Product: Credit reporting or other personal consumer reports

This issue involves EXPERIAN credit reporting and their online portal. 

On XX/XX/XXXX I was notified via email of a fraudulent credit card application through XXXX XXXX ( separate issue ). 

I proceeded to obtain my annual credit reports which I have done in the past. I have online accounts in order to file disputes with all three major credit reporting companies. When I went to login to my Experian account, I was notified that my username and password do not match my personal identifying information or phone number. 

When I requested my username by email, I noticed it had been changed from my personal email to one that I did not recognize. This username being " XXXX '' What this means is that someone was able to login to the Experian online portal without any two step verification or username reset email verification and obtain all of my personal information and credit report. They successfully changed the username and password associated with my online Experian account. Experian quite obviously failed to provide any security measures that would prevent this from happening. 

It's quite simply unacceptable in XXXX and a violation of section 611 of the Fair Credit Reporting Act 15 U.S.C. 1681l. Section 1681 ( e ) ( b ) requires the standard of maximum possible accuracy. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX 

A reinvestigation can not simply shift the onus back onto the consumer. Sections 1681n and 1681o of Title 15 respectively provide private rights of action for willful and negligent noncompliance with any duty imposed by the FCRA and allow recovery for actual damages and attorneys ' fees and costs, as well as punitive damages in the case of willful noncompliance. XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXX, XXXX, XXXX XXXX XXXX ( XXXX Cir. XXXX ). [ A ] reinvestigation that merely shifts the burden back to the consumer and the credit grantor can not fulfill the obligations contemplated by the statute. Id., 225. 

I called the Experian fraud department twice ( ( XXXX ) XXXX ) on XXXX around XXXX XXXX. Both times I was told that I could not speak to a representative by an automated robot. I called member services ( ( XXXX ) XXXX ) on XXXX at XXXX XXXX  and spoke with a " XXXX. '' She was nice enough but proceeded to ask me my " secret questions '' in order for her to reset my username and password. 

Obviously Experian did not require the fraudulent " XXXX '' to answer any questions or submit a pin number in order for them to change my information and access my account. Moreover, how am I supposed to know if " XXXX '' had not changed my secret questions and pin number in the online portal. 

XXXX refused to reset my information despite my providing ample personal identifying information including XXXX, XXXX, address, name, etc. She identified my case as " heightened '' or something and said someone would call me but they would need more information. 

A clear violation of federal law and ineptitude. Experian is obviously liable under federal statute and case law for any damages that result as of their failure to protect my personal information, credit report, and online account portal. This is an ongoing problem with Experian 's online portal and there was a lawsuit in XXXX  in XXXX. I expect swift action from the CFPB.