crossocal.blogg.se

• EXPERIAN CREDIT FREEZE LOST PIN PASSWORD

I published a detailed Q&A a few days ago about why this is so important and how you can do it. While this service is disappointing, I stand by my recommendation that everyone should place a freeze on their credit files. I addressed some of these issues - as well as other abuses by the credit reporting bureaus - in the second half of a long story published Wednesday evening.Įxperian has not yet responded to requests for comment. This is yet another example of how someone or some entity other than the credit bureaus needs to be in put in charge of rethinking and rebuilding the process by which consumers apply for and manage credit freezes. However, the information should be sent via snail mail to the address on the credit record, not via email to any old email address. This is human nature, and the bureaus should absolutely have a reliable process to recover this PIN. I understand if people who place freezes on their credit files are prone to misplacing the PIN provided by the bureaus that is needed to unlock or thaw a freeze.

Here’s a sample of the KBA questions the site asked one reader:Įxperian will display the freeze PIN on its site, and offer to send it to an email address of your choice.

More than a dozen readers responded in just a few minutes, and most of them reported success at retrieving their PINs on the site and via email after answering the KBA questions. However, I also asked my followers on Twitter who have freezes in place at Experian to test it themselves. That’s fine and as far as I’m concerned the way it should be. That is why this offering from Experian completely undermines the entire point of placing a freeze.Īfter discovering this portal at Experian, I tried to get my PIN, but the system failed and told me to submit the request via mail. In short: Crooks and identity thieves broadly have access to the data needed to reliably answer KBA questions on most consumers.

EXPERIAN CREDIT FREEZE LOST PIN PASSWORD

Equifax says crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering KBA questions about those employees. Weaver came in a story from May 2017 which looked at how identity thieves were able to steal financial and personal data for over a year from TALX, an Equifax subsidiary that provides online payroll, HR and tax services. “Whenever I’m faced with KBA-type questions I find that database tools like Spokeo, Zillow, etc are my friend because they are more likely to know the answers for me than I am,” said Nicholas Weaver, a senior researcher in networking and security for the International Computer Science Institute (ICSI). What’s more, many of the companies that provide and resell these types of KBA challenge/response questions have been hacked in the past by criminals that run their own identity theft services.

As I have noted in countless stories published here previously, the problem with relying on KBA questions to authenticate consumers online is that so much of the information needed to successfully guess the answers to those multiple-choice questions is now indexed or exposed by search engines, social networks and third-party services online - both criminal and commercial. The final authorization check is that Experian asks you to answer four so-called “knowledge-based authentication” or KBA questions. I’m certain this warning would deter all but the bravest of identity thieves! The first hurdle for instantly revealing anyone’s freeze PIN is to provide the person’s name, address, date of birth and Social Security number (all data that has been jeopardized in breaches 100 times over - including in the recent Equifax breach - and that is broadly for sale in the cybercrime underground).Īfter that, one just needs to input an email address to receive the PIN and swear that the information is true and belongs to the submitter. Experian’s page for retrieving someone’s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.