Consumer complaint received 2017-11-03
Company: Experian Information Solutions Inc.
State: IN
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Problem with fraud alerts or security freezes

Complaint:
EXPERIAN AND XXXX ARE NOT PROPERLY SECURING CREDIT OF VICTIMS OF IDENTITY THEFT. 
I have been a victim of identity theft since XXXX. 
On XXXX/XXXX/XXXX someone other than me used Experian 's website to retrieve my security freeze PIN using personal information that they have about me. This resulting in 3 applications to XXXX XXXX, 1 to XXXX  Card, 1 to XXXX, 1 to XXXX card, and 1 to XXXX XXXX. Most of these companies found something suspicious and denied the credit application, stating they could not verify my identity. XXXX XXXX ended up issuing a card in my name. On XXXX/XXXX/XXXX I spent over 1.5 hours on the phone with over 10 representatives at XXXX in order to find out that they pulled my credit report from Experian. I immediately called Experian and discovered that my credit freeze had been permanently lifted. XXXX at Experian was able to tell me that the freeze was lifted online. When I asked how this was possible without my PIN, he told me that by answering questions about your personal information, you could retrieve your PIN online. I believe they have a copy of my credit report from XXXX ( shows one was pulled within last 12 months and it was not me ), and they would be able to answer all of these personal questions. When I inquired as to why I was not notified the freeze was lifted by mail or email, I was told that since it was done online, that is how I was notified and they do not take any additional security measures. 
On XXXX/XXXX/XXXX I discovered that on XXXX/XXXX/XXXX someone used my name and a phone number that is not mine to go online and place a hold on my mail with the US Postal Service for a month. I called Experian again that day to confirm that my credit freeze was still in place since this caused additional concerns about the security of my financial information with them. It was still in place, and again they told me that there was nothing they could do to prevent this from happening again. 
On XXXX/XXXX/XXXX I tried calling Experian again to try to get the email address that was used to retrieve my PIN. I spent 45 minutes on the phone with them. They claim they do not have those records in their system and could not tell me which department would have those records. They said that there was no additional security measures that they could put in place to protect my information or prevent these thieves from using the same method to lift my security freeze again. 
When you place a security freeze with Experian, none of the information or disclosures you receive state that the PIN can be retrieved online. It states that if you lose your PIN, you must send proof of identity in to them by mail and they will reissue your PIN. This would be a secure method that would prevent thieves from impersonating me as long as they only mail it to my address of record. However, they stated on all three occasions that they had no way to prevent anyone from accessing this information online. 
I believe that my identity and financial information are not safe with Experian, and they will do nothing to assist me with this. It is also my understanding thaXXXX XXXX has a similar method to retrieve your PIN, but I have not yet had a problem with them. I believe this is unsafe for consumers, especially victims of identity theft. With the recent XXXX breach, it is possible that they could have the personal information needed to unfreeze the credit of unknown numbers of consumers using this method! 
I have not had any direct monetary losses from this issue, but it is only due to my vigilance and time spent chasing down these fraudulent credit applications. This has also placed undue XXXX upon me and caused medical bills due to a condition I suffer from.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with non-monetary relief