It's still easy for anyone to become you at Experian
Credit bureau Experian is under fire for weak identity verification that reportedly lets attackers hijack consumer accounts, unfreeze credit files, and open large loans with little friction. Commenters argue that because individuals are treated as data products rather than customers, credit agencies have few incentives to invest in security or usability, and current legal penalties for breaches are effectively toothless. Many call for structural fixes — from stricter liability and privacy laws to improved national digital identity systems or even nationalizing credit reporting — while others share personal horror stories that highlight how hard it is to undo fraud once it occurs.
Power and Structure of Credit Bureaus
- Commenters stress that individuals are not the customers but the product; lenders, employers, and data buyers are the real clients.
- There is no practical opt‑out: lenders and employers feed data to all three major bureaus by default.
- Attempts to “vote with your feet” (e.g., avoid one bureau) are seen as unrealistic because businesses typically report to multiple agencies.
Security Failures and “Identity Theft”
- Experian’s account recovery and identity proofing are widely criticized as weak, enabling hijacks and easy unfreezing of frozen credit.
- Several users describe major fraud incidents (cars, apartments, insurance) and the difficulty of cleanup, often with little law‑enforcement help.
- Many argue the term “identity theft” is misframed: the real victim is the lender that was defrauded, while the individual is stuck cleaning up bad data and damaged credit.
Regulatory, Legal, and Punitive Ideas
- Strong calls for large per‑record fines, potential corporate “death penalty,” and even criminal liability for executives to make breaches and negligence genuinely costly.
- Suggestions include: expanding FCRA enforcement, revisiting defamation/libel immunity for credit reporting, and allowing substantial damages when false data harms individuals.
- Some point to GDPR‑style regimes as a model for meaningful penalties and privacy protections; others note class‑action settlements so far have been tiny per person.
Identity Systems, SSNs, and Alternatives
- SSNs are criticized as both identifier and shared secret, enabling fraud.
- Proposals include government‑issued digital IDs (DMV/passport‑style smart cards, Apple/Android‑Pay‑like identity tokens) and stronger identity proofing services.
- Counterarguments highlight surveillance concerns, government overreach, and the need for strong privacy law (US‑style GDPR) before strengthening identification.
Consumer Mitigations and Practical Advice
- Many recommend freezing credit at all bureaus and enabling fraud alerts, while acknowledging Experian’s weakness undermines freezes.
- Links are shared to opt out of some data sales and to file complaints with regulators (FTC/CFPB).
- Several users note that simply having no credit history can itself be harmful, tying people to the existing system.
Broader Data and Verification Problems
- Commenters extend criticism to data brokers, employment‑income reporting services, SIM‑swapping, and weak email/account verification flows, seeing them as part of the same structural problem of unaccountable data collection and misuse.