Slashdot Mirror

← Back to Stories (view on slashdot.org)

Experian Sold Social Security Numbers To ID Theft Service

Posted by Unknown on from the you-can-totally-trust-us dept.

realized writes "Experian — one of the three national U.S. credit bureaus — reportedly sold SSNs through its subsidiary, Court Ventures, to the operators of SuperGet.info who then offered all of the information online for a price. The website would advertise having '99% to 100% of all USA' in their database on websites frequented by carders. Hieu Minh Ngo, the website owner, was recently been indicted for 15-counts filed under seal in November 2012, charging him with conspiracy to commit wire fraud, substantive wire fraud, conspiracy to commit identity fraud, substantive identity fraud, aggravated identity theft, conspiracy to commit access device fraud, and substantive access device fraud."

86 of 390 comments (clear)

  1. Probably a downmod coming but.. by Anonymous Coward · · Score: 5, Insightful

    WHAT THE FUCK!!!?!!!?

  2. Since you mentioned Experian by Anonymous Coward · · Score: 4, Insightful

    These are the same people who offer to counsel you for $15, with a made-up number (even more made up than FICO) with fine print like this: "your Experian Credit Score indicates your relative credit risk level for educational purposes and is not the score used by lenders". Yep, super class act all the way. Even among credit rating scams, er "agencies", they are the worst.

    1. Re:Since you mentioned Experian by Anonymous Coward · · Score: 5, Informative

      You have no idea what you're talking about. Indeed, the FICO score is strictly a model from the Fair Isaac Corporation. However, that model is licensed out to the major credit bureaus, and they will indeed provide you a FICO score. However, any FICO score is only as good as the information it's based on. Since all three credit bureaus can happen to have different info on you, you can have a different FICO score with each of them. That's why all the ads you see talk about checking your three FICO scores - the algorithm is the same in all cases, it's just coming up with different results due to different inputs.

      Now as to what the GP was saying, Experian has it's own, non-FICO score too, that they'll sell you (in addition to selling you a FICO score, should you pay for that), for a price. That's the "even more made up" number the GP is referring to, which has the name VantageScore. It's not your FICO score, and due to the less licensing and federal regulation surrounding it, costs less. However, the GP is wrong in sticking this with Experian - all three major bureaus jointly use VantageScore.

      And lastly, folks pulling credit history that aren't making a direct loan (ex: insurers), usually don't pull a FICO score, since it's expensive, relatively speaking, but will pull yet another number made up by the three bureaus (what it is depends on what you're looking to insure - they have separate scores for auto and homeowner's insurance). All of this has made the FICO score itself much less important than it used to be. It's still the gold standard for big, big ticket items, where a mortgage company has no problem spending the $ to get the FICO score from all three bureaus to insure their hundreds of thousands of lending to you.

    2. Re:Since you mentioned Experian by ShanghaiBill · · Score: 3, Interesting

      They can't use FICO because it's owned by a third party (Fair Isaac)

      Wrong. They can and do give out FICO numbers. They just don't give it out to you, as an individual, when you pay $7 for your "credit score", because they don't want to pay a fee to Fair Isaac. Instead they give you a number that is just meaningless garbage. 99% of the people paying the $7 think they are are going to get their actual FICO score. I fell for this scam myself.

    3. Re:Since you mentioned Experian by atom1c · · Score: 2

      Anonymous Coward, nobody cares what Dave Ramsey says. You are both a creditor and a debtor whenever you work or lend or borrow something from anyone. Why work? Because, unless you get paid upfront, you're actually hoping that your employer makes good on your next paycheck. Ever borrow something from a neighbor, classmate, or colleague? Well, that makes you a debtor until you make good by returning the favor.

      If you think an arbitrary credit score matters, then how do you react to medical health assessment scores? Or even your annual physical? They are just numbers with limited real-world significance (unless you're living in the wrong world).

  3. And when will Experian be charged? by Anonymous Coward · · Score: 5, Insightful

    The US Credit system is a racket designed to screw people. I have been fighting a bogus charge on my credit report for years and I would love to see the power that these behemoths lowered.

    Granted, I do not know of a superior way to track people, but the amount of destruction caused by identity theft or improper billing is insane.

    1. Re:And when will Experian be charged? by Solarhands · · Score: 4, Informative

      Move to California. In California the burden of proof is on them if you dispute something.

    2. Re:And when will Experian be charged? by bradley13 · · Score: 4, Insightful

      "Granted, I do not know of a superior way to track people"

      How about this for an idea: don't track them.

      Let's be real: These credit reporting agencies bring zero added value to the system. If you want a loan, go to the bank, show them certified copies of your pay statements, sign a legal document listing your other debts (or whatever other information the bank needs for a decision), and that ought to be it. There is zero need for anyone to know that you were three days late on a credit card payment in March of 2007.

      These agencies are a blight. They are in the same category as Facebook: you are not the customer, your personal data is a product that they sell to anyone that will pay for it.

      --
      Enjoy life! This is not a dress rehearsal.
    3. Re:And when will Experian be charged? by Anonymous Coward · · Score: 5, Funny

      The first good reason I've heard to move to California. It's like saying "move to North Korea, Experian doesn't operate in North Korea."

    4. Re:And when will Experian be charged? by Anonymous Coward · · Score: 3, Insightful

      I have no problem with the service they provide, I only have a problem with the mechanism they use to provide it. We need a law that radically limits the usage of people's SSN. It is a government identification number and, as such, needs to be restricted to purposes that involve the government. If a company needs to deal with the IRS, Medicare, or any other government entity, they can and should use SSN for that purpose only. A private credit transaction does not involve the government, so using an SSN as an identifier in that transaction should be illegal. If Experian, TransUnion and Equifax want a unique identifier, they can create one themselves. If banks want to trust these services to determine credit eligibility, they can require that ID number rather than a SSN. It should be up to those businesses to de-dupe identities (without using SSN) when people apply for a new identification number.

      And that's the kicker...de-duping identification is a hard problem, but one that's necessary for the business model of the reporting agencies. So, rather than solve the hard problem, they've pushed the responsibility onto the government since it does it anyways. The government needs to tell these companies that it's not okay for them to do this and that they need to solve the hard problem themselves.

      Once you limit the use of SSN, it becomes significantly less valuable. Sure, it can be used in schemes to defraud the government or seek employment illegally, so there will be some use for criminals, but it's utility for identity theft will be drastically reduced.

    5. Re:And when will Experian be charged? by asmkm22 · · Score: 2

      The industry is broken, that's for sure. But your proposed solution would only lead to the same problem. If a bank loaned money out like that, you know they'd keep track of who pays on time and who doesn't (or at all). You'd still end up in a database with a record showing how trustworthy you are when it comes to paying back loans. At first, that might allow you to just go to different banks since the databases wouldn't be shared, and get loans despite having a poor repayment record, but eventually (as in, within a few months) banks would begin to share this data with each other in order to minimize their risks.

      And of course, a third party would have to step in and offer to manage the whole process as a neutral party, basically resulting in new credit rating agencies.

      The problem isn't that lenders shouldn't be able to use past information when deciding who to lend to. The problem is that debt collection agencies have no incentive to finding out if you are actually the right person or not, and if the debt was even valid in the first place. They just buy up a bunch of debt and anything that doesn't get collected (for whatever reason) is lost income for them. Dealing with those people can be a real nightmare because between them and the credit agencies, it's very much a 'guilty until proven innocent' kind of system. That's what needs to change.

    6. Re:And when will Experian be charged? by Cro+Magnon · · Score: 3, Insightful

      That's actually a decent reason to move to NK.

      --
      Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
  4. Who watches the watchers? by gstoddart · · Score: 5, Insightful

    So if the credit bureau is selling all of the information to the identify thieves you're pretty much fucked.

    Sounds like this company is playing both ends against the middle and needs to be shutdown.

    Pathetic.

    --
    Lost at C:>. Found at C.
    1. Re:Who watches the watchers? by Bob+the+Super+Hamste · · Score: 5, Insightful

      Wasn't there some law that stated that when data breaches like this happen the company has to pay for credit monitoring for those affected. Given that it sounds like they may have distributed all US citizens' info it might be enough to sink their company. Then again I may only be remembering some proposed law that died a quiet death in some committee.

      --
      Time to offend someone
    2. Re:Who watches the watchers? by Ronin+Developer · · Score: 3

      How about we make Experian liable for clearing ANY AND ALL debt incurred whose credit info was divulged by them?

      Once upon a time, the SSN was to be used for Social Security Purposes only - not for ID. Then, they started asked asking for it in college (as my ID) ... now, they ask for it at the local grocery store. Seems the law was changed. Why?

      At one point, when someone wrote a letter (remember those?) in the 1980's to a service member, they gave the name, rank, SSN and Fleet or APO post office number. In retrospect...WTF where they thinking? Prior to that, a service number was issued and it was NOT your SSN.

  5. And no one at experian will ever be charged. by Anonymous Coward · · Score: 5, Insightful

    Even though Experian was selling the info, only the people who bought it will get punished.

    1. Re:And no one at experian will ever be charged. by mcgrew · · Score: 2

      and that presumably, there is a separate argument to be made for Experian having the right to ever sell the information at all.

      And what, pray tell, would that argument be? I can see nothing whatever society gains by letting Experian sell what they do not own.

      --
      Free Martian Whores!
    2. Re:And no one at experian will ever be charged. by Jason+Levine · · Score: 5, Informative

      Sadly, the people whose identity was stolen will also be punished by having to spend time, energy, and money restoring their credit files and getting the bogus accounts removed. In some cases they will have to prove that they really didn't open the lines of credit to Experian - the very company who is responsible for the mess they are in. They will also need to watch their credit closely for the rest of their lives wondering when the next line of credit will open up or deal with the hassle of freezing their credit and not being able to open new lines of credit when they want. (Though, as an ID theft victim who did the latter, it's really not that much of a pain. Just stinks that it is necessary.)

      Experian, on the other hand, will face a vicious finger wagging by Congress. At the very worst. Maybe a token fine that they can make back in 2.3 seconds of doing their normal business.

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    3. Re:And no one at experian will ever be charged. by Anonymous Coward · · Score: 2, Informative

      Read the article - it wasn't Experian selling the info.

      As stated also in the summary, it was a company called Court Ventures, although what the summary doesn't say is that although Court Ventures is currently a subsidiary of Experian, it was already illegally selling this information before it was aquired by Experian, and also that the Secret Service contacted Experian about it after the aquisition.

      It also should be noted that the information itself did not originate from Experian, but from US Info Search, and that the information is apparently aggregated from public sources (i.e. court records, driver records etc)

      They were allowed to sell the information to US companies for ID checking and theft prevention, just not to foreign companies, and not to companies using it for other purposes.

      I don't entirely like what Experian do, but I don't really think they're the bad guys here.

    4. Re:And no one at experian will ever be charged. by PraiseBob · · Score: 4, Insightful

      an argument exists that Experian would not have had any way of realizing the nature of who they were selling it to

      Excuse me? You are saying there is a valid argument that they have no way of knowing whom they are doing business with?

      They have permanently compromised a system that hundreds of millions of people use every single day. They have made every single citizen subject to fraud, and have no ability to fix it, except conveniently through their business model. This breach will STILL be an issue ruining people's lives 20 years from now, and we will have to beg Experian to correct the problems they caused, and even pay them for the privilege. The economic damage could reach well into the trillions of dollars, there is virtually no cap, since it undermines the entire credit system of every citizen currently alive, for their entire lifetime. Every executive at the company should be put to a firing squad.

    5. Re:And no one at experian will ever be charged. by Sarten-X · · Score: 2

      Ah, but they do own it. See, when you signed that loan agreement, or contracted for utilities, or had that background check for that job, you signed an agreement that your Social Security Number could be given to a "third party" for the fulfillment of the credit or background check, and that the third party could then use it according to its own policies. Those policies you never saw but agreed to anyway likely remove all restriction on what can be done with your SSN.

      --
      You do not have a moral or legal right to do absolutely anything you want.
  6. Start the bombing now! by Theophile · · Score: 5, Funny

    I'm an American, so I'll admit that I couldn't find Experia on a map if I tried, but this is an outrage and I say we start bombing the Experians back to the stone age right now!

    1. Re:Start the bombing now! by UnknowingFool · · Score: 2

      What's sad that this is true most of the time. My friend was interviewing someone (college graduate education) for her company. My friend mentioned that she was in New Zealand earlier this year. The interviewee asked where in Europe New Zealand was located.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    2. Re:Start the bombing now! by freeze128 · · Score: 5, Funny

      Well....? Don't keep us all on the edge of our seats! Where in Europe is it?

    3. Re:Start the bombing now! by NeverVotedBush · · Score: 2

      It's just east of the country of New Mexico...

  7. 15 counts of wire fraud explained. by nimbius · · Score: 3, Insightful

    If convicted in an american court those 15 counts amount to:
    10 years in prison, appealed to 7
    parole after 4

    and experian leaving the room without ever having admitted any wrongdoing. Visa and Mastercard dont care, because the amount of credit as a balance reflected on a card is imaginary anyhow and doesnt correlate to any real value. They simply issue chargebacks against the vendors affected by fraudulent purchases.
    the vendors in turn get a strike against them for accepting fraudulent transactions. cardholders get a new card, and the game resets. Consumer capitalism cannot be permitted to short-circuit at the expense of the consumer.

    The cards are commonly used to purchase web hosting or secure free trials to distribute malware as a means of garnering more legitimate cards and absolving their dependence on lucky ducks like the Experian guy. The wheel is still turning.

    --
    Good people go to bed earlier.
    1. Re:15 counts of wire fraud explained. by I'm+New+Around+Here · · Score: 5, Insightful

      And my understanding is that once the card is opened, it's now on the consumer to dispute everything about the card,

      I never understood that line of thought. If someone, e.g. a bank, says I owe them money because I agreed to repay them money they loaned to someone who claimed to be me, my first question would be "Where is the paper I signed?". If the contract was made at a branch of the bank, such as for a loan, my next question would be "Where is the video footage of me at that bank?".

      Because if they don't have those two items, and they indisputably prove it is me, they have absolutely no case to try to extort money from me. They can go after the actual person they gave money or credit to. Why should it not be that way for all cases of so-called "identity theft"? It used to be called "bank fraud", which firmly shows the bank is the victim of fraud, and should have been more diligent in its actions. Instead they now imply the party who should have been more pro-active is the person whose name was used without their knowledge.

      Stop calling it ID theft, call it bank fraud, and tell the banks they can get their money from whomever they decided to give it to.

      --
      If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
    2. Re:15 counts of wire fraud explained. by Bob+the+Super+Hamste · · Score: 5, Interesting

      That actually happened to my wife. She got a call from American Express stating that we were in default on a card she had taken out and bills were being sent to an address in Las Vegas. They demanded that we pay in the most aggressive legal way they could. I told them that it isn't my fault that they didn't do their due diligence in giving out credit and that since it was a credit card we were only liable for up to $50 of it and I wasn't going to even pay that since neither of us had ever been in Nevada let alone Las Vegas. I then mentioned that if I ever heard from them again I would be filing charges against them for attempting to defraud me and would also be filing a complaint with my state's attorney general. Never heard back from them. I do the same thing with the idiots who keep buying someone's bad college loan debt that was accrued 14 years before I was born who happens to share my name. Some new company seems to buy it every 2-3 years and then they start calling or sending mail so I don't know if it is a scam or not but I treat it as if it were one.

      --
      Time to offend someone
    3. Re:15 counts of wire fraud explained. by onyxruby · · Score: 2

      Okay, your not helping yourself or anyone else like you think you are. I'm not writing this response for you personally, I'm writing it before other people follow your advice and get themselves in legal trouble.

      You have rights if your a fraud victim and you should exercise them, which you haven't done. In order to protect yourself and your credit rating you have to file a fraud complaint and send it to the and credit agency and company.

      If you don't do that the company can continue to report against your credit report and you can be sued by the company in the jurisdiction that they have on file and get a judgment against you. Without a fraud dispute the company has no way of knowing your right address and the fraudulent address will be used for the jurisdiction you are sued under. Once a judgment is issued against someone you can have your wages garnished, credit ruined, tax refunds seized and property sold at auction.

      You'll have hell to get an judgment overturned that was issued in another jurisdiction and than your in a position of explaining why you couldn't be bothered to write a simple affidavit and mail it in. Someone following your advice could well get a judgment against them that they couldn't get rid of - even after proving they didn't take it out. With a lot of jurisdictions allowing people to be arrested in order to enforce payment of judgments your advice could well put someone in jail.

      * Before I worked in IT I made a living performing large balance credit card fraud investigations ($5000+). I was the one of two people in a well known company that would track down situations like yours. Please stop giving legal advice when you haven't got the slightest clue what your talking about.

  8. Re:And, who has the Obamacare ID validation contra by Anonymous Coward · · Score: 5, Insightful

    Oh god, is Slashdot now The Blaze, where everyone has Obama Derangement Syndrome and every single comment has to tie to Obama, no matter how loosely related they are?

  9. Why is SSN secret? by bigwheel · · Score: 4, Interesting

    I never understood why social security numbers have become secret. It was my student ID both in undergrad and grad school. Available to everyone. Once upon a time, you were even supposed to keep your social security card in your wallet. Now it needs to be kept secret, along with my mother's maiden name.

    It is just a has code -- not a password.

    1. Re:Why is SSN secret? by ComfortablyAmbiguous · · Score: 5, Interesting

      Besides that, it's a horrible, horrible secret. Until just a few years ago the first five digits could be easily determined from your birthday and location of birth, leaving only 4 digits of somewhat randomness, and even that went in sequential order, giving you a pretty good guess at a much small range. To add insult to injury, whenever a company thinks they are helping you keep it secret they will ask you for the last four digits of the number, the only four digits that actually matter.

    2. Re:Why is SSN secret? by thaylin · · Score: 3, Interesting

      because with your SSN now you have access to EVERY other piece of information. Forget your password with any company that has your SSN and they will use your SSN as the ultimate password.

      --
      When you cant win, ad hominem.
    3. Re:Why is SSN secret? by Anonymous Coward · · Score: 5, Insightful

      And how do you keep your mothers maiden name a secret?
      Do you kill her and her parents and wipe out all traces of them?
      Why do they use stupid shit like this to identify someone.

    4. Re:Why is SSN secret? by Jason+Levine · · Score: 3, Informative

      Not that mother's maiden name is any protection. When someone opened a credit card in my name, they had my name, address, social security number, and date of birth. They got the mother's maiden name wrong, though. It wasn't even close. Didn't stop Capital One from approving the card application, though, and almost giving the people a line of credit in my name. (The only thing that stopped them was a fluke where they paid for rush delivery of the card and immediately changed the address from mine to theirs. The two processes crossed paths and the card arrived on my doorstep. Had it worked as intended, they would have gotten the card and run up a huge bill under my name.)

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    5. Re:Why is SSN secret? by unrtst · · Score: 2

      It's very similar with credit card numbers, especially bank account ones. The first 6 digits idenfity the issuer. The last digit is just a check digit (usually via Luhn algorithm). That leaves 9 digits for the user account for most cards. However, many banks use a heirarchal system that identifies the branch where you got the card in the first 4 digits of that. The last 4 digits (3 account digits + checksum) and the expiration are usually printed on reciepts and such, as is the type of card (visa/mastercard/etc). If you know a little about the person, you can guess their branch, which leaves only 2 digits unknown. Along with the checksum, you can deduce those, or at least narrow it down to a couple possibiities.

      Guessing the branch might seem difficult. However, the college I went to, and I assume many others, has a bank offer to sign up all freshmen for free checking accounts with a debit card. All those signing up with get the same first 10 digits (possibly 11 or 12). It leaves very little to guesswork.

      FWIW, I'm not sure if the aforementioned practices are current. Maybe they do things differently now. Regardless, the last 4 digits are the most significant and specific digits, just as with the SSN. Hiding the leading digits provides a false sense of security to the end users (there is still some security added, but nowhere near what the average person would assume), and it retains the most unique parts so the company using it still benefits almost as much as having the full thing printed/supplied.

    6. Re:Why is SSN secret? by Anonymous Coward · · Score: 3, Informative

      Here's a dirty little secret about SSN's. They were never intended to be used as unique identifiers. In fact, it says on the card For social security only, not to be used for identification. Even more, they are not secure in the least, up until recently you could get the first 3-5 numbers just by knowing a little bit about the person, see ID by state of issue, and it's pretty simple to identify the group number as well. Last 4? those were sequential. Basically, they were never designed to be secure, and now we have to treat them as such. Better keep your birthplace/birthday secret too.

  10. Why do SSNs persist? by necro81 · · Score: 5, Insightful

    I have a general question: why does the Social Security Number endure as the primary key of, well, every kind of financial account or transaction in the United States. The SSN - how it's assigned, how it's revoked, the regulations regarding who can use it and for what, what necessary safeguards are in place to prevent theft or misuse, its anonymity or lack thereof - was never intended for the tasks that it is now burdened with. It's broken in so many ways that it would be hilarious - if the consequences were not so dire.

    Is it just that this is the system that we in the US are stuck with, and that's that? How do other countries handle this? What are the potential alternatives? What are the true requirements for a "master identifier key", and how can they be realized in a way accessible to all people? How can we convince the business and banking community to stop using the SSN - not because they're forced to, but because it's such an awful liability?

    Which politicians' identities need to be stolen in order to put such a system in place?

    1. Re:Why do SSNs persist? by Culture20 · · Score: 2

      That's essentially what a SSN is, just using a weaker algorithm. Using sha1 won't make it any more secure since most people's birth details are public record. Then once the hash is created, it suffers from the same problem that SSNs have: being passed around in plain text as the same password for every company.

    2. Re:Why do SSNs persist? by houghi · · Score: 2

      In Belgium there is a 'General Identifier' It is your birthday + some extra numbers as there will be more then 1 person born on the same day.
      This is then linked to an (obliged) ID card.
      The ID cards have a chip that can be read by a generic cardreader. Applications are available online, as well as the open source software. http://eid.belgium.be/en/ for more information.
      So you have your ID. This will then be linked to the Central Balance Sheet Office http://www.nbb.be/ where all credits are available for certain institutions (e.g. banks and credit card companies) to see if you are allowed to have a new credit.

      e.g. when you already have some credit cards with a too high credit risc, they are NOT allowed to give you more credit. If the address at NBB is not identical to what is on your ID card, your credit will be declined.

      Then there is the social security number that will be linked to the master ID as well. However again a separated part, http://nl.wikipedia.org/wiki/SIS-kaart which will be replaced by the National ID of the eID.

      When you get a new job, what they will ask you is the social security number and your ID-card. Soon this will only be the eID card.

      If your eID gets stolen, or it gets lost, you go to the police, who then block the card for further processing.

      The system is not water or idiot proof. It is close enough, I would think. Verification of a card is valid or not is easy : https://www.checkdoc.be/CheckDoc/. So if you have any reason to verify an ID card (e.g. rental company, sales entities, ....) they can easily do so. In stores easily with a card reader linked to the above.

      Now imagine I am Mr. ID Theft and I steal your ID numbers. I must be very fast in doing everything and hope you did not already call in the ID as stolen. Then I must also pass other standard tests at a company.

      Next to this for several things (like opening a credit) you need to get an official signature. Faxing will not work. That means you must either send a letter or go to an office and present yourself.

      So all in all, I think it has several advantages (even though not 100% foolproof)
      1) Open
      2) Transparent
      3) Easy to verify and use

      e.g. while I typed this message, I regiterd on checkdoc.be and verified my card. It is valid.

      --
      Don't fight for your country, if your country does not fight for you.
    3. Re:Why do SSNs persist? by Cro+Magnon · · Score: 4, Insightful

      The problem, IMHO, isn't SSN as an identifier. It's that SSN is used as a password! I wouldn't care if everyone knew that xxx-xx-xxxx belonged to Cro Magnon, but when someone can buy a car in my name with just that number, that's a serious problem.

      --
      Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
    4. Re:Why do SSNs persist? by Bob+the+Super+Hamste · · Score: 2

      I have a simple solution. I have even written my legislators about it but they don't seem interested.

      Solution:
      Make it a crime for any business or institution to use your social security number for any purpose other than for taxation or receipt of social security benefits. Punishable by a fine of $1,000,000 per incident. Even better is to make it so that 50% of the fines go to the individuals who's social security numbers are being misused.

      Do that and suddenly no one will care what your social security number is since it will only be used for it's intended purposes and if it gets out won't be something that gives an attacker the keys to the kingdom for your identity.

      --
      Time to offend someone
  11. Re:Probably a downmod coming but.. by Anonymous Coward · · Score: 5, Funny

    A very articulate and insightful comment. No sarcasm intended

  12. Re:And, who has the Obamacare ID validation contra by cyberjock1980 · · Score: 2, Informative

    No, but he does make an interesting comparison. It is worth at least mentioning. Is it not? Last I read the contract was a no-bid(aka no competition) contract. Usually those are given to companies that are getting "special privledges" from those high in the political ranks.

  13. What about Experian? by gr8_phk · · Score: 5, Insightful

    Hieu Minh Ngo, the website owner, was recently been indicted for 15-counts filed under seal in November 2012, charging him with conspiracy to commit wire fraud, substantive wire fraud, conspiracy to commit identity fraud, substantive identity fraud, aggravated identity theft, conspiracy to commit access device fraud, and substantive access device fraud.

    Why does someone at one level of the crime get charged but not the one at the top. Remember:

    Experian — one of the three national U.S. credit bureaus — reportedly sold SSNs through its subsidiary, Court Ventures, to the operators of SuperGet.info

    Why are they not being charged? Using SSNs for certain things is illegal, and selling them probably is too - otherwise what did the other guy do wrong?

    1. Re:What about Experian? by Anonymous Coward · · Score: 2, Interesting

      Because criminal culpability usually requires intent. This would require the prosecutor to show that Experian executives either knew about it or suspected it, or should have known about it but were too wreckless in their supervisory duties. Obviously the latter is more likely, but that can be tough to prove. Experian would bring in an army of experts to explain to the jury why the executives lived up to every reasonable standard, and that these mistakes happen every once in awhile, etc.

      In many other countries criminal culpability doesn't require such a high standard of intent, and in some cases none at all. These also tend to be poor and underdeveloped countries, where moral outrage tends to drown out reasonable business expectations. These are countries where philosophy students write the laws.

      There's a reason why America is the richest country in the world. We have one of the best environments for business in the world. We just have a really fscked-up wealth distribution problem, and also a drastically underfunded investigative apparatus to enforce our existing white collar crime laws.

  14. obDilbert by Anonymous Coward · · Score: 2, Funny

    http://dilbert.com/strips/comic/2010-10-14/

  15. Re:Probably a downmod coming but.. by binarylarry · · Score: 5, Interesting

    Agreed. I'd vote for hanging some of the Experian exec responsible for this.

    --
    Mod me down, my New Earth Global Warmingist friends!
  16. Re:FREE AS IN BEER MARKET !! by Anonymous Coward · · Score: 3, Interesting

    4. Get one rifle shot shot at long range from a citizen who got screwed in the bargain. Make it a .50 caliber.

    I've been saying since Enron we should add more FEAR to the "greed and fear run Wall St." aphorism...

    captcha: brooms (which sweep clean)

  17. Re:Probably a downmod coming but.. by lymond01 · · Score: 5, Informative

    WHAT THE FUCK!!!?!!!?

    According to TFA, basically the company that Experian purchased had already been selling information to the notorious 24-year old cyber criminal. Once the company was purchased, Experian didn't review its own transactions closely enough and inadvertently sold our SSNs to the guy too. Monthly. The Secret Service found out, captured the 24-year old, and it's unknown if Experian, credit watchdog, will suffer for sleeping on the job.

    I'm not sure who appointed Experian watchdog (though I'm certain someone on Slashdot will point out how ignorant I am for not knowing), but for a company with so much power over your own life in terms of credit, it would be nice if, with the power came some sort of responsibility -- and accountability. I suppose we'll need to off Experian's Uncle Ben to get our point across...

  18. US credit reporting violates privacy of millions by bradley13 · · Score: 5, Insightful

    Credit reporting ought to have everyone up in arms anyway. Every company an American does business with sends personal, financial details to these agencies. No permission required. The agencies themselves have a shared monopoly, but the size of their market is static. So they are always looking for quasi-legal ways to make even more money by selling your personal data. Sometimes quasi-illegal.

    The whole system stinks. Americans need to get themselves some privacy rights...

    --
    Enjoy life! This is not a dress rehearsal.
  19. Experian one of the worst by Lysol · · Score: 4, Informative

    My family and I were looking to move recently. Of course, we have to print out our credit reports. It used to be nice years ago when Yahoo had a service where you could easily get all 3 in just a few mins. But I'm sure since that was actually useful in real life, someone had to end it. So now, you have to log into the big 3 separately and request your 'free' report.

    Of course, it's not 'free' since there's quite a bit of time involved in just getting it. You have a right by law to get this information once a year, but in order to do so, you have to put in your credit card. Red flag right there. This 'entitles' you to a free month of credit 'protection'.

    After your done with your 'free' month, you have to call and cancel or else they'll charge you. Yup, you're right, no easy way to do that, no cancel account link or button to click - you gotta get on a phone and do an old school call. To keep the good times rolling, once you're actually off hold and connected to someone, it's some call center in another country. Mine happened to be India. What ensued next was back and forth on just getting the fucking thing canceled. There were many "just a moment" pauses and even a few upsells. I had to tell the guy 3 times I want to cancel. Just click the cancel button in your crappy web app.

    30 mins later, I was off the phone. This company and the people that work for it are trash, plain and simple. They are a scourge on society and a drain on humanity. And along with banking (and warring I guess), credit 'scoring' and manipulation has to be one of the worst human endeavors ever. I don't understand how these people sleep at night and I'm not surprised they're selling people's info to whomever will pay.

    1. Re:Experian one of the worst by sconeu · · Score: 2, Insightful

      I've *NEVER* had to enter a credit card to get my free credit report. Where the hell are you going to get it?

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    2. Re:Experian one of the worst by Anonymous Coward · · Score: 3, Informative

      Stop spreading FUD. No credit card info is required to get your free annual credit report.
      You don't have to agree to upsell features like FAKO credit score and credit monitoring.

    3. Re:Experian one of the worst by HeavyD14 · · Score: 4, Informative

      Next time, go to http://annualcreditreport.com/ for your free report. No credit card or trial required. Takes care of all three agencies at once.

    4. Re:Experian one of the worst by Solandri · · Score: 4, Informative

      That's the official (and only) government site for getting your free credit reports. All the sites asking for your credit card are scam sites (usually run by the credit bureaus themselves) which automatically sign you up for a credit monitoring service and charge your card if you forget to cancel.

      All of this confusion and scamming could be eliminated if the government would just move the real site to the .gov domain. Then it'd be easy. .gov = real, .com = fake.

    5. Re:Experian one of the worst by Qzukk · · Score: 2

      I just spend a few bucks and get all the information from this site I found, superget.info. Yeah, you can get it for free elsewhere but they don't try to stick you with signing up with all sorts of bullcrap. Funny, though, I can't seem to log into the site right now, maybe you're right about useful things getting shut down.

      Google tells me I can get a free report from https://www.annualcreditreport.com/ but the site looks like one of those crappy scam sites crapped out of a template with some generic stock photos, so I'm not sure I'd trust it.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    6. Re:Experian one of the worst by SeaFox · · Score: 2

      All of this confusion and scamming could be eliminated if the government would just move the real site to the .gov domain. Then it'd be easy. .gov = real, .com = fake.

      They had one. I remember going to freecreditreport.gov last time I got my credit report, then that commercial outfit got freecreditreport.com and started running all their stupid singing TV ads. I even remember a campaign to educate people that they needed to go to the .gov site for the official report. But it looks the government had to change because for the sheeple the idea a website can end in something other than .com is too difficult.

      Try freecreditreport.gov now and you get a redirect to the FTC and told to visit the new site.

    7. Re:Experian one of the worst by atom1c · · Score: 2

      Yahoo! never provided you with credit reports or scores. They merely had advertisements for such crap.

      American citizens are granted 1 free annual credit report (NOT score, but the REPORT of the components to any scoring algorithm) per year PER CREDIT BUREAU. (See annualcreditreport.com) It is actually recommended to use the service every 4 months but selecting a different bureau each time -- thus checking your credit report 3 times a year, once for every bureau.

      There is no payment. There is no telephone service. Stop spreading bull.

  20. Re:And, who has the Obamacare ID validation contra by MacColossus · · Score: 2

    Which makes you wonder why they are using Experian for validation.

  21. Re:And, who has the Obamacare ID validation contra by mcgrew · · Score: 5, Insightful

    For fuck's sake, it has nothing to do with obamacare. Stay on topic and stop trolling.

    OK, so they put the ID theft guy in prison, how about having Experian's CEO in an adjoining cell? Why is it legal for Experian to sell my SS#??? I never gave them permission for that.

    --
    Free Martian Whores!
  22. I'm Dead by Princeofcups · · Score: 3, Interesting

    These are the same fuckers who insisted that I was dead because someone had mistyped a social security number. Therefore they rejected all credit requests (I was trying to get financing on a car) until I could prove that I was still alive. That's right. If they make a mistake, the victim, errr, customer, has to correct it.

    --
    The only thing worse than a Democrat is a Republican.
  23. Re:Can I form a subsidiary too? by Anonymous Coward · · Score: 2, Insightful

    Always go check for an apposite Will Rogers quotation:

    "A holding company is a thing where you hand an accomplice the goods while the policeman searches you." - Will Rogers

  24. Re:And, who has the Obamacare ID validation contra by EMG+at+MU · · Score: 3, Insightful

    Brining Obama into it frames the discussion on partisan politics. The discussion becomes "Obama and the democrats are corrupt, look at this no bid contract" instead of "The entire goverment, regardless of political party, is corrupt; no bid contracts have been part of the goverment bidding process for years and we need to reform it now".

    We get nowhere when we fight about one party over another. But thats how all the debates are framed, and partisan drones are programmed to jump all over the opportunity to blame opposing party while ignoring the same transgressions when it is their party being bad.

  25. Re:Probably a downmod coming but.. by Scutter · · Score: 4, Insightful

    At the very least, Experian's board should be held accountable by its shareholders for gross negligence in failing to do its due diligence during the purchase.

    --

    "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
  26. Re:We Need to move away from paper-based identity by Jawnn · · Score: 2

    WE need to switch to DNA-based identification, where computers can lift your DNA sample on the fly to confirm your identity rather than rely on a number and piece of paper that can be easily duplicated.

    Yeah, that's a swell idea. We can adjust your health and life insurance premiums at the same time, and even check to see if your DNA is related to any unsolved crimes.

  27. Solution: Make SSNs Public Record by Anonymous Coward · · Score: 5, Interesting

    The solution to this issue is for the Social Security Administration to publish EVERY SSN along with name in a big set of phone type books, and online. The SSN was never intended to be a secret number.

    Banks and credit organisations who use the SSN as some sort of secret code can find some other real authentication method. Publishing them all at once would 'shock' the system into the fix that is needed.

    1. Re:Solution: Make SSNs Public Record by careysb · · Score: 4, Interesting

      +1 I've had to argue with more than one health insurance company to get them to not use my SSN as an ID number. Tell you what, along with publishing numbers lets also guarantee duplicate SSNs. That'll fix 'em.

  28. Re:And, who has the Obamacare ID validation contra by EMG+at+MU · · Score: 2, Insightful

    I think it frames it in terms of arguments of a federal website and program that is going to be gathering unprecedented personal and medical information on US citizens, and that is showing incredible ineptness of design and implementation through its first website portal is a fair argument to be brought up by anyone remotely concerned about their information, the safety of the information...and well frankly, what the govt does with that info.

    Nothing is unprecedented. The government has been collecting all of your data for years, regardless of if the President has a (R) or a (D) next to his name. Bringing Obama into the discussion distracts from the fact that it doesn't matter who the president is, the government will continue being the government and continue doing whatever it wants.

    No matter what you call it....there is justifiable cause for concern. Remember the other day about the code viewable in the source of the ACA website about "no expectation of privacy"?

    Yes I do, and in that discussion everyone whined about Obama and missed the opportunity to discuss the fact that the government and corporations have always acted as if you "have no expectation of privacy". Hence the fucking story we should be talking about here.

  29. Re:And, who has the Obamacare ID validation contra by GodfatherofSoul · · Score: 3, Insightful

    healthcare.gov uses Experian to validate registrants. Experian sells account information to whoever will pay for it. You're saying there's no relationship???

    --
    I swear to God...I swear to God! That is NOT how you treat your human!
  30. NOT ENUF! by TiggertheMad · · Score: 4, Funny

    Hanging's too good for him. Burning's too good for him! He should be torn into little bitsy pieces and buried alive!

    --

    HA! I just wasted some of your bandwidth with a frivolous sig!
  31. Re:Probably a downmod coming but.. by cusco · · Score: 2

    Now watch for the new Experian advertising campaign.

    We know for a fact that criminals have your Social Security number, because we sold it to them! Now wouldn't it be a shame if they were to use that information to ruin your credit (hint, hint, nudge, nudge)? For only $9.99 a month we will make sure that those fraudulent charges don't apply to your credit score, so you can argue with the credit card companies without that worry!

    --
    "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
  32. Re:And, who has the Obamacare ID validation contra by Bite+The+Pillow · · Score: 3, Informative

    What did you read?

    "The work on Healthcare.gov grew out of a contract for open-ended technology services first issued in 2007 with a place-holder value of $1,000. There were 31 bidders. An extension, awarded in September 2011 specifically to build Healthcare.gov, drew four bidders, the documents show, including CGI Federal."

    Search for part or all for source. Now, last you read it was a bid contract, invalidating your point.

  33. Re:Probably a downmod coming but.. by Solandri · · Score: 3, Insightful

    I'm not sure who appointed Experian watchdog (though I'm certain someone on Slashdot will point out how ignorant I am for not knowing), but for a company with so much power over your own life in terms of credit, it would be nice if, with the power came some sort of responsibility -- and accountability.

    Nobody "appointed" Experian watchdog over this information. Many companies (banks, lenders, credit card companies, etc) needed reliable information on a customer's past creditworthiness. Experian (and TransUnion and Equifax) collected and provide this information in sufficient quality for these companies' needs, and so they've become the watchdogs.

    The problem is a subtle one I've noticed in several fields (mainly HR and hiring). The credit agencies protect against a false positive - one where an individual who is a high credit risk is incorrectly determined to be a low credit risk, and thus the bank gives them a loan. This protects the companies who seek this information before lending out money or equipment.

    They do very little to protect against false negatives - one where an individual with low credit risk is incorrectly flagged as a high credit risk. The companies who use the credit bureaus don't really care about this case because it's a "safe" error for them. If they refuse a loan to someone who would've paid it back, they just lose out on the interest. So there's less incentive to verify the accuracy of negatives on someone's credit report. (Incidentally, low interest rates exacerbate this situation. If interest rates are higher, the interest on a loan can exceed the principal, and thus a false negative could become a greater financial loss than a false positive.)

    (In the HR case, a HR department which carelessly culls out job applicants based on keywords and unrealistic years of experience is lowering their risk of false positives. But they're also increasing their risk of false negatives and weeding out a lot of qualified people. From management's standpoint, they can see the direct negative consequences of a bad hire. The negative consequences of failing to hire someone who was a good fit for the job are not so obvious. To correct for this, companies should regularly test their HR departments by submitting applicants who are "perfect" for a job and seeing how many of them get asked for interviews.)

  34. Re:And, who has the Obamacare ID validation contra by HiThere · · Score: 2

    In particular the Supreme Court has, IIUC, decided that if you share any information with anyone except your lawyer, then you have "no expectation of privacy". And currently most of the Court has strong Republican leanings.

    Neither party is worth ANY degree of trust. A very few individuals within each party appear to currently be trustworthy. (And being trustworthy doesn't mean that they will support your position, it means that they will support their own stated position.)

    This is what you get when you have a "plurality wins" electoral system. It took it over a century to get quite *this* corrupt, but I don't think it's achieved maximum corruption quite yet.

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
  35. Re:Probably a downmod coming but.. by HiThere · · Score: 4, Informative

    Not much. Harsh punishments are less effective at deterring crime than are moderate punishments that are more likely to happen...unless, of course, you are likely to be punished even if innocent. To be effective the punishment only needs to be sufficient that the net benefit of an act is negative...but they need to be expected to happen if you are guilty. And sooner is much more effective than later.

    Yeah, I know these requirements are in conflict. If it were simple, someone would have had a decent government by now.

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
  36. Re:slightly off topic by Bite+The+Pillow · · Score: 2

    Your blog sucks.

  37. Re:And, who has the Obamacare ID validation contra by lgw · · Score: 3, Insightful

    Usually I laugh at claims that the CEO should be in jail when a company does something bad, but in this case there are laws with teeth about credit report info. Unless this was some case where he could not reasonably have known that this was going on, there must be some crime here, times 300 million counts.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  38. Former Experian employee by Anonymous Coward · · Score: 2, Informative
    I'm posting as AC for fear of reprisals but...

    As a former Experian employee and Systems Administrator to boot - I have only this to say, "Buwahhhhhhhhhaaahhhahhhhahhhahhhaaaa! Oh god, stop it! You're making my sides hurt!"

    Ah - the good old days of Experian! For the record, this was my original CIO's personal nightmare that he shared in nearly every "All Hands" meeting while I was there. He got cut loose and within 3 years so did I and most of the technical experts in the US. RIF'd because we're expensive help. Remember, Experian is NOT an american company. It is listed in the London stock exchange since it was originally bought by "GUS Plc" back when it was TRW. So, now that the Experian CIO position has shifted back to the Brits (it was an American when I first started), they're GUTTING the IT infrastructure staff in all of the "expensive" locations (i.e. - the US) and outsourcing to places like Costa Rica. No offense to anyone in Costa Rica - but they are very late players in this corporate reshuffle and have NO voice in any IT decisions. We (the US IT infrastructure staff) have been warning senior management for nearly a decade (I was employed for 8 years) that they were SERIOUSLY screwing up each and every corporate acquisition company integration. Since there was NO oversight of the IT integration (at any level) is it any kind of shock that there was little to no oversight of the account management of customers in these subsidiary's?

    It's a shame that the good people I know in that company will now pay the price for senior management greed and stupidity. And yes - I agree with everyone who posted about the predatory website and practices by Experian with the so called "free credit report". What a freaking racket. If it's any consolation - I argued against it (and so did all of the web developers and IT staff) but senior management was looking to hook all customers any way they could. Sorry if this sounds disgruntled - truly I'm more disillusioned and saddened because I know how much effort the good guys are expending trying to make it right from within. Poor bastards.

  39. Re:Probably a downmod coming but.. by synapse7 · · Score: 4, Interesting

    So are all SSNs compromised?

  40. Re:Probably a downmod coming but.. by gsgriffin · · Score: 3, Informative

    They're up 24 points, 2% right now. Don't think investor care so long as they make money. $1,224/share is pretty staggering.

    --
    jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
  41. Here's a thought by g0bshiTe · · Score: 2, Insightful

    How about penalizing Experian for selling the information in the first place.

    --
    I am Bennett Haselton! I am Bennett Haselton!
  42. Re:Probably a downmod coming but.. by dewrox · · Score: 2

    In the words of Brick Top... Feed 'em to the pigs.

  43. Re:Probably a downmod coming but.. by Samantha+Wright · · Score: 2

    The bill would die immediately after being introduced, if not because of its blatant immorality then because of corporate lobbyists. I find it strange that people fantasize so much about a legislature comprised almost entirely of corporate lapdogs turning on its masters.

    --
    Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
  44. We should first make it illegal to do this by dutchwhizzman · · Score: 2

    We should first make it illegal to do this. In fact, we should making gathering or selling credit info and social security numbers illegal for anyone but the government themselves. The only use is for companies to charge you, the USA people, more money for their services. They do it under the pretence that if you check out, you get a discount, but you never do. If you don't check out, you don't get a service at all, except with companies that charge way more because they want to counter the risk somehow. A law that contra-beneficial to over 90% of the people is not in anybodies interest, so it should be made illegal that this is possible at all.

    --
    I was promised a flying car. Where is my flying car?
  45. Re:Probably a downmod coming but.. by Cederic · · Score: 2

    Ok. Stop mocking and tell me: Why is share price relevant, except as a relative measure?

    As an absolute measure it's totally pointless. £12 for a share. So fucking what. HOW MANY SHARES ARE THERE?

    If there's one share, the company is worth £12. Suddenly a share price of £14bn sounds reasonable. If there are 400 billion shares than £12 feels a tad excessive.

    It's a meaningless measure. Or do I sound like a politician using common sense, logic, financial nous and a background in writing portfolio management software. You decide.