for you, even if they seem really pleasant.
Then again, I'm fortunate to have highly sought skills and years of experience, but I wouldn't go so far as to say that's the only way to get fair pay.
Edit: I should point out that I'm not making anything to brag about by silicon valley standards, but I also live somewhere with much, much lower cost of living and salaries in general, and make the high end of what's common out here.
2. Make up a figure -- you have a lot of leeway to do so truthfully by adding or not adding various benefits to the number you state.
A common tactic is, if a company knows what you're making, they'll try to hold your earnings as close as possible to something only slightly better than any potential raise you'd be entitled to at your current employer, and you'll get the same tactic from multiple potential employers.
If you're only entitled to a 3% raise, organizations with access to this information might only ever offer 5%, and refuse to go higher.
With this information in the picture, lower salaries mysteriously stay low, even for some lateral moves, depending on who you are and what they can dig up on you.
I think that transparency could make for a more fair process and also level negotiation since the compensation would then be about the role and how good someone is actually rated, rather than about how much they happened to have been paid in the past or how good they are about lying about it.
Secrecy is good in many places, but I can't think of why it is good for tax returns, asides from perhaps allowing criminals to more easily target those with high incomes?
I prefer for every random passerby to know full details of everything I do.
In some poor communities, there's a strong ethic of sharing good fortune. That's good in many ways, but also makes it hard to climb out of poverty. More generally, lots of people have unbounded spending habits, and some will put a lot of pressure on friends/family if they find out they have any savings.
The downside in the private sector is that employees will find out how much they are getting screwed around with. Double downside when those employees figure out why.
Lenders want to "verify employment" and I can imagine a service where big employers report who is working for them to an agency, allowing lenders to query the agency to check employment.
What I doubt is that employers report salary data to Equifax. I'm an employer and I've never heard of this. I'm good friends with (well...married to) someone who worked in this field and tells me it is highly illegal to divulge non-anonymized salary data to any entity other than the IRS.
I've been trained how to answer calls from lenders asking about our employees (I can answer "yes that person works for us", and provide no other information, period).
The idea that Equifax built a giant database of everyone's salary data is completely at odds with everything I've ever heard as a person running a business with employees.
Also...if they had this data why am I always asked to provide my salary on loan applications?
..to allow these corporations to continue to make money at our expense.
https://www.nbcnews.com/business/consumer/republicans-congre...
/s
What you have, what you know, what you are. Those are the three factors. Passwords and fingerprints are two of them.
You need the ability to change out your password or 2fa if it gets compromised. You can't change your fingerprints or retinas.
People need to stop complaining about biometric security if they don't understand the basic concepts of security in the first place. Re-read my first post and this one, and if you're still confused, look into factors of security. Hopefully you can stop parroting this nonsense that fingerprints are not a valid factor in 2fa.
What are you going to do if you have a dispute with your payment processor? Just stop processing payments while you switch providers? Its like no one here has run a legitimate business before.
Regardless of what the options are, it's a colossal PR misstep that deserved a much more thorough explanation from the IRS than "they're the only ones who can provide this service that we can't readily explain".
Is it too much to dream that Equifax should be legally obligated to provide, at the bare minimum, a way to easily secure this sensitive information?
If I were a hiring manager or in HR this would be a goldmine for verifying candidates' salaries and work histories, and gaining the advantage in any salary negotiation.
2. I'd hope that people might hesitate a little bit before committing acts of identity fraud on an institutional scale.
2 - Will it save the company more money than the potential cost of lawsuits? Is it provably fraud? I'd argue that there is value in knowing for certain that an applicant made $x amount of total compensation in salary, benefits and equity. Having a precise dollar amount could let you implement all sorts of ways to optimize the compensation packages you offer for different employees.
For instance you could check an applicants past three jobs and get the average compensation % increase between each. You could use this to get a well-modeled idea of the minimum you need to offer them based on past trends in order to hire them.
Is this illegal? It should be, but the job market didn't anticipate the Equifax breach. There may not be laws that specifically prohibit this.
I get why it's important to tell the truth to e.g. a lender during a mortgage application.
Why should a prospective employer deserve this information?
But why can Equifax just go ahead and store and share my information in perpetuity, with no explicit grant of permission from me, or EU-style GDPR to guarantee my right to evict my information from their database?
Why doesn't Equifax have to ask for my permission before _they_ can forward my information that was shared with them to additional third parties? The bank had to ask for permission, so why doesn't Equifax?
Is it because I am really the product and not the customer? I just can't accept that!
Because when you get asked this on an interview, what's the "right" answer? There's base pay, bonuses, 401k match, all kinds of stuff. So the "right" answer is up in the cloud somewhere, I can't see it, but I'm being turned down for jobs when my answer doesn't match the mystery number?
Its not only my salary month by month, but also all my bank accounts, all credit card account all with amount I owe, amounts and history I paid, everything! Full front-face info, straight from credit reporting bureaus! :|
Yes I can see every month how much I owe and how much I paid back. Month after month history. I sure also see my checking and savings accounts, from every bank (currently 2), with up to date (well, 7 days ago) status on how much money I have there. I don't know what else I can say? Screenshoots - no thank you.
If you have checking accounts on there it's because you specifically added / linked them into their system, having bank accounts on there isn't a default.
You have to go under "Track Spending" and manually add the accounts, including entering in the Username and Passwords for them.
https://www.creditkarma.com/question/is-there-a-way-to-add-m...
All we need now is a 23AndMe breach, and we'll be fast-tracked to the GATTACA timeline!
Convenient that Equifax is doing "maintenance" on this page after Krebs posted his article...
https://secure.w2.talx.com/popups/findemployer.aspx
https://secure.w2.talx.com/PreAuthenticated/employerEntry.as...
XXXXX Company Name
I guess the first five digits is the code.
1) If the value of the individual damages related to this breach are in excess of the market cap of the equifax company, all company stock should be seized and distributed equally among those affected by the breach.
2) In the future, if a company controls this amount of sensitive data, they should have mandatory breach insurance. This means that they are covered for a government mandated amount based on the legal liability if all their data was lost. This will mean that the insurers will do in-depth audits of the data security of the company, and they will be incentivized year-to-year to ensure their security practices are top notch. The present system incentivizes each CEO to have a head-in-the-sand approach to data security where a hack is considered a long-tail event unlikely to happen during the ceo's 3-5 year tenure and therefore is not really worth paying attention to. In addition, it would ensure that if the potential damage done if data is leaked far exceeds the value of the business storing the data, the insurance will be prohibitively expensive and the company will not be able to continue with this line of business - as it should be.
I would love to know if there is a way to see what data is held on me, and who has requested it.
They don't. It's essentially an indemnification clause that they can point to as a copout if their service gets abused and a victim of that abuse comes looking.
"They said they had permission. We're just an innocent third party that they lied to. Go take it up with them." more or less
>You must give your consent for reports to be provided to employers. A consumer reporting agency may not give out information about you to your employer, or a potential employer, without your written consent given to the employer. Written consent generally is not required in the trucking industry. For more information, go to www.ftc.gov/credit.
https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-r...
You see, once EFX bounced off its low, I thought I'd catch a "dead cat bounce" with some call options I'd hold for a week and make a few bucks. It's a proven strategy for me, find a company with a scandal, wait a week for it to blow over, make a quick and small profit when it bounces back up. Then unload, because it won't last. Worked for me with United Airlines as one example. But EFX just keeps going up...and up, and I have no idea why. They were always a horrible, if profitable, company. But the Equifax problem isn't even remotely close to being resolved, and yet at the rate it's going it'll be back to pre-scandal prices before long. (Note that I don't believe it will get back to those prices any time soon, but it's trending that way.)
So to answer your question: I don't have a good answer. The almighty market seems to think things aren't all that bad, despite the masses of unpopular sentiment. My best guess is that there are a lot of fingers in that pie (this article being but one example) that don't want to see their source of data disappear. Still can't figure out why that's driving the stock price up, though.
See: BP oil spill, HSBC money laundering scandal, Wells Fargo fraudulent account scandal, Equifax data leak, United Airlines beating up a passenger... I know I'm forgetting some.
I'm pretty sure you could beat the yearly S&P's performance in a single trade for any of those events.
Apple having to delay a new iphone release would have a more significant long term effect on that company's stock price than workers at foxxconn facilities killing themselves
Yeah, I don't know where I stand on it quite yet. I mean, I won't outright buy Exxon shares to hold long-term. Is it hypocritical to make a short-term trade using options? Yeah, probably. But it's not like that money goes straight into Equifax's pockets, it just adds a minuscule amount of liquidity to a market for abstractions of EFX. Meh, I've got bigger ethical fish to fry right now.
As aside, to add to your list: the private prison company whose stock went down last year when the Feds said they were going to curtail using private prisons. A few seconds of reading confirmed that it's states that make the most use of private prisons, not the Feds. Made bank on that one, can't say I feel good about it. But I also can't articulate exactly why I shouldn't feel good about it other than, "private prisons, yucky!"
I'm pretty sure you could beat the yearly S&P's performance in a single trade for any of those events.
Of the three that come to mind that I've personally traded recently, that is most certainly true (the in-the-money EFX calls I have are up about 300%). Problem is, such scandals need to happen more frequently in order to make a trading strategy out of it. About once or twice a year is as frequently as I see such opportunities come up. One could have made a year's SV salary on EFX calls with a $50K investment, but because it's options that $50K could very easily be worth $0 in just a month or two.
Nobody cares about Equifax. What's going to happen? You have a republican congress that won't regulate them away, the banks need them, and the actual thieves are criminals or nation states who'll get tagged with the actual crimes that get committed later.
They will wait until they get their fine, take the media hit, and then rename the company after Trump kicks a kitten or something and overtakes the news cycle.
It looks like that's the only way, we can't just "vote with our wallet" in this situation.
No idea if they used something smarter than birth date for "Login Code"
As an example, One firm managed to figure out the correct expected birthdate of our child. The only record of this child are the medical and prescription records of the near fatal miscarriage that my wife was hospitalized for at 9 weeks.
If they can get that, one or more somebodies is paying off your company's payroll processor for your salary data.
Yeah. Many levels of creepyness there.
Because mine initial impression was that this site uses credit information to disclose every person's salary.
In that case I guess the main issue here is just that the information is not well protected, especially after recent leak.
For mortgage and car loans you do not need credit card either.
So we can just give up credit card totally. We do need a new way to build people's credit scores somehow though.
So, just because credit cards aren't common in China, doesn't mean that there isn't some other equivalent tracking going on... (although, I don't know any specifics).
Yes people still need credit, and typically a government branch keeps track this kind of information.
[1] https://www.nytimes.com/2017/09/29/us/puerto-rico-shortages-...
Credit cards only matter to Equifax and other credit scoring companies because of the "instant loan" that they give to a consumer. The banks that issue credit cards want to know if the consumer will pay back that loan.
As long as consumers can get instant loans through some kind of mechanism (credit card, phone, pinky swear, etc.) there will be a role for credit scores and the companies that generate them.
Sounds like the employers were doing it wrong.