Experian Sold Consumer Data to ID Theft Service
krebsonsecurity.com
krebsonsecurity.com
I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I've shared it with, they're the only ones with a record of it's existence.
When I emailed them asking if they'd had a security breach or if they were selling email addresses they responded saying they would opt me out of marking emails. When I responded with the context and header info of the emails I received and asked if this was in fact from them things turned. About an hour later I got a response, the tone had changed significantly and they indicated that the incident had been escalated to their security department and that they would be in contact with me as their investigation progressed.
I can say this has been the best response to the dozens of emails I've sent to companies about the same issue. The worst was Best Buy whose response was something along the lines of "Eat Dk, we do what we want."
Irritatingly, when I signed up for the utilities at my apartment I used a single address "utilities@domain.com" for simplicity. One of my three suppliers leaked my details with that address, and they all deny it. Took less than a week from moving in to getting penis pump advertisements at that address.
The downside was that changes were veery slow to implement :)
The first question you have to ask your self is for what reason would anyone choose to do that? Shits-and-giggles and malice against me personally are about the only legitimate reasons someone would do that.
Spammers wouldn't want my dummy addresses in their list, and harvesters who sell emails to spammers wouldn't either because I could easily invalidate swaths of their lists by disabling my catch-all giving them a bad reputation.
I mainly do this to see how my email address gets around. If and when I contact a company about my email address receiving SPAM, I don't name and shame in any public capacity. Its of little consequence how they respond because the damage is done, its not like they can undo the SPAM.
I was pleasantly amused when I got an email from my congress man asking my specifically about my email address and wanting to know what was going on. We had a nice back and forth conversation about it and I had a greater appreciation for him as a result because I knew that a human was actually reading my emails. More than that, he was looking at the email address.
I don't know if it is one one of those terms that was invented by one of those PR agencies that invented terms like "climate change" to mitigate the visceral impact of "global warming."[1] But it certainly has ended up as a term that obfuscates the responsibility of banks to stop treating public information like passwords.
http://www.actionfraud.police.uk/fraud_protection/identity_f...
If you want a mortgage and you feel you have a convincing reason a bank should risk entrusting you with their money despite a bad credit history, try an in-person appointment with a lender at a local credit union. Be prepared to show your bank statements, several years of tax returns, and if you're self-employed, a signed letter from your business's accountant about the health of your cash flow. You'll definitely need enough cash on hand for a downpayment of at least 30% the house's value; good strategy even if it weren't required.
If you really want to look credit-worthy, use that six figure income to pay off those student loans before you take on an even larger debt obligation.
For example, I've paid cash for the last 5 cars our family has purchased over the last 6 years. Why doesn't my ability to do that apply to my credit-worthiness? Small things like that annoy me about the agencies/system.
Also, the median home price where we live is $500-600K (depending on the city/neighborhood). 30% of that is quite a down-payment.
You're talking about being entrusted with half a million dollars of someone else's money. That's a huge bet to make on you; it goes both ways. If you can't afford the down payment, then you can't afford to live in that neighborhood.
30% isn't an unusual downpayment, especially if you don't have perfect credit. With a smaller downpayment, the bank is in a position where you could default on the mortgage, they repossess the house, and because it's depreciated in value at all, get less money when they sell it than they paid the person who sold the house to "you" (to the bank, really) after foreclosure and closing costs.
I think this is one of the reasons we got into this mess. People bought more house than they could afford thinking they would be able to sell it if they needed to and at least break even. Nobody was prepared for underwater mortgages because we all assumed houses only appreciate.
The value of land can definitely depreciate. Perhaps not in [sub]urban areas so much, but in rural areas the value of land can be tied to things like timber, water, or mining. If I buy some acreage and extract timber/sand/gravel/etc, that land is going to have a lower resale value.
Or maybe I buy prime farmland and then crop the soil until it is dead.
Or instead of extracting stuff, I leave bad stuff behind (persistent pollution -- lead, mercury, etc).
For something more [sub]urban, consider the case where a new highway is built to route traffic around a city instead of through it, and a previously viable commercial location becomes worthless because the traffic count drops to near-zero.
Because paying cash once for something is the opposite of proving credit-worthiness. You haven't proven an ability to uphold your end of a long-term agreement.
If you want to improve your credit, finance those cars. Make payments for about 6 months and then pay them off. You pay a little extra in interest, but you get another credit entry which is in good standing.
On an unrelated note, you can almost always negotiate a better price on your car (in the US) if you finance and then pay the loan off.
While I don't remember the name, my wife and I built credit getting some sort of secured loan from our local credit union. The process was something along the lines of making an account with them, putting $X into the account, and then getting a 6 or 12 month loan from them for the same $X dollars at a really low interest rate. Overall I think we paid $30 to $50 dollars over that period in interest.
This is absolutely true under the current system. But, I think the parent is actually questioning the rationale behind the current system.
I agree to some extent. Accruing, then using significant cash-on-hand to make multiple large purchases should speak more than it currently does to the customer's financial responsibility and/or wherewithal. It's also potentially evidence of his/her earning ability. All of these should contribute more to the determination of a person's "credit-worthiness".
The current system is punitive for those who generally don't like debt, but recognize its necessity for large purchases (i.e. especially for homes). Debt elimination/avoidance is a sound and oft-recommended personal financial practice, which should show sound financial judgement. Why is there a penalty for subscribing to it?
Of course the credit-reporting bureaus profit tremendously by upholding the current system as it is. Their biggest customers as well as their source of information/power are the creditors themselves.
This doesn't seem to follow. The credit bureau has incorrectly identified a responsible person and denied them a loan. No loan = no interest payments. How do they or the bank profit? People who deal solely in cash are the worst kind of (non) customer for the financial industry. Wouldn't the banks prefer (and pay for) accurate ratings over inaccurate ratings?
And, this is the how we've been trained to "build credit", as evidenced by the grandparent's standard advice to improve credit by financing cars and paying them off over the months vs. paying in cash. This is how things work currently, and most people understand and follow that program, which suits the bureaus quite well.
>Wouldn't the banks prefer (and pay for) accurate ratings over inaccurate ratings?
This is not to say that the current approach is wholly inaccurate. It certainly can be one way to measure worthiness. I'm just saying that there are other approaches that are overlooked and, as it happens, the credit bureaus don't have much incentive to pursue those other approaches.
When you get a loan for a car or a house or pretty much anything else, the bank is lending you money it doesn't actually have. (This is called "fractional-reserve banking" in order to confuse the uninitiated into thinking it is something abstruse, when it's actually very simple: I've just defined it in one sentence.) The cash that gets paid to the seller when you close on the loan is created on the spot (ultimately it comes from the Federal Reserve, at least in the US, which can print money on demand--actually it doesn't even have to "print" it since it's just electronic entries in accounting databases); it doesn't come from the bank's vaults.
So the bank doesn't really care whether or not you can pay back the loan; it makes its money on the "processing fees" at closing. The loan payments you make are going to third parties (in many cases, the bank sells your loan to a third party almost as soon as it's created), who are spreading the risk of default much more widely. (If you ask, "what happens when that risk isn't spread widely enough?", the answer is that you get an economic meltdown such as the one that happened in 2008.) But since the primary lender is making money on fees, it considers people "credit worthy" who generate fees: i.e., who take on debt. It does not like people who pay cash because that creates no debt and hence no fees.
No. I am saying that it doesn't, but should to a larger degree.
>This is called "fractional-reserve banking"
Yeah, I'm pretty well familiar with our banking system. No need for the Dr. Evil-style "laser" air quotes. It's not germane to this discussion in any event, as defaulted loans aren't good for the bank.
>So the bank doesn't really care whether or not you can pay back the loan;
Not true. Many banks/lenders actually service most of their non-real estate loans vs. selling them. Also, to the extent that they do sell loans, they care about credit-worthiness because higher quality loans fetch a higher price.
>(If you ask, "what happens when that risk isn't spread widely enough?", the answer is that you get an economic meltdown such as the one that happened in 2008.)
This is incorrect. In some ways, the problem was that they "spread the risk" too much. That is, the same loans were re-packaged and sold multiple times, creating insane leverage through exotic instruments (derivatives, CDOs, etc.) of little-to-no-intrinsic value. Had we simply seen a series of defaults, the systemic threat would have been greatly reduced. It was the leverage that created the real crisis.
Ok, fair enough. I agree that it should; but then again I don't think fractional reserve banking is as good an idea as most economists appear to think it is.
It's not germane to this discussion in any event
I think it is, because the fact that making loans causes money to be created on the spot means that loans are cheaper (in some cases, much cheaper) than they would otherwise be. That greatly reduces the incentive to increase one's financial responsibility. Also see below.
defaulted loans aren't good for the bank
They aren't if the bank still owns them and if the bank was booking them at an inflated value, yes.
Many banks/lenders actually service most of their non-real estate loans vs. selling them.
Yes, I should have drawn a distinction between real estate loans and other loans.
to the extent that they do sell loans, they care about credit-worthiness because higher quality loans fetch a higher price.
They care about creditworthiness in the sense of ratings, yes; but I thought we agreed that that's not the same as actual financial responsibility, i.e., as whether the borrower can actually pay back the loan. See below.
In some ways, the problem was that they "spread the risk" too much.
They thought they were spreading the risk by re-packaging loans in all these creative ways, when they actually weren't. (This may be what you were referring to by putting "spread the risk" in scare-quotes. Note that I did not do that in my previous post.) Spreading risk means the risk of any one loan defaulting is independent of the risk of other loans defaulting. That turned out not to be true, because real estate was in a bubble, created by low interest rates and consequent cheap mortgages (and the fact that the money for the loans was being created out of thin air), and when the bubble popped, lots of loan defaults happened that were correlated, not independent.
Had we simply seen a series of defaults, the systemic threat would have been greatly reduced. It was the leverage that created the real crisis.
I agree that leverage greatly exacerbated the problem; but note that the leverage doesn't just come from the derivatives. It comes from fractional-reserve banking in general, i.e., from giving out more loans (up to 10 times as many with the current reserve requirement of 10%) than the actual supply of real savings justifies. That's going to create a bubble in whatever the loan vehicle du jour is, even if no other leveraging is present.
Also, our rent is very low here ($2K for a 4bd home on 1/3 acre in a great neighborhood). We just happen to be in an area where buying vs. renting is out of balance.
And your car analogy breaks down real fast. There are many more factors which can/do prevent people from moving to other cities.
Do you also assume that Mormons are experts on responsible social drinking?
If you have old debt, some buyers of that old debt are fraudlently trying to make it look like new debt by filing it with credit agencies--fight it. It's all about statue of limitations.
Oh, I've noticed some of you are very protective of our credit system. I've always felt most credit cards are very unfair. No real control over your rate of interest has alwalys bothered me.
While, I'm on a rant. The Credit Agencies need some competition? It would be a great start up? A credit agency that actually looks at an individuals ability to pay back a loan.
It shouldn't be a crime to pay off your bills without using a credit card. Oh yes, they claim to look at utility bills, etc, but in order to get the really good credit terms they want to see you used high interest credit cards through out your life.
I'll never forget the look on my fathers face when he was refused a credit card, because he never saw the need to use credit until he was in his 60's. This was after paying off a morgage.
The problem with that is that just because someone is able to pay back a loan doesn't mean they will.
I had a roommate in college that financially was able to pay off a credit card, but was just so irresponsible that he ignored it.
For small debts in the 4-6 year range it's usually fine to let them just fall off your report (although there's certainly a moral ambiguity there). Larger debts will almost always be litigated well before the 7-year mark, and entering into litigation does reset that clock.
With that I'm amazzed there is nothing in the USA, must be something beyond class action suits?
Hospital admissions and discharges used to be published every day in the paper. People used to have their social security number printed on their checks. Someone's birthday was a day of celebration, not a personal secret.
I want to get back to a place where routine facts about me do not need to be secret or something I worry about. The onus should be on anyone granting credit to verify that the person is who they claim to be, and it should take more than a few bits of public information to do that.
However, pandora's box is open and we can never ever go back.
When you say, "The onus should be on anyone granting credit to verify that the person is who they claim to be" I couldn't agree more. This goes to the heart of my argument, you cannot trust those granting the credit. The invisible hand isn't working here. The only other option is to use fear to keep them in line... fear of a regulator that has teeth.
So exactly what do I mean by that? Well for starters I believe that the American political structure doesn't lend itself easily to direct public scrutiny and transparency. I can't remember ever meeting an American politician except when it was in their best self interest... surprise, surprise right around election time. Barriers are set up making it difficult to get face-time with a Senator or a Governor. By comparison MPs (British Members of Parliament) are obliged to have open constituency meetings where a member of the public can arrange to speak to their MP face to face.
British politicians just seem more willing to me to engage with 'Joe Public.' For example, it would be beyond belief to hear that the US Vice President or some Governor of some state has a weekly call in radio talk show slot, yet Deputy Prime Minister Nick Clegg (kind of like the British Vice President) and Mayor of London Boris Johnson (who is more like a US Governor than a city Mayor) have regular weekly radio slot on LBC (a call in radio talk show) where they calls from ordinary citizens and sometimes take some intense heat.
Also understanding American politics outside of the likes of Fox and others (or what I would say is the "TV political bubble") is difficult. Sure there are some amazing publications one can read. The likes of the The Wall Street Journal, The New York Times, Time, The Economist, and Foreign Policy all spring to mind. However these publications are not for everyone and definitely not read by the masses.
In comparison, the Sun and other tabloids, manage to break politics down into bite-sized blurbs that focus on the important parts for the everyman. I believe that this allows Brit Joe Public to be regularly informed on politics and therefore more engaged. So well much could be said about how bad tabloids are, I think they provide a valuable public service keeping people informed and from time to time crucifying the odd politician or goading them to action.
If there was maybe more public political engagement, more willingness for politicians to be accountable and less special interests on capital hill maybe the average citizen would understand why data protection is important and feel they have the leverage on politicians to enact it.
The post is saying that a service that aids scammers purchased data from Experian.
Seeing the title, I initially thought it meant that Experian sold data to an ID Theft-prevention service, which would be less bad.
That is, Experian's longevity and importance makes them more reputable. Their function as a business, certainly, is to collect, analyze, and repackage this data. But these things should not give them a free pass on the "why" question that greenyoda posed, if the question is going to be asked at all.
Here in Uruguay (and almost everywhere else) we have a national ID number (Cédula de Identidad). It's not supposed to be secret (although it's not a great idea to divulge it freely).
The ID number in my country has photograph, fingerprints, signature, several security measures (difficult to fake). Not so easy to steal (of course there are forgeries, but identity theft becomes much harder)
I'm not from the U.S., but I've read a lot of criticism about the SSN, for example:
http://www.theverge.com/2012/9/26/3384416/social-security-nu...
"In 2009, researchers developed an algorithm that could guess an individual’s SSN with up to ten percent accuracy"
"SSNs have become available through data resellers, security breaches at various companies and government agencies, unsuspecting customer service representatives, and even public records, if you know where to look. SSNs can be bought in bulk for $1 each on private online forums, and a specific person’s SSN can reportedly be had for as little as $3.80."
I've also read about duplicates ("More than 20 million Americans have more than one SSN associated with their name."), the numbers running out (in the 2050s apparently), etc.
http://www.witn.com/home/headlines/111371029.html
The REAL ID act sounds like something closer to what we have:
http://en.wikipedia.org/wiki/REAL_ID_Act
Some other advantages (from an IT point of view): you can validate an ID number against a central database, and get a person's given names in a unique format. Our ID numbers have a check digit, so you can validate if the ID number has been correctly entered :)
Multiple identifiers per person is a feature, not a bug. People get new SSNs when they want to change their identity (eg, witness protection programs), or because someone stole their old one. That need doesn't go away just because you have a new numbering system.
If you want to use credit, you have to let lenders collaborate to determine whether they're willing to lend to you, if that's their criteria for making decisions.
If you don't want to use credit, they get no special pass to store and use personal data about you.
I'm from Europe, where generally personal privacy gets more emphasis than it seems to in some places, notably the US. We have explicit laws about collecting and processing personal data, but certain organisations seem to get a free pass for no apparent reason. As this story demonstrates, the risks are still there.
That said, perhaps we shouldn't be too worried. The last time I paid a little real money to get hold of my personal credit report from one of these credit reporting organisations, it was so riddled with obvious errors, including more than a few wildly inaccurate data points, that I was on the phone to them for something like half an hour to get them to correct everything. At that point (I kid you not) the woman on the phone asked if I would be much longer because it was the end of the day and time for her to go home.
When I ordered my reports I paid with postal orders, so as not to leak any financial information back to the agencies. I'm glad I did so, as the details ( other than my mortgage ) were laughably incorrect.
I was on the verge of writing to correct them and then caught myself - that's exactly what they want, isn't it? So hopefully by now they've diverged even further from the truth.
That's like your gmail password being your address, oh and by the way you can never change it.
So, yeah; this is pretty bad.
It would have to be out of the Caribbean or some place with lax data privacy laws, and strict confidentiality laws.