Experian, you have some explaining to do
krebsonsecurity.com
krebsonsecurity.com
All the burdens are completely backwards, in turn massively perverting the incentives. And it's eternally infuriating. Some rando applying for a credit line on the opposite side of the country should be Not My Problem, 100% of the time, whether they have my name or address or a random symmetric 9 digit number some government assigned me. All the tools exist for financial institutions to manage their risk/convenience tradeoff, but they're the ones who have the power, information and should have the incentive to do so. They are externalizing onto the general public instead.
Credit bureaus — as well as the various credit building products that are so common in these countries — are required to play that role.
Social security numbers were introduced for the sole purpose of administering the social security program. The protections on private entities abusing them were neutered, which is how we ended up with the backwards regime under discussion. People have a vague fear that social security numbers are important and shouldn't be casually shared, which is the only thing holding back (for example) grocery stores from demanding your social security number to get the regular prices.
If say the US issued everyone a cryptographic identity via a smart card, there would be little stopping every single business from demanding that you scan this card. Imagine needing to link your singular legal identity to every single online service, so they could better associate your surveillance records. Big tech is currently doing its best to accomplish this through phone numbers, but at least it's possible to get additional phone numbers.
The consequences of the problem the proposal is trying to address seem larger to me. Currently, you can be denied access to capital and even basic financial services because identity management has been outsourced to unreliable third parties with no incentive to do a better job.
[1] Sorry Jenny https://youtu.be/6WTdTwcmxyo
Still, there is a difference between this de facto state of affairs, and a de jure mandate from the government to make us more trackable.
If were talking about the deficiencies causing the original topic, the right answer is to rebuke this nonsensical concept of "identity theft" and make companies fully liable for their attempted frauds (ala the top level comment of this tree). If we're talking about constructively building systems to do things the "right way", then privacy needs to be incorporated in such systems from the ground up, as the previous bait and switch with social security numbers has demonstrated.
Innuendo amongst other things is the perfect trigger for paranoia, and in such situations, people will get banged up in a mental health hospital and have drugs forced down their throat otherwise they just get labelled as uncooperative, and then other drugs will be forced down their throat and their detention period increased, perhaps even indefinitely. Its a clever system and there is no judge or jury to convince, you just go straight to mental hospital without passing Go!
You cant argue against this craze for labelling everything as mental health issues, Doctors will not have their authority challenged. I even had a GP tell me how I could suicide myself!
You dont run a country by being nice!
You got a lot to learn, now obey your authority figures and back to work!
No they absolutely are not. You know what institutions, after government, should have been in principle be absoultely ideally placed to help with identity in a private distributed way?
BANKS (credit unions too perhaps). Lots of secure, physical locations people were used to going into. Already have a need to deal with serious physical security, and lots of money. Already tons of KYC infrastructure. Well regulated and trusted overall. Reasonable numbers of choices. Valuable in-house dogfooding opportunities. This should have been a slam-dunk service for banks themselves to do, and one near impossible to replicate the same way online which also would have been quite helpful for them vs online-only challengers. Each local branch could have a dedicated room or rooms to take photos and video, verify documentation, history, references, whatever else, all the stuff that was (and in much of the world still is) needed to prove ones' identity and open an account. Then the banks could all have their own CAs and give people a signed cert attesting that all this had been done in-person at XYZ location, every bank required to do it themselves with cross signing possible, and all online account usage required to use PKI, no password/email crap. And we'd live in a different, better world.
Instead they've tried to outsource or externalize that. That should be absolutely on them. All the tech has been easily possible develop for something like 20 years (OpenSC even first release was 2001). I'd love to see a law along the lines that financial transactions and products including loans, credit cards etc that are only backed by stuff like described in this article (name, SS#, birthday etc) are simply unenforceable in court and that defendants can challenge it along the lines of anti-SLAPP statutes where the challenge happens pre-discovery and stops the whole process with attorney fees going to the defendant if they win. Bank tries to after somebody for unpaid debt and all they have are info like that? Case dismissed, they can just eat it. Criminal for credit collectors to go after it too. Bet we'd see some changes in a hurry then.
David Mitchell discusses it further here: https://www.theguardian.com/commentisfree/2018/nov/25/identi...
The problem is that America's government does not provide a strong form of identity. In fact, strong identity is culturally resisted: civil libertarians[0] have been adamant that America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier.
Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. Names are quite common, people move all the time, phone numbers change and can get stolen, SSNs were specifically designed to be easily forgeable[1], most Americans do not have passports, not everyone has a US birth certificate, not everyone can get a driver's license, the ID-only cards you can get are intentionally designed to be a pain for the above two categories, etc.
[0] This is also one of the few times where I don't have to distinguish between left- and right-wing libertarians either.
[1] If you were born before 2011 you can obtain valid SSNs by incrementing or decrementing the last four digits of your own. You will get the SSN of someone else who was born in the same hospital as you. The first five digits are just a function of the state the SSN was issued in and when you were born. There is no check digit, they only started randomly issuing numbers in 2011, and even then it does not matter because compromised SSNs are never reissued unless you are an FBI informant.
No, it makes establishing trustworthy business transactions slightly harder. Only slightly, and the necessary technology has been off-the-shelf for some time now.
> Today, if you are a bank you don't actually have any good options to verify the identity of a new customer.
The folks at my local credit union and I know each other personally. It would take a "Mission Impossible"-style impersonation to get them to succumb to fraud ("identity theft".)
It is true that banks very much don't want to issue loans that turn out to be fraudulent.
But, they very much more strongly don't want any liability for ruining peoples credit for issuing those fraudulent loans. So they'll rather take the former than the latter. Shift the blame to the innocent person who has no way to prevent it.
Examples
climate change: individuals should choose electric cars, run their thermostats higher in the summer, lower in the winter, and lower their carbon footprint. Ignore industries that dominate the generation of greenhouse gases
obesity: no, it's not the product of individual fallibility. That's the dominant narrative, but the problem is the food system
retirement savings: join your companies 401k and max out your contribution, get an IRA, save more. Don't blame companies that stopped funding pensions, but let the financial industry capture huge profits from managing funds. Oh and don't have any affordable housing for retirees.
plastic waste and garbage: recycle! return your bottles for deposit! But the “Keep America Beautiful” campaign, was actually the product of beverage and packaging corporations such as the American Can Co. and the Owens-Illinois Glass Co., later joined by corporations such as Coca-Cola and Dixie Cup.
SSNs aren't even that random, they're very deterministically generated for the most part. If you know when and where someone was born its not too hard to guess the first 5 digits or so, meanwhile the last four digits are routinely shown places.
Thanks for sharing this!
Some time ago someone obviously signed a gas contract for a company and just put my home address as the billing address. The first I heard about it was when I received a gas bill for a property that I have absolutely no connection with. It was addressed to a company I have no connnection with at my home address. I've lived in the same house for over 10 years and this company has never been associated with my address in that time. I don't think it was before either but w/e.
I accidentally opened this bill because I receive a lot of mail and didn't realise it was incorrectly addressed. Having seen that it was the wrong thing I wrote to the company explaining their mistake. I also gave them the name and address of the actual officers of the company who had the debt (this is public information in the UK where I live). I didn't hear back except that I received 3 or 4 more bills all of which I returned to sender.
A few months later I received a legal letter from a collections firm saying they had been engaged to collect this debt and I had to pay up or they would take me to court. I wrote to them explaining the situation saying that this debt, company and the property and debt underlying the address was nothing whatsoever to do with me and that I had written to the creditor to that effect some time ago.
I didn't hear back until a few months later, when I received another legal letter from a different person at the same collections firm basically repeating the threat to take me to court. I wrote to them again and also called them up to explain. The person at the collections agency thanked me for calling and said they would deal with the matter.
A few more bills arrived. I returned them to sender (at least once in an envelope with a covering letter explaining the situation again). Then I received a notice saying a default court judgement had been entered and that the bill had to be paid. I wrote to them again and said they had to stop harrassing me and actually pursue the collection against someone associated with the actual company.
It was super clear that at no time did anyone associated with either the original creditor or the collections agency make the slightest effort to actually try to collect this debt from someone who was actually responsible for it. This is in spite of the fact that I spoonfed them the names and addresses of actual people who were associated with the company responsible etc. This situation could also never have occurred if they had actually made any effort at all to check whether the company was associated with the billing address.
If people with the means (those that have "fuck you" money and can afford to walk away) suddenly turn around and say "nope" and are happy to have bad/fraudulent credit, the entire credit system collapses - banks need to lend to survive and if the credit system stops being useful in verifying someone's creditworthiness (because even creditworthy people's records are contaminated with bad/fraudulent data) then banks will switch to a different system that doesn't have these problems (and that system could be to manually search for bankruptcy records and evaluating proofs of income, like it's done in many European countries), or lose out to those who switch because the "fuck you money" people will prefer them as they're willing to ignore the credit history system and use alternative means of evaluating creditworthiness.
Of course, a legal solution that outlaws this privacy nightmare is best, but that's a lost cause in the US. The market-based approach described above is more likely to work.
It's a fairly simple process though.
1. Create a table that tracks every email address change on the account. It can't just be a single field because once compromised, people have learned to just change the email address twice.
2. That table should contain fields for: user_id, email_from, email_to, confirm_key, reversal_key, created_at, confirmed_at, reversed_at, created_ip, confirmed_ip, reversed_ip
3. When an email change is initiated, an email should be sent to the new email address with the confirmation_key to have them verify the new email address before making the change.
4. Once verified, an email should be sent to the OLD email address notifying them of the change and including a link to the reversal_key to use if they did not make this switch, including the IP address and approximate geolocation of the IP address for some context.
5. If the user clicks the reversal link it will clear the confirmation and reversal links of every email change that came after the link that was clicked, ensuring that the original change can always be reversed no matter how many changes were made afterwards, revert the email address change and force the user to update the password. This password change screen should warn them that their account was likely compromised and strongly recommend they enable MFA (if available on the site) to prevent it from happening again.
I spent a year working on a site that dealt with a TON of fraud and phishing against the user base. This was one of the biggest issues that we dealt with, but this approach completely resolved the problem.
https://www.brightball.com/articles/automatically-reversing-...
One example:
- Destructive actions to an rsync.net account (manual deletions, account cancellation, etc.) have an "email age" flag. If someone is requesting something dangerous from a just changed email, support looks very closely at the request and sends a heads-up to both the old and new email addresses.
We also have some relief mechanisms for the occasions people get locked out of their lives by (google, et. al) - if a user can prove control over an rsync.net account by `touch`-ing filename of random hash we provide, we can start a reclamation process based on proving the ability to destroy the account anyway.
Email age wasn’t included, but definitely should have been.
The worst part is, you can’t even talk to Uber support chat unless you put in the account’s current email, phone number, and last 6 digits of the credit card on the account. I have the attacker’s email address, but not the phone number, so I couldn’t even chat with support. They have an “email support” form, but it asks for the same info. I put in what I knew, but I haven’t heard back from support since the attacker took my account this afternoon, and I fear I’m not going to get it back.
https://help.uber.com/riders/article/i-think-my-account-has-...
Interestingly enough it also says:
> We are currently seeing a high number of requests come through this form.
Just yesterday it was an attempt at a password reset. For an email that doesnt even exist in their system, allegedly.
Sorry, that second one was best buy. This was the text:
You may need to create an account.
We received a request to reset your password on BestBuy.com®.
However, we don't have an account associated with this email address. You can try to sign in with a different email address.
You can also create a new account using any email address you choose.
Happy Shopping!
Your Best Buy Customer Care Team
Normally a security breach this egregious would require the attacker to call the help desk, but for some reason Experian has it baked right into the signup process. That is an impressive level of negligence. Someone had to put some serious effort into opening up that security hole.
100% this. If there were serious consequences to not taking (customer) account security seriously, perhaps it wouldn't be such a common occurrence.
Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.
There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
How does this keep happening... It's pretty remarkable the gallery of blunders a simple HN search gets you for "experian":
If the c-levels at Experian were sent to prison for a few years each time this happens, you can bet your last dollar they'd put measures in place to prevent this sort of thing.
If in some dystopian future, the C-levels could be given 2 years for what could amount to a basic human error in an otherwise well-run organisation, no-one would do the job and a whole sector of the economy would probably go bust.
Having worked in a handful of companies, at least some of them try to do the job properly but are restricted by employee turnover, lack of consistent skills across the software sector, negligence at any level, incompetence - even if not malicious, tired engineers, ancient software systems that would be impossible to replace in any reason time etc.
>> employee turnover, lack of consistent skills across the software sector, negligence at any level, incompetence - even if not malicious, tired engineers
Pay better, give raises that keep up with the market, and train your people. Basic stuff.
>> ancient software systems that would be impossible to replace in any reason time etc.
Second best time to start is now. Ancient software systems with tons of legacy cruft and obsolete tech aren't going to get any better.
All this costs money, which is the real problem. If there's a market wide failure, as there seems to be in credit reporting, then serious consequences for cheating out on this stuff to undercut your competitors at the cost of security seems fully justified.
That's the point - if the C-level could go to prison then you'd find that mysteriously there were multiple overlapping systems of control implemented such that no one person could make a simple human error and expose reams of customer data: it would require systematic failure.
(At that point, when safety systems are in place but fail for complicated hard to predict reasons, malicious negligence is hard to prove and executives don't go to jail.)
Worse than that - the consequences are positive for Experian: "For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity".
Aren't CEOs paid "that much", because they carry all those responsibilites? If they're responsible enough to get so much money, they're responsible enough to deal with the consequences of fucking up.
I believe the general argument here would be that if you invest in a company and they later are caught doing something illegal or unpopular, you suffer when your shares lose value.
They have never shown interest in anything outside their B2B relationships with creditors and employers (remember, they track your employment history plus salaries for future employers’ use).
The biggest mistake here was not having a link in the old email that says "CLICK HERE if you did NOT change your email" that would undo the email change and put some sort of lock or hold on the account.
* Equifax failed with a server error [0]
* Transunion requires payment [1]
[0]: https://my.equifax.ca/consumer-registration/?lang=en
[1]: https://members.transunion.ca/tucan_en/orderStep1_form.page?
SOftware is massively complex and not everything has been defined in a way that there is a "right" way and a "wrong" way to do things. What happens if they setup 2-factor and someone loses their phone? What happens if someone needs to change an email address and can't access their old account because an ISP has gone bust or is refusing to give you access?
I agree that things should be much better but until there is a book of "this is the right way to do signup/signin/account reset/ etc. " then most of us are trying to do things the best way we know how to and sometimes bad things happen.
Article 32, GPDR: https://gdpr-info.eu/art-32-gdpr/
SOC2, CSF, FedRAMP?
> Define adequate security
If there is no means of defining "adequate" when it comes to security of sensitive personal data, then companies should not be allowed to amass and process sensitive personal data.
If it's not possible for a company like Experian to exist safely, then it probably shouldn't exist at all.
It is but "adequate security" is not defined. That is what I am saying. Would someone without 2FA or this particular account reset process be prosecuted in the EU? Almost certainly not because the Prosecuter cannot currently say, "you didn't follow NIST guidance XYZ requiring it to be done this way".
> private credit registers are all but extinct in the bloc now
I'm not sure why you think that. In the UK, we have a number of them who are used by organisations. They are bound by the same GDPR regulations as everyone else.
And when these (hopefully rare) bad things happen (and are documented and reproducible) what do you propose, do nothing and wait some more until that book is published by someone?
Or take note of what happened (useful to later publish the "other" book "these are the wrong ways to do signup/signin/account reset/ etc. ") and quickly implement a remedy for the found issue?
Too bad our elite senators and congress folks have no interest in keeping people's identity safe.
[1] https://www.ftc.gov/enforcement/refunds/equifax-data-breach-...
And as if to rub salt in the wound:
> 3. I don’t want Equifax to have my data. What can I do?
> Equifax is one of three national credit bureaus. These companies collect information about your credit history, such as how many credit cards you have, how much money you owe, and how you pay your bills. Each company creates a credit report about you, and then sells this report to businesses who are deciding whether to give you credit. You cannot opt out of this data collection. However, you can review your credit report for free and freeze your credit.
It turns out you literally cannot turn off sex offender notices (within an unspecified distance of your home) without turning off all notices for activity under your name, address, or SSN.
Just start opening CFPB complaints and do your best to push all the buttons in the way that sets off the maximum alarm bells. Yes, this is preventing me from making my payment, why do you ask? Got a call from an "executive support team" two days later.
Her answer was to just batter my way through the phone system until I got an operator because it was definitely, totally the right number... should go back and see if they ever actually fixed it, I ended up just knuckling under and using a short, insecure password that their system would actually accept, maybe I should see where the CFPB complaint is. But if you don't let up, CFPB complaints are a big deal and will absolutely get movement, they've definitely resolved "intractable" (read: bank couldn't be bothered reading the case notes after a half dozen times repeating it to them, even when I repeated it all for them) issues for me in the past.
(I am on autopay but genuinely if something went wrong with my credit union or the mortgage system and I needed to get in, I would be fucked. Sure I could pay by check/paper coupon but I'd have to cancel the autopay first and I don't know if I can do that on the coupon either... it's really only the inertia of a few things still working right that actually did prevent problems with payments in general, so actually "problems with payment" isn't real far off.)
Probably not worth it in the long run.
Maybe brokerages don't report to Experian? So you could use margin as a form of credit? Unknown.
You just don't know it because it's hidden behind a series of machinations that not only generate the credit score we're all used to, but also a variety of B2B products from renter risk to identity verification.
As for the spam filters, whilst the domain definitely does play a part in some cases - there's more to it than that. Having the correct security configuration (DKIM, etc.) and a "trusted" mail server (good luck asking M$ for their list, though) goes a long way.
There would be no identity to steal if thieves knew that any bank will properly verify they are who they claim to be instead of just handing them money after they recite a SSN…
I placed a lock on my Experian credit score years ago when I moved overseas with no clear plan to move back to the US. I was living overseas, and read something that a lock only lasts 2 years, so I had the lock PIN sent to a relative and told my relative to just shred the PIN letter. The last I read was that for some states, the lock lasts 2 years, some 7 years, and some indefinitely.
In any case, I moved back to the US and my Experian credit was still locked, so I sent a notarized letter from my bank indicating my new address to Experian, in order to initiate re-issuing my PIN. A week or so later, I got an email from Experian saying my address had been updated. I logged in online and saw that Experian then thought that I lived inside my bank! The Experian employee read the bank's address off of the notarized letter, not my address from the body of the letter.
There are supposedly 3 ways to reset your Experian PIN: phone, website, and snail mail. The phone system tells you that you actually need to use the website or snail mail. The website, when I gave it my particulars, generated internal errors multiple days in a row, and the error message told me to use the phone or snail mail. They say they'll respond to snail mail within 2 weeks, I think, but it was closer to 6 weeks, by which time I had sent 3 letters and finally resorted to the aforementioned random mashing of the phone keypad.
Some executive at Experian clearly heard that Kafka is very popular at many companies now, completely misunderstood, and structured their processes around the complete works of Franz Kafka.
I'm totally not surprised that they allow you to just sign up a new account for an existing identity, and when called out on it, claim they have some opaque secret security process that's you know, totally better than not allowing strangers to make duplicate accounts for your identity.
Side note: if you move overseas, do your best to keep a US credit card open in the off chance that you move back. Note that you can't even gen a secured credit card issued without a credit check, which is ridiculous. The cash on deposit fully covers the card's maximum balance, so the credit risk to the issuing bank is zero. I had to use my foreign credit cards for my first 2 months in the US while getting my Experian credit lock sorted out. Both Experian and the banks are jointly at fault for that mess.
Now I know why. My only recourse is I suppose to call my loan originator and advise them against the reliability of Experian.