Consumer complaint received 2022-02-03
Company: Experian Information Solutions Inc.
State: IL
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
On XX/XX/XXXX at XXXX XXXX  I received a notification from Experian that the email address on my credit reporting account had been changed. The alert directed me to email Experian if this was not me who made this change. I sent emails to the provided address at XXXX, XXXX, and XXXX and only received an automated response saying " Thank you for contacting Experian! We got your email and aim to respond within XXXX business days from your initial request ... '' I then tried calling them a total of XXXX times over XXXX hours and was never let out of the IVR to talk to a human. All this time I knew that my account was being hacked as I was not the one who changed my email address. Since I work in the financial service/credit card industry I knew right away this was an account takeover attempt as I had previously had my credit card information stolen XXXX earlier this year from various breaches at other companies. I tried numerous times to reach Experian on any number I could find on their website including XXXX, XXXX, XXXX, XXXX XXXX  XXXX I tried calling Experian on XX/XX/XXXX : - XXXX ( XXXX seconds spent in IVR trying to connect to person ) - XXXX ( XXXX min ) I tried calling back again on XX/XX/XXXX during normal business hours : - XXXX ( XXXX min ) - XXXX ( XXXX min ) - XXXX ( XXXX sec ) - XXXX ( XXXX min ) - XXXX ( XXXX min ) - XXXX ( XXXX min ) - XXXX ( XXXX min ) - XXXX ( XXXX min ) I then proceeded to reach out to them on XXXX and XXXX at XXXX and heard back from an Customer Service Representative at Experian who setup a call with me at XXXX that lasted for XXXX minutes. During that call the Experian Employee confirmed to me that my account was taken over and proceeded to lock my account so that I, nor the hacker, could log in and view my reports. This was done XXXX hours after the account was taken over so really did not do much. The Experian Employee told me that per Experian policy they not authorized to disclose the hackers email address that was set and instead opened up an internal case ( # available upon request ) at Experian to review. After receiving this information that my account was in fact hacked and taken over, I filed a police report with the with my local police Department, ( report # available on request ). I had also opened an initial CFPB complain ( report # available on request ) as well as a follow up complaint ( report # available on request ) a few days later with more details on the incident after not hearing back from Experian. At XXXX on XX/XX/XXXX I received a call from another member of Experian Customer Service who provided me additional information. The Experian Employee on the phone confirmed to me that the hacker changed my email address, then changed my password via a password reset to that email address. The Experian Employee said that the hacker then changed my security question and pin. The Hacker changed the security question of " favorite teacher '' to " yo-yo '' and PIN to " XXXX '' The Experian Employee told me that this is not the first time that the Experian Employee has seen those answers to other accounts that were taken over. The Experian Employee also shared with me the email address that the hacker changed the account to ( available upon request ). The Experian Employee was able to help me regain control of my account. Once I had control I was able to see that the hacker pulled a copy of my credit report which gave them access to the following : date of birth, last XXXX address history, employer, middle initial, my credit scores for all XXXX bureaus, first XXXX digits of every credit account and loan that I have had in my life, payment history on every credit account and loan that I have had in my life, current balance/open date, status of every credit and loan, past inquiries from companies. I could tell this was the case as Experian 's interface saves all past reports you generate, and the timestamp that was generated for this one was XX/XX/XXXX at the exact time when my account was taken over by the hacker and I lost possession. Given all of this information that was taken I immediately placed fraud alerts on all of my Credit Bureau accounts that remain in place. I also filed a report with the various law enforcement and state agencies for identify theft and hacking. I was also forced to add on an expensive {$25.00} a month Experian Credit Protection package to perform dark web scans, and give me the ability to lock my report, and a private phone line to contact so that if my account was taken over again I would have better alerts and controls in place instead of getting an email and having to wait XXXX  days for a response. Overall I just can not believe that this happened. Experian dropped the ball massively in protecting my very sensitive data in allowing an email change to take place at XXXX at night, followed by changes to password, security question, security pin, address, and my report being drawn. All of this without any KYC checks being done, or any two-factor authentication taking place and zero notification back to the contact info that I set up on the account to verify all this strange behavior ... which is even more appalling knowing that Experian sells two-factor authentication products on the market yet fails to protect our most sensitive information with it unless you pay {$25.00} a month. So this was either an inside job at Experian and they are trying to cover this up which is why they are not providing me or law enforcement with any details on the hack, or they massively failed Know Your Customer checks and don't want regulators to be made aware.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation