Consumer complaint received 2023-11-07
Company: Experian Information Solutions Inc.
State: TX
Product: Credit reporting or other personal consumer reports
Sub-product: Credit reporting
Issue: Problem with fraud alerts or security freezes

Complaint:
This is a complaint against Experian due to a security breach of my account. Experian 's handling of this situation was severely inadequate and has left me vulnerable to identity theft and financial harm. 

On XX/XX/2023, I received an email from Experian stating that my credit report had been unfrozen. I had not unfroze my report which suggested unauthorized access to my credit information. 

Upon reaching an Experian customer service agent, I was informed someone impersonated me on the phone and successfully unfroze my credit report. This implies a severe lapse in Experian 's security procedures. I took immediate action to safeguard my account by changing all PINs and passwords associated with my Experian account. The Experian agent treated this as a dispute and placed a fraud alert on my account. They advised me to call if any further unusual activity occurred. 

On XX/XX/2023, I received an email from Experian stating my address had been changed. I had not made this change, but I noted that one digit in the numeric part of my address had been altered. More alarming is the fraud alert on my account had been removed without my consent. 

When I contacted Experian about this unauthorized change and removal of the fraud alert, the agent was unhelpful, providing no information about how this change had occurred. They suggested it may have been initiated by a creditor, but I have not opened any new lines of credit in over a year. This lack of transparency and assistance from Experian is deeply concerning and suggests someone can impersonate me and change information in Experian credit report with relative ease. 

I have taken all necessary steps to protect my identity, but Experian 's lax security measures and inadequate response to these incidents are deeply troubling. I hope that my complaint will lead to a thorough review of Experian 's security protocols and a resolution of this situation to prevent further damage to my credit and personal information. 

I filed a XXXX XXXX XXXX complaint against Experian. Below are two statements in the reply from Experian that highlight the incompotence of the people handling XXXX complaints. 

The following is in regards to your statement " Additionally, our records indicate that XXXX XXXX was able to successfully remove his Security Freeze from his Experian credit report on XX/XX/2023, via our contact center. '' Apparently you can not comprehend that this is the PROBLEM and not a solution. I did not call your contact center to remove a security freeze. I did call your contact center to ask why my security freeze had been removed. I was told that someone impersonating me was able to call your contact center and have my security freeze removed. This shows a severe lack of security on your part. 

The following is in regards to your statement " We added an Initial Security Alert to XXXX XXXX credit report on XX/XX/2023. '' You also claimed that you set up an Initial Security Alert when I called you on XX/XX/2023. When I called you on XX/XX/2023 regarding the unauthorized change to my address I was told there was no Initial Security Alert. That means either you did not actually set up an Initial Security Alert on XX/XX/2023 even though you said you did or somebody impersonating me was able to remove the Initial Security Alert due to lack of security on your part. 

Upon loooking into Experian security issues I found the following XXXX XXXX XXXX XXXX All you need to get the PIN that allows a hacker to unfreeze an account is the person 's name, social security number, and birthdate. Any unvalidated email can be supplied to received the PIN. With this PIN the hacker can make any changes to your credit report. As the page says this security is truly a joke.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation