Consumer complaint received 2017-09-21
Company: Experian Information Solutions Inc.
State: MA
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Problem with fraud alerts or security freezes

Complaint:
None of the topics I was presented really described my issue so I chose this one. 

This is an issue is with Experian allowing access to retrieving Credit Freeze PIN numbers online and the serious lack of security in protecting that access. 

XXXX XXXX, 2017 I went on Experian 's credit freeze website ( https : //www.experian.com/freeze/center.html ) and noticed that there was an unsecured menu that allows retrieval of credit Freeze PIN numbers accessible to anyone who just wanders in from the internet. That menu requires no login/password to access it and the information required to retrieve the PIN consists of the information exposed in the recent breach at XXXX and information easily available on the internet. Also I was able to go back and try again and again to access that account as many times as I wanted. 

Upon filing out the main form with my SSN and birthday as the main security objects I was presented with 4 'security ' questions. Three of the answers were easily found by XXXX on my name or buying a {$25.00} online background check on me. They were questions about previous employment, my previous phone number ( seriously ) and which bank I used. None of the banks listed were in my hometown so the correct choice " none of the above '' was obvious. Even XXXX asks more secure questions than this, Worst of all once you got through this menu ( and like I said you have as many tries as you want ) instead of mailing the PIN to a verified address on record like the other Credit companies do the PIN was displayed on the screen visible to all along with the offer to email it to any email address you provided in the form! Why? Because there is no address on record because there is no account created for people with credit freezes. Experian just uses unverified information that is arbitrarily entered on their form. 

I can easily see Experian being the next company in the news for not securing their information properly because they obviously are not. I did n't authorize Experian to collect this information on me the least they can do is implement serious security to protect it, not just trying to make it as convenient and inexpensive as possible. 

If you are going to allow PIN retrieval online ( which is insane to begin with ) at least secure it. It is the keys to the castle! 

- Create an account for all people with credit freezes with the usual name address, email, along with a login and password which will be needed in order to even get to this menu screen and then only allow the PIN for that account to be retrieved. 

- Only allow one try to get the information correct and then they need to call. Sorry you may need to hire a few more people but thats how real security works. 

- The security questions should be something in my credit history that would n't be found on the internet and certainly not publicly obtainable information like my previous phone number! 

- Most importantly, MAIL the PIN to a verified address ( and not on a postcard ). Inconvenient? yes. Secure? YES!

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation