You try to sign up correctly, then it emails the fake persons email for permission? How does that make any sense.
"Hello scammer, John Doe would like to access his Equifax account. Do you want to give him permission?"
I agree the Experian way is not good either, but how is the above handled?
I can speak for Experian. If you already registered the account, and someone else knows your SSN and the answers to the credit bureau security questions, then _they_ get to register your account. You as the person who originally registered will get an email that your email address changed.
Supposedly the thinking is that they want to make it impossible for someone to truly be locked out of accessing their own Experian account, so they just let you do these stealth registrations as long as you can answer all the security questions. Clearly they need a better solution.
They already have the well-shared data that determines much of your life. Signing up is so you can glimpse it too.