Hacker News Reader

Comment by devonbleak | Hacker News Reader

It makes me irrationally angry that I suddenly started getting spam emails from Experian. Like motherfucker I never consented for you to have my data, then you leak it all, now you're sending me unsolicited junk email? It's just such bullshit that I'm literally forced to have a relationship with these companies to freeze my credit or else I'm at the mercy of whoever they decide to release my information to without my authorization.

View on HN

Yep. It sucks. Zero consequences of any import for those companies as far as I'm aware too. Tiny fines end up being "cost of doing business". Then they get to externalize their failures onto us by using terms like "Identity Theft", which indicates something was stolen from ME and is now MY problem.

In actuality some not-well-maintained systems owned by <corp> were hacked or exposed or someone perpetrated fraud on a financial institution and happened to use information that identifies me. It's really backwards.

PSA: If you haven't already, go freeze your credit at Experian, TransUnion, Equifax and Innovis. It will make the perpetration of this type of fraud much more difficult for adversaries.

PSA pro tip: they will try to steer you toward “locking” your account. Don’t fall for it. Freeze your account.

Do you know why they do this?

No. I have some guesses. A credit reporting company can probably sell access to their data for good money if the account is locked but not if it is frozen?

Put otherwise if a bank asks experian to look at my credit report and experian tells them to take a hike because my account is frozen, that’s not worth much money to the bank. But that’s the only credit account configuration that has any value to me, so I’ll insist on it.

I think “freezing” and the dynamics thereof are established by federal law, while “locked” is a think the companies made up so they had an account setting that they could provide that would give the illusion of security, while maintaining the ability to sell information associated with the account.

In other words: evil people do evil things when we aren’t paying sufficient attention. It’s our job to hold them accountable.

Innovis? That's new to me. How long till they spin up yet another credit check corporation that I have no choice but to involve in my life?

I was also informed you can freeze opening checking accounts here.

https://www.chexsystems.com/security-freeze/place-freeze

My pet solution has been to make the credit reporters liable for transmitting false information to the CRAs.

Chase tells Experian I opened a new line of credit with them, but it later is demonstrated that it was a scammer with my SSN? Congratulations, $5,000 fine.

Of course this all gets priced in to the cost and availability of consumer credit. Good! Now the lenders have an incentive to drive those costs down (cheaper, better identity verification) to compete.

The solution is much simpler. Put all of the consequences of being defrauded by a borrower onto the lender.

If a lender wants to be repaid, then they need to show the borrower all the evidence they have for proof that the borrower entered into the contract.

If all a lender has is the fact that a 9 digit number, date of birth, name, and address were entered online, then the borrower simply has to say “I did not enter that information”, and the lender can go pound sand.

Guarantee all the lenders will tighten up their operations very quickly, and consequently, so will the loans that appear on one’s credit report.

Right. This is a problem between the lenders and the people who stole from the lenders. The person whose name/number was used shouldn't even be part of the transaction or part of the problem.

They call it "Identity Theft" instead of what it should be called: Bank fraud. The term "Identity Theft" 1. needlessly pulls an otherwise uninvolved person into the mix, suddenly making it their problem too, and 2. downplays the bank's negligence.

If someone uses my name to take out a loan, and the bank stupidly lets them, this shouldn't even remotely be my problem. I shouldn't even have to know about it. This is the bank's problem from their own stupidity.

Lenders hand over bad loans to collection agencies (“accept the consequences”) all the time. Cost of doing business. That an innocent person’s credit is destroyed is just collateral damage from their perspective.

"Put all of the consequences of being defrauded by a borrower onto the lender" - that seems a bit strange.

Imagine saying "put all of the consequences of getting robbed onto the bank, not the robber"

Who bears the consequences of their home being robbed? Or mugged on the street? Or a contractor taking payment for services and then disappearing?

Why are we subsidizing lenders’ by putting this ridiculous burden on people who have nothing to do with the lender’s business?

The lender can pay to appropriately verify their borrower’s identity, or go to court and sue for damages like everyone else has to.

Can you describe how you make them liable in this arrangement?

You can challenge entries your credit report today. Win the challenge, whoever reported the entry is liable to the Feds. Maybe add a modest bounty for the injured taxpayer.

For a while they were sending emails about my account that I was actually unable to unsubscribe from[1]. I knew it was illegal at the time, and when I finally noticed an unsubscribe button it was because the FTC finally intervened[2].