News for hackers. Stuff that matters.
Re:Identity Thieves Bypassed Experian Security to View Credi... by sofixa on Monday January 09, 2023 @10:46AM (#34311592)
It's interesting seeing the American credit model malfunction so badly so often (massive data leaks, crappy gaming of the system - even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score).

As with a couple of other things, it's basically the only developed country with this model (useless for-profit middlemen for no good reason), it really sucks for the average consumer, yet there is no actual change coming. Why? Is it American exceptionalism refusing to acknowledge that there are better ways used elsewhere? Is it free market "absolutism" hoping the market will fix itself?

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @11:41AM (#34312331)
I disagree with the better ways used elsewhere, as a French citizen who has worked abroad all his life, I can barely get anything. When I came back to France for a year due to my father's health issue, it was difficult getting an apartment because I had proof of income for more than 3 years in France (the current income I was declaring of 150k usd a year working remotely from France didn't count). People in France who have a CDI (permanent contract) can easily get mortgages and everything but entrepreneurs, people on fixed term contracts, etc... have a very hard time getting anything.

With a US social security number that I got as a student and good management of my credit card accounts that I kept since, I have a good US credit score and can easily get a mortgage in the US. Of course, it's possible to game it, but you can also get a very decent score by just managing your finances well.

So from my perspective, I think the US system works much better. Does it have issues? Yes, there's data leaks, there is some gaming of the system (by the way, paying off the mortgage won't tank the credit score, it'll lower it yes by a few points, but that's mostly inconsequential)

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @12:09PM (#34312686)
“Working remotely from” means long term you’ll be paying taxes there. Which should be proof, and if not should be fixed. Having to wait a year or three is probably fine for a mortgage, no?
Re:Identity Thieves Bypassed Experian Security to View Credi... by giraffe_lady on Monday January 09, 2023 @01:17PM (#34313807)
French bureaucracy is infamous for a reason and it's not just the state itself. A CDI is a certain type of employment contract, and a CDI is a CDI and everything else isn't, and a CDI is required for almost any significant loan. Workarounds are possible for smaller loans IF you have a personal relationship with the bank officer servicing that area. But if you didn't grow up there, or don't normally bank there, or they're suspicious of your race or tattoos, or were your bully in high school or or or. This sort of thing is more or less exactly what the credit reporting setup was meant to eliminate.

It doesn't matter what it "should be" proof of or what a reasonable person could infer from this income or documentation of it. If you don't have a CDI, which even many full-time employed people don't, you're in a hard spot.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @04:57PM (#34316775)
Again, I don't see anything here that requires a third-party as intermediate. If you have a system broken in another way, go right ahead and fix that. But it is not sufficient justification for incredibly bad actors such as Experian et al to exist.
Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @06:14PM (#34317919)
That's the thing, based on my experience living in different countries like France as described above or in Japan for a few years (where I was systematically rejected for credit cards when my ex who was a student with significantly less income than me was approved), I find that having third parties as intermediate setup a reporting credit system with clear rules like the US is so much better.

The US system has issues but it's less broken than every other countries I've lived in.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @08:46PM (#34319260)
But what about the other 99% of us that aren't living internationally in multiple countries we have no history in?

The idea that everyone is forced to create a public profile so you have the option of getting a mortgage sucks. You have no right to a mortgage at other's expense. If you want folks to trust you, get a co-signer, put down roots and stay a while.

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @09:04PM (#34319401)
Ok, granted, living in different countries is not something that most people do, so let's talk about the other big advantage that a system with a credit score has. It protects against racism. If you don't have that, it's very easy for a bank officer to reject a mortgage because you're the wrong colour. You'll tell me there's law against discrimination but what often happens is people discriminates and then find other excuses to justify the rejection. Are you going to tell me that this isn't a problem?

Without a credit score that follows simple algorithmic rules, how do you want to prevent this from happening? A credit score that has rules that people know in advance may be gameable but it also creates fairness by making it easy for everyone to know what to do to get a decent score.

Now, the fact is that the credit score could be managed by government agencies (although honestly, I'm not sure any government is much better in term of data security), there could be stricter fines in case of data breach (that sounds like a good idea), but those are implementation details.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @09:16PM (#34319501)
Lofty goals but too many degrees of separation I'd say. Not my responsibility to fix the problems of society. I'd go farther and say ubiquitous credit is not a human right, to the extent to force its drawbacks on the rest of us.

That said, I'd agree that both of our plans could be implemented a lot better.

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @08:30PM (#34319123)
Yeah but having to wait a year or three (three actually because as someone working remotely, you're self employed and self employed always require 3 years salary for anything) during which 80% of apartments reject you because you don't fit the criteria of the "garantie loyer impayé" is more than frustrating. It's downright hostile. Getting a mortgage is a pipe dream...

Being a French national and not being able to get a mortgage to buy an apartment for my mum is also more than a little frustrating. And that's despite having quite a bit of money saved.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @08:49PM (#34319287)
You getting a mortgage is not a problem I'm willing to pay for with my privacy. (Not that I was given a choice.) Buying property here is a pipe dream, period.

I've rented apartments without credit by showing paycheck stubs and bank balance.

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @09:10PM (#34319445)
Also, I'm kind of confused, why do you think you'd have more privacy in other countries or with other systems? Even without credit scores, you still have credit cards, debit cards etc and all this can be tracked? There were massive data breach at places like Target, wouldn't you be impacted without credit scores and those 3 companies?

Outside of living off the grid, paying everything in cash, how do you want to have privacy about how you spend your money in this day and age?

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @09:23PM (#34319569)
Well, I'd say having a soon-to-be expired credit card transaction revealed here and there is a lot less worrisome than a single entity hoarding everything over my lifetime, combined with an utter disregard for security. They also sell it without knowledge and usually consent. At least CC processors have PCI standards right?

Bulk surveillance is a problem as well, but a big topic for another day.

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Tuesday January 10, 2023 @04:18AM (#34322291)
Having done PCI compliance audits and talked to QSAs who told me about pretty serious breach from a well known payment processor owned by Visa, I wouldn't put too much faith in the PCI compliance process when it comes to protecting my data.

I guess where we differ is that between banks having lousy security, social medias and search giants selling all our data, the cat is already out of the bag when it comes to privacy and won't be put back until law is updated to have teeth, so I see that as a separate problem (which does bother me) that's orthogonal to the 3 companies credit scoring system.

That doesn't mean that it shouldn't be solved, I believe Equifax, Experian and Transunion should be heavily fined for any breach of data especially considering how important the data they have.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mancerayder on Monday January 09, 2023 @02:07PM (#34314546)
> I disagree with the better ways used elsewhere, as a French citizen who has worked abroad all his life, I can barely get anything. When I came back to France for a year due to my father's health issue, it was difficult getting an apartment because I had proof of income for more than 3 years in France (the current income I was declaring of 150k usd a year working remotely from France didn't count). P

Do bank savings count for anything?

Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @06:10PM (#34317887)
I had 50k euros in a bank account, didn't help because I didn't fit into the criteria for the so called unpaid rent insurance ("garantie loyer impayé").
Re:Identity Thieves Bypassed Experian Security to View Credi... by jollyllama on Monday January 09, 2023 @10:52AM (#34311698)
It's not really malfunctioning, in my opinion. It's more or less designed to violate individual privacy and offer as many people access as efficiently as possible.

Neither free market absolutism nor exceptionalism are the reason that it's designed this way. At least, not in the way that I think you mean it. Rather, it's because the current economy of the USA is an inflationary credit economy. It's a very un-free market; a great example is education. The government subsidizes loans which drive up the price, and put people in debt so that they are more desperate to take jobs.

Re:Identity Thieves Bypassed Experian Security to View Credi... by melenaboija on Monday January 09, 2023 @11:23AM (#34312100)
It is operational malfunctioning:

- Data leakageS

- Prone to errors (see equifax coding error that happened on August[1])

And functional malfunctioning. I would say there are tons of things to say here but only the fact it is a for profit and under control of three companies is enough.

It is broken and IMHO also hard to fix.

[1] https://www.equifax.com/newsroom/all-news/-/story/equifax-st...

Re:Identity Thieves Bypassed Experian Security to View Credi... by lesuorac on Monday January 09, 2023 @11:30AM (#34312189)
I mean, a credit report is only useful if it actually tells me about _your_ credit worthiness.

Sure, some Elon Musk guy might have enough credit worthiness to make a $44 billion purchase. But are _you_ Elon Musk or just some guy impersonating Elon Musk? Fraud may not be rampant enough currently but if Experian/etc continue to help fraudsters it will just keep getting worse.

Re:Identity Thieves Bypassed Experian Security to View Credi... by tau255 on Monday January 09, 2023 @11:39AM (#34312311)
I find it kinda similar to:

-USA tax system where Turbofax created a niche for itself and fights hard to keep the system as convoluted as it can be to detriment of everyone

-USA healthcare insurance system where insurance companies do the same

Seems like best way to profit is to become a parasite that does not fix the problem but just defends the current situation.

Re:Identity Thieves Bypassed Experian Security to View Credi... by user3939382 on Monday January 09, 2023 @11:30AM (#34312208)
> Why? Is it American exceptionalism

Because our government is completely corrupt and doesn't represent the interests of the People, at all. It serves and is beholden to large corporate interests, chief among them banks and financial institutions. In a just system that represented our interests Equifax would be forbidden from compiling consumer data after what they did.

Re:Identity Thieves Bypassed Experian Security to View Credi... by seniorThrowaway on Monday January 09, 2023 @12:00PM (#34312575)
Exactly, and the best part is it is all out in the open but the majority of people either don't understand or don't care. The corporations openly write legislation via their lobbyists, huge bills that congress themselves don't even fully read let alone write. I've just about given up hope that this will ever change.
Re:Identity Thieves Bypassed Experian Security to View Credi... by user3939382 on Monday January 09, 2023 @12:35PM (#34313056)
The 2014 Princeton study https://doi.org/10.1017/S1537592714001595 highlighted https://i.imgur.com/eH6YcWn.png what a corrupt sham our "democracy" has become.
Re:Identity Thieves Bypassed Experian Security to View Credi... by ndsipa_pomu on Monday January 09, 2023 @10:59AM (#34311790)
There's a bunch of people making money from it and that usually takes precedence over whether it is fit for purpose in other ways.
Re:Identity Thieves Bypassed Experian Security to View Credi... by thinkmassive on Monday January 09, 2023 @11:17AM (#34312021)
Yep, think of credit score as a rating of how likely a debtor will be profitable to creditors over the long term.
Re:Identity Thieves Bypassed Experian Security to View Credi... by randommuser on Monday January 09, 2023 @11:22AM (#34312073)
Does anyone have good resources on what other non us countries do? Asking as an American curious/wanting to learn more.
Re:Identity Thieves Bypassed Experian Security to View Credi... by hungryforcodes on Monday January 09, 2023 @12:00PM (#34312580)
Google is your friend...
Re:Identity Thieves Bypassed Experian Security to View Credi... by worksonmine on Monday January 09, 2023 @01:05PM (#34313595)
I don't have any resources to share but in my country the bank looks at my income - expenses then checks if I've defaulted on any debts. My limited understanding of the US system is that everyone has (often several) credit cards to build the necessary credit score. Here owning a credit card is for people drowning in debt who struggle to pay bills on time or in rare cases new money flexing their amex black, which is also shunned upon.

I've always thought the US system was super weird and backwards forcing debt on people. We don't have credit cards from every big chain and don't get harassed into signing up for cards in the mall, it's just not a thing.

We have the same safeguards you have, but we prove it with sensible spending instead of getting debt just to prove that we can pay it in time.

Re:Identity Thieves Bypassed Experian Security to View Credi... by Nifty3929 on Monday January 09, 2023 @05:42PM (#34317485)
"looks at my income - expenses then checks if I've defaulted on any debts" - This is basically what we do in the US as well. But HOW do they do this in your country?

In the US, the loan originators look at year-end tax forms or recent pay stubs to verify income. They look at credit reports from e.g. Experian to verify defaults and other debt information.

Re:Identity Thieves Bypassed Experian Security to View Credi... by worksonmine on Monday January 09, 2023 @06:19PM (#34317974)
The paychecks are verified at the bank, probably tax as well. For the debts we have a government authority which is usually the last resort for creditors. This authority also takes care of getting your cash, selling belongings etc to pay off creditors.

This is all open data and can be verified with just a phone call to the tax office and debt authority. Some private aggregators exist for convenience but they're regulated in what they're allowed to share and for how long.

The private companies are also required to notify me anytime someone checks my score, the government agencies aren't.

Re:Identity Thieves Bypassed Experian Security to View Credi... by technion on Monday January 09, 2023 @03:42PM (#34315722)
Australian here. When I apply for rentals I just went to my online banking and took a screenshots of the deposits.

It's been years since I had my mortgage approved but I vaguely recall the process being very similar.

Re:Identity Thieves Bypassed Experian Security to View Credi... by jimbob45 on Monday January 09, 2023 @11:31AM (#34312212)
Are you able to offer a better system that is/was working in another developed country?
Re:Identity Thieves Bypassed Experian Security to View Credi... by sofixa on Monday January 09, 2023 @11:38AM (#34312298)
I can tell you about the system here in France - when you apply for a loan, the bank asks for some information (your salary, marriage status, kids, etc.) from you to see what you're capable of to spend monthly, and checks with the national bank what loans you have/had, and if you've defaulted on any of them. That's it, they don't need to know more, and the national bank doesn't keep track of everything, only very basic loan information (and of course they have no for profit motive), and nobody outside of a bank where you're applying for a loan uses this information to define your worthiness as a tenant or employee.
Re:Identity Thieves Bypassed Experian Security to View Credi... by aantix on Monday January 09, 2023 @11:53AM (#34312479)
But why not?

Failure of paying back a loan prior - why would I want them as a tenant?

If you had a friend that failed to pay back loans, would you want to make a future loan to them?

Re:Identity Thieves Bypassed Experian Security to View Credi... by toomuchtodo on Monday January 09, 2023 @02:49PM (#34315047)
Depends on the terms. People change, situations change. It's a big reason why finance firms in the US are attempting to move away from the three CRAs to cashflow underwriting; it turns out credit scores aren't a great forward looking proxy for repayment ability.
Re:Identity Thieves Bypassed Experian Security to View Credi... by nicolas_t on Monday January 09, 2023 @08:56PM (#34319330)
Well, French laws are heavily in favour of tenants so actually contrarily to the OP, it's not that easy to rent an apartment. I'm guessing the OP has a CDI (permanent contract), has a French family name and doesn't look Arab or Black. In those cases, yeah you can get a mortgage relatively easily, you can easily rent too.

But, 24.8% of people who are employed have those permanent contract. People who do not have that, have it much tougher. To get back to the example of renting, landlords in France are scared of renting to tenants who don't pay because it's hard to evict tenants, so they often use something called a "Garantie Loyer Impayé" which is an insurance backed by the government that will pay back any unpaid rent to the landlord. But if you don't have a permanent contract, it's hard to qualify for this. When I was searching for an apartment 7 years ago, 80% of apartments rejected me because I was working as a contractor (and what's worse my income was from another country since I was working remotely). They used that insurance and that means that I couldn't qualify.

So, yes, if you have a permanent contract in France, things are relatively easy but, even then, I have a friend who is black and worked as an electronic engineer with a permanent contract but still had a hard time securing a mortgage because, for some unknown strange reason, he got rejected a lot more than his white friends.

Credit systems with clear rules like the US may be gameable but they have the advantage of actually protecting against racism, of enabling people with non-standard profiles access to credit and of actually being relatively easy to follow.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mixmastamyk on Monday January 09, 2023 @11:02PM (#34320347)
Hmm, the US credit system might not be as effective at preventing racism as one might imagine. Hard to say without comprehensive numbers however.
Re:Identity Thieves Bypassed Experian Security to View Credi... by astura on Monday January 09, 2023 @10:56AM (#34311761)
>even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score

Only when it drops off your report, which is 10 years after you pay it off.

If you were so concerned about having a line of credit on your record then open up a credit card and don't use it, no reason to pay thousands of dollars in interest to avoid an abstract fear of "tanking your credit score."

>it really sucks for the average consumer, yet there is no actual change coming

I am an average consumer. The credit system is great for me! I'm able to demonstrate my responsibility and as a result I'm able to obtain a large amount of credit products at very low cost as well as pay less for insurance. I guess you can argue that the government should be providing this service rather than private companies or there should be more regulations around security, but the system only "really sucks" for people who take out loans and don't repay them.

Re:Identity Thieves Bypassed Experian Security to View Credi... by hedora on Monday January 09, 2023 @11:12AM (#34311958)
Funny story:

Rocket mortgage fraudulantly tanked our credit score and refused to fix it. The other bank's underwriting department looked at it, shrugged, and honored the mortgage office's request for an override to give us the best available rate.

IMO, Credit ratings are theater.

Re:Identity Thieves Bypassed Experian Security to View Credi... by mrguyorama on Monday January 09, 2023 @03:36PM (#34315635)
I had $60k in the bank and was paying $12k down on a used car that cost $28k and would be worth $30k the second I had the keys (the dealership seemed to low ball it a little, probably because they were a new volvo dealership with one GTI on the lot they had for like a couple months that they needed to get rid of), but no, they still needed to check my credit, which at the time did not exist, and still required me to sign up to $2k interest payments over a 5 year loan that would have been more profitable if I never paid a cent and they could reposes the collateral.

I know there are contrived ways I could have killed the value of the vehicle before the loan was done and they couldn't recoup it, but like, come on. My credit report was BLANK. It was never needed in the first place.

Re:Identity Thieves Bypassed Experian Security to View Credi... by toast0 on Monday January 09, 2023 @11:21AM (#34312071)
> Only when it drops off your report, which is 10 years after you pay it off.

I haven't seen what happens at 10 years, but there's definitely an effect after about a year; mine dropped 50 points, which isn't really tanking, but could switch you into a different risk category depending on where you started. Finishing up my car payments didn't help either.

Re:Identity Thieves Bypassed Experian Security to View Credi... by staringback on Monday January 09, 2023 @11:23AM (#34312092)
Credit Karma isn't a real score.
Re:Identity Thieves Bypassed Experian Security to View Credi... by toast0 on Monday January 09, 2023 @11:28AM (#34312171)
Who said anything about them? This is on scores reported in my online banking.
Re:Identity Thieves Bypassed Experian Security to View Credi... by staringback on Monday January 09, 2023 @01:05PM (#34313585)
Then your online banking is using the same fake score as Credit Karma (usually called VantageScore or something like that)

If you actually want to get the score that lenders use, experian.com will give you your FICO 8 score. This score considers all accounts open the same until they have been closed for 10 years.

Re:Identity Thieves Bypassed Experian Security to View Credi... by toast0 on Monday January 09, 2023 @01:51PM (#34314331)
One of my banks says:

> The FICO® Score pulled on [date] is the FICO® Score 8 based on Experian data, and is the same score that [name of institution] uses, along with other information, to manage your account.

Another says:

> The score provided here is FICO® Score 8, which is based on TransUnion® data and may differ from other FICO® Scores. Variations may also occur when your score is based on data from another consumer reporting agency or calculated at a different time. [name of institution] and other lenders may use different scores and other information in credit decisions.

I'm not going to intentionally interact with Experian directly, unless I have to, so not going to compare there. From what I recall, when I last opened a loan and they disclosed the scores, they were within spitting distance of what I was seeing from my banks at the time.

Now maybe FICO 8 score means something different than FICO Score 8; these guys like to be deceiving, and maybe some banks give the VantageScore, but mine seem to give a FICO Score 8.

Re:Identity Thieves Bypassed Experian Security to View Credi... by barbecue_sauce on Monday January 09, 2023 @11:13AM (#34311974)
Why do you consider yourself an average consumer?
Re:Identity Thieves Bypassed Experian Security to View Credi... by runarberg on Monday January 09, 2023 @11:26AM (#34312136)
I would love to see some data about this but it wouldn’t surprise me if many USA residents don’t have a credit score at all, or if they do, it is very minimal. Given how many are underbanked, I wouldn’t be surprised if the average credit score is heavily skewed by the people gaming it.

Anecdotally, neither me nor my partner have a credit score. I know several people where I’m living that are permanent renters/get owner financed loans, buy used cars with cash (or are simply given old cars, or don’t have a car at all).

I did a superficial search and found some census data (https://www.census.gov/data/datasets/time-series/demo/cps/cp...) but I have no idea how to read it.

Edit: Looks like my suspicions have some merit:

> 22% of Americans do not have a credit score. Half of this percentage has a stale credit score that makes it impossible to generate a valid FICO score while the other half do not have any credit file with any of the three credit bureaus—Equifax, Experian, and TransUnion.

> 18% of Americans have credit scores that fall in the 580-669 range of “fair.” those in the fair range are considered sub-prime and have lower chances of qualifying for a loan or getting better interest rates.

https://comparecamp.com/credit-score-statistics/

Re:Identity Thieves Bypassed Experian Security to View Credi... by icedchai on Monday January 09, 2023 @12:08PM (#34312669)
Paying off your mortgage won't "tank" your score.

I paid off my mortgage almost 15 years ago. I have zero debt, no car loans or anything, and pay off my credit cards in full every month. My credit lines are barely utilized (single digit percentage.) My score seems to vary from 790 to 810.

Re:Identity Thieves Bypassed Experian Security to View Credi... by SoftTalker on Monday January 09, 2023 @01:06PM (#34313603)
Using credit cards and paying them off is keeping ytour score up.

If you have no debt and pay cash as you go for your expenses, you will eventually drop because the credit bureaus will have no recent data to compute a score.

Re:Identity Thieves Bypassed Experian Security to View Credi... by runarberg on Monday January 09, 2023 @01:31PM (#34314056)
I posted on my sibling that 22% of Americans have no credit and of the ones that do have credit, 18% have a subpar credit score. That sums up to over a third of Americans that the credit system is either working poorly or not working at all.

Maybe you are indeed an “average consumer” (whatever that means) but if you are, then the credit system is heavily skewed in your favor, with many “non-average consumers” falling by the wayside.

Re:Identity Thieves Bypassed Experian Security to View Credi... by ufmace on Monday January 09, 2023 @02:53PM (#34315107)
We should remember the reason why it was created - to replace decisions for approvals on loans, mortgages, apartment rentals etc being made by low-level individuals for a variety of arbitrary reasons. Many places made such decisions based on personal connections, class, race, and other such things. AFAIK most other places still use such systems. Replacing that with a system where everybody's worthiness and terms for such things is determined algorithmically based on numeric data is a great move towards equality.