Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy

It's Still Too Easy for Anyone to 'Become You' at Experian (krebsonsecurity.com) 36

Posted by EditorDavid from the identity-thieves dept.
An anonymous reader shared this report from security research Brian Krebs: In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hacked, and the only way I could recover access was by recreating the account...

The homepage said I needed to provide a Social Security number and mobile phone number, and that I'd soon receive a link that I should click to verify myself. The site claims that the phone number you provide will be used to help validate your identity. But it appears you could supply any phone number in the United States at this stage in the process, and Experian's website would not balk.
One user said they recreated their account this week — even though the phone number they'd input was a random number. "The only difference: it asked me FIVE questions about my personal history (last time it only asked three) before proclaiming, 'Welcome back, Pete!,' and granting full access," @PeteMayo wrote. "I feel silly saving my password for Experian; may as well just make a new account every time."

And Krebs points out that "Regardless, users can simply skip this step by selecting the option to 'Continue another way.'" Experian then asks for your full name, address, date of birth, Social Security number, email address and chosen password. After that, they require you to successfully answer between three to five multiple-choice security questions whose answers are very often based on public records. When I recreated my account this week, only two of the five questions pertained to my real information, and both of those questions concerned street addresses we've previously lived at — information that is just a Google search away...

Experian will send a message to the old email address tied to the account, saying certain aspects of the user profile have changed. But this message isn't a request seeking verification: It's just a notification from Experian that the account's user data has changed, and the original user is offered zero recourse here other than to a click a link to log in at Experian.com. And of course, a user who receives one of these notices will find that the credentials to their Experian account no longer work. Nor do their PIN or account recovery question, because those have been changed also. Your only option at this point is recreate your account at Experian and steal it back from the ID thieves!
Experian's security measures "are constantly evolving," insisted Experian spokesperson Scott Anderson — though Krebs remains unsatisfied. Anderson said all consumers have the option to activate a multi-factor authentication method that's requested each time they log in to their account. But what good is multi-factor authentication if someone can simply recreate your account with a new phone number and email address?
This discussion has been archived. No new comments can be posted.

It's Still Too Easy for Anyone to 'Become You' at Experian More

It's Still Too Easy for Anyone to 'Become You' at Experian

Comments Filter:

  • A good way to fix this issue with credit companies having this weird power over you is too not pay bills and so on. I have a bunch of bills from services not rendered. Such as ambulances who came to a minor car accident and did nothing, contractors who didn't finish the job and illegal fees and taxes my county created to cover miscellaneous overruns my taxes already paid for and to pad their buddies pockets.

    • A good way to fix this issue with credit companies having this weird power over you is to not pay bills and so on.

      How does this work, and why isn't your credit ruined by not paying bills you have chosen to dispute?

      It's not like any of us *chooses* or wants to actively do business with the likes of Experian.

      • I don't use credit or debt.

        • Re: (Score:3)

          by kmoser ( 1469707 )
          Even if you don't use credit, that doesn't stop an identity thief from hijacking your identity and using it to get (and abuse) credit, the responsibility for which will eventually land on your lap for you to deal with. The only way around this would be to not have an SSN at all. If you live in the US, good luck with that, since it all but precludes you from getting any kind of job.
          • Recently I submitted an article that made it to the front page [slashdot.org], and only afterwards did I put two and two together to realize why this news is a really big deal to focus my fellow slashdotters' attention on. It was like a Woosh that went over everyone including me at the time. I've even reconsidered re-doing the front-page weekend submission with a new version, but this reply seem as good a place as any to do the deed:

            Here's the scam, now that I understand better: North Korean agents set up shop in eithe
    • Do a credit freeze: https://en.wikipedia.org/wiki/... [wikipedia.org] I did this a long time ago. I think there is a fee which I think is fubar, but that is the way it is until our useless congress people do something about it.

      • Credit freeze is free in the US. There are bureau-specific alternatives to freezing that they may try to sell you on instead, but a credit freeze is free by law in all 50 states.

        It also wouldn’t help here. Someone would still be able to hijack your account at the bureau and then lift your freeze.

  • Liability is urgently needed (Score:3)

    by gweihir ( 88907 ) on Sunday November 12, 2023 @04:58AM (#63999331)

    Say, $500 to anybody that has their data stolen, as default, no court proceedings and no proof of damage needed. If more damage, tripple damages to be paid.

    Maybe that would make cretins like these pay some attention to security. As it is, nothing seems to happen even for having the most shoddy security imaginable.

  • Means “we only fix stuff after there’s a big enough problem to cause real trouble.

    At this point, I’ve concluded that the small criminal gangs engaging in this stuff are actually doing us a favor. Without them, companies and governments would engage in near-zero effort to improve their systems. Basically, they’re providing immune-system training services to our computational ecosystem.

    • Means “we only fix stuff after there’s a big enough problem to cause real trouble.

      Big enough to cause trouble equates to " We only care when the cost of a potential lawsuit exceeds the costs necessary to fix the problem. "

  • Corporate Personhood (Score:5, Insightful)

    by newslash.formatblows ( 2011678 ) on Sunday November 12, 2023 @10:58AM (#63999663)
    The whole idea of corporations being equal to (or greater than!) actual people needs to be overhauled. The "person" created is invariably a sociopath. Experian has absolutely no motivation to give a shit if they ruin your life or not. It will probably cost them under $5 per person in penalties, no matter what they do.

    • Experian should have gotten the corporate death penalty during their first breach. Unfortunately they do actually provide an important service. It is easy to complain about how much power they have, but nobody has figured out a better solution.

      I say this after my wife's credit score was decimated yesterday because a store's credit card issuer only allows direct payment after the second billing cycle, even if you have electronic statements. In this case it is the card issuer that is corrupt, not the credit b

  • Though I'm positive it actually provides no safety or security other than making me feel smarmy. I dug deep into the credit bureau pages and found the pdf form. I printed it out, and USPS snail mailed it in, and eventually after a bit of mail back and forth, all three bureaus sent me a free paper credit report. I've been doing it every couple of years since they began the free credit report laws in the U.S.

    Signing up, and submitting information over the net to get my 'free credit report' just sounded brok

  • So the issue is if a "bad actor" has your SS# and a passing knowledge of your history (former employers, residences,etc) they can "trick" the credit bureaus into sharing your private financial records, right?

    In other words, just a SS# along won't suffice...

    I mean, it's not great, but they have to start with your correct SS#, without your SS# they can't get anything on you, right?

    • Not likely. Take a look at Spokeo and the like and what you can dig up on someone with only their name and a vague idea where they live currently. That's all the answers to the "security" questions. It also narrows down the possibilities for the first 5 digits of their SSN to at most two dozen, all I need from there is to find the last 4 in one of the data-breach databases floating around out there. That's assuming their full SSN hasn't made it's way into one of those databases, if that's happened I don't e

Slashdot Top Deals

A computer scientist is someone who fixes things that aren't broken.

Close