Google admits to violating federal law and plans to keep doing it | Hacker News Reader

Google admits to violating federal law and plans to keep doing it

89 pointsthrowaway8202830 comments

I've been doing this back and forth dance with Google for a while, where I remove a credit freeze from Experian, wait a couple days and then apply for a payment plan through Google Fi for a new pixel phone. I am then denied with a message:

"There are special circumstances on your credit profile that do not permit us to access your credit information, and we are therefore unable to review your eligibility for the Pay Monthly Device Plan."

After talking to their support and Experian, it was determined this is most likely due to having a fraud alert on my account that I placed there after getting a breach notification from T-Mobile. However, as Experian stated and claims on their website and the FDIC has published guidance stating the same, denying credit due to having a fraud alert on your credit profile is illegal. It is a violation of the ECOA because having a fraud alert is a right under the CCPA. The steps that companies are supposed to take for people with a fraud alert, is to contact the phone number included with the fraud alert and verify the individuals identity. Ironically, Google actually includes the section of the ECOA that they are violating in the denial.

After two months and retrying the same steps, I finally got a Google representative to admit that they are blanket denying credit for having a fraud alert because as they claim it is their policy and they don't have the resources to verify identities. Yes, you heard that right, a billion dollar company claims they can't afford to follow the law. I notified Google about this back in September when I sent an email to their legal department and mailed their registered agent, along with filing a complaint with the Consumer Financial Protection Bureau, which they ignored.

I am not the first person to ever complain about this, as it appears someone else reported the same on reddit but it is a pretty unique issue. Google states that I should remove the fraud alert and then try again. I appreciate the suggestion, because this will be the final nail in the coffin to prove that they are indeed violating the ECOA. However, it will be interesting (and unfortunately expensive) to see if a judge actually applies the law as written or gives a special exception to Google based on their connections.

That's actually horrible.

The immediate impact is that someone who is the victim of fraud is then stigmatized and systematically denied access to financial service.

The knock-on impact is even worse, though, as it means there is a strong consumer disincentive now to report fraud at all. People would refrain from reporting identity theft so as to preserve access to their digital lives.

At scale, this would effectively leave consumers without practical recourse to fraud, meaning that having your identity stolen in 2002 might mean you don't get a mortgage in 2042.

I sure hope the hammer falls on Google here.

Huh—my experience with having my credit "frozen" was that I could still open accounts, it just meant that if it was happening online the company would call me first using some number on record with the CRAs (I think?) to make sure it was really me (and, like... why the actual fuck isn't that the default behavior? Why do you have to request that they do that?)

I'd not have even bothered unfreezing before trying to apply for something from Google. Now I'm wondering how that would look. They do hate paying actual people to do actual-people things, so maybe they'd, uniquely, just flat-out reject the request.

(yes, I get that OP removed the freeze first, I'm just wondering how Google would have handled it if they hadn't)

Having a freeze is actually supposed to prevent any pull at all, which is why Experian has an option to unfreeze. The fraud alert is a separate action though that states you have been a victim of identity theft.

I feel like freezing should get you a set of 10 one-time defrost codes. When you apply for something, you give a defrost code to the creditor and that lets them punch through. When you run out, you can re-authenticate and get more.

The normal unfreeze process could still work, but frozen really should be the default, rather than this weird freeze / unfreeze business you have to do. What we really want is to grant one creditor access one time.

Nitpick: depending on how the financing is structured, it may not be under CFPB jurisdiction at all - the DOJ explainer on the ECOA says that retailers and "finance companies" are the FTC's responsibility.

https://www.justice.gov/crt/equal-credit-opportunity-act-3

IANAL but I do suspect the counter-argument would be that their internal fraud processes & metrics have determined there's NO approach that produces "reasonable belief" of the user's identity as required before issuing credit for a report with a fraud alert.

https://www.govinfo.gov/content/pkg/USCODE-2011-title15/html...

The CFPB did end up forwarding the complaint and I did notify the DoJ as well. I agree that they'll probably try to argue anything they can to deny responsibility.

Is there a reason you haven't talked to or mentioned the company providing the payment plan? "Google Store Financing is a credit card account issued and serviced solely by Synchrony Bank" and "Credit card application decisions are made solely by Synchrony Bank."

What's in it for you to start the project of fighting Google's lawyers on this? I think it's great that you point this out, but I'd consider different ways of creating pressure on them to change their policies. Can you complain to the FCC?

Because I already sent a letter to multiple agencies about it and nothing was done, so the only recourse I have to get them to change their ways is to file it myself or find a class action attorney willing to do it.

Good luck and thanks for holding them accountable.

You might want to contact your senators, and if they aren't responsive, I would not be surprised if Sen Elizabeth Warren's office wasn't interested [0].

This sounds like an egregious and intentional management decision to ignore the law. Generally not appreciated by those who write the laws.

[0] https://www.warren.senate.gov/contact/office-locations

Are you pursuing legal action?

Yes, I will be pursuing legal action on the matter because there is a $10,000 punitive penalty.

please update if you get $10k out of them in a settlement. I'll be happy to file myself.

Perhaps we should stop calling Google by the brand name they acquired to clean up their image and call them by their original name: DoubleClick.

Class action.

Unfortunately, '...but it is a pretty unique issue.'

Doesn’t take that much time to slap a fraud alert on your credit and force this bureaucratic process of theirs to trigger.

Probably isn’t worth the legal fees though.

It likely is not. Just the filing fees in federal court can be close to $500 and I believe the ECOA requires the action be brought in federal court.

Could this be ripe for an automated lawsuit app, like the one to fight against bogus parking fines?

How many could be won before Google finally fixes it?

I wonder if Google would cut off accounts associated with suing Google.

That is one of my biggest concerns, although in this case that would hopefully be a PR disaster.

I would be surprised if they didn't.

Although the situation is ideal for class action, federal law caps the penalty at $500,000 for class action and so depending on the number of class members the amount I'd get as a class representative is likely less than what I'd get in an individual case.

So you don't really care about others, just yourself. A class action, could gain you near nothing but cost Google millions, or you could gain 10k and google could lose 10k.

Uh, if the class action damages cap is 500k then it’s only worth 500k to Google…

I am very glad the OP is pursuing action at all; it is far too easy to simply let violations of the law slide (and companies work hard to make it so). He deserves praise for that. The few of us who go through this stressful months or years-long journey deserve all the support we can give them. We should try to avoid giving petty, selfish critiques from the backseat.

I do get why you might feel that way, but first by me going alone it doesn't prevent someone else from filing a class action.

Yeah that's incredibly selfish. Is the point to hit Google for acting antisocially and doing this same song and dance potentially with anyone, or just to get compensated for the brazen demands on your apparently extremely valuable time?

Both. Regardless of the route, they would change their practices and the law does allow for equitable relief to get them to stop doing the action.

Reply on news.ycombinator.com