When I checked this year, 2 out of the 3 major CRAs in my country (Equifax, Experian) had:
- An incorrect flag saying I was not registered to vote, and a note saying this significantly affected my credit rating.
- A bogus address that didn't correspond to any physical location. Nor did it correspond with any address used by any business, that I know of. (If it does, they won't be able to mail me!)
- Three credit application searches (hard searches) in 3 days, for applications I didn't make. (I complained to the relevant company, who agreed they were added due to software errors on their side, and "resolved" the complaint by agreeing to remove them; but in the end they didn't remove them, so my history has unremovable entries for applications I've never made.)
- An account with the largest telecoms provider (BT) in the country that I didn't have (I'd left them 2 years earlier, account fully closed and settled).
- Fictitious monthly entries on the above account showing new amounts being added each month, of seemingly random amounts (no obvious pattern), and flagged as severe, overdue, late payer etc. Not a good look on a credit record, and entirely fictitious. (Fixing this proved arduous, and I ended up having to use three companies in a daisy-chain of each one passing along a formal complaint to the next. I later learned from BT customer support that BT does this to other former customers without their knowledge as well, so for ethical reasons if I can muster the energy I'll be complaining about this to the government regulator)
I could say so much more about the complaints process, terrible customer service in every conceivable way from Equifax specifically, and more, but it would be rather off-topic.
Remarkably, just complaining about the above caused the errors to be acknowledged and correct data found magically by the companies involved, without me needing to provide replacement data. It's as if the companies involved had all the data they needed already, they just aren't using it until a customer finds out and complains.
The only thing definitely wrong on mine is it lists an address that I've never lived at (and there is actually a decent reason for this mistake [1]). I looked at getting it fixed, but it looked like that would be a bit of a hassle, so I haven't bothered. I just have to remember if some site does one of those "which of these 5 address did you once live at?" kinds of test as part of identity verification, I need to pick that wrong address if it shows up.
[1]. (Names and addresses made up) A single women, Ms. Johnson, owned and lived in a house at 567 Fake Street. At some point, Ms. Johnson married Mr. Brown, and they lived together at 567 Fake Street as Mr. and Mrs. Brown. At some point another Mr. Brown, no relation to the Browns at 567 Fake Street, bought and moved into 527 Fake Street.
The Browns at 567 decided to move, and submitted a change of address form to the USPS. Someone processing that at the post office noticed that 567 was listed in their records as belonging to Ms. Johnson, but that there was a Brown at 527, and apparently concluded that it was probably the Brown at 527 who was moving and that he had just botched the address on the form, and so they processed this as a change of address for 527 Brown. Credit reporting agencies get change of address data, so they picked it up too.
AT&T is currently doing the same thing BT did to you. I closed my account and shipped back hardware a year ago. Since then, they have been reporting either a bill with a random number from $100-3,000 or 0, and being either on time or late or none. It's maddening.
I'll described what I had to do to fix the BT nonsense, in case it's useful for your AT&T problem.
To fix the BT nonsense (after I'd done tedious detective work to figure out which company it was, as it was under a company name I didn't recognise), I was lucky to get a good BT customer service agent, who explained that they could see it was BT, that it happened to other people as well, and the BT Equifax-handling department would fix it as soon as they looked at it, but that department wouldn't fix it on my request. To fix it I needed to complain to Equifax myself as a data correction. Equifax could not change data, since it merely aggregates data supplied by other companies and is not responsible for the data, but it would contact the BT Equifax-handling department, who would make the correction and submit it back to Equifax. In the end getting Equifax to process a data correction complaint was excessively difficult, slow and intrusive (requiring various documents I didn't care to send them), and I found a third company who magically made Equifax process the complaint in days rather than months; it went all the way along the chain to BT and back, and was magically fixed.
Without very careful system design, that itself could be used to corrupt data.
Suppose a thousand obviously fake accounts are made and use the phrase "giraffe-eater" (to coin something random-looking) in messages.
If the system is designed as a fancy nonlinear regressor, then it doesn't have to obey causality -- observing P("giraffe-eater"|fake) = 100% will increase the modeled prediction of P(fake|"giraffe-eater").
Worse yet, if the system is in fact being built in a non-interpretable way (throwing everything into a random forest or deep neural network), then it will be impossible to prove anything about how the system makes its judgement. Ultimately, these models are at risk from anti-discrimination statutes if (for example) they can key on use of dialect or other protected-ground-correlates.
What is stopping these actors from doing just that?
I have wondered about this for long time and I'm just curious. If the whole 'terrorism threat' thing is real, we would see counter-actions like this done by terrorism sponsoring organizations or states. No?
I.e. if an organization fighting for free speech would create software generating false personas who create false messages, and other events, would they know any better?
For example, it wouldn't be too hard to generate hundreds if not thousands of fake Facebook, Instragram, Airbnb, Coinbase, Uber, Gmail, Amazon, etc. accounts doing "stupid things". Like ordering stuff and canecelling orders right away. Like generating fake emails en masse with "trigger words" in millions a day. Like creating fake posts on Facebook warning of fake incidents like "15% of Uber drivers have serious mental issues".
The whole thing could be scripted and run on bots worldwide in millions. After some time, serious chunk of internet traffic would be fake. How would these companies know any better?