Consumer complaint received 2022-10-28
Company: TRANSUNION INTERMEDIATE HOLDINGS, INC.
State: FL
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Problem with fraud alerts or security freezes

Complaint:
Due to a hack that began on XX/XX/XXXX, I had credit alerts and freezes on all XXXX credit reporting bureaus ( XXXX, XXXX, TransUnion ). I placed these with each bureau over the phone. I did not have online access with them. On XX/XX/XXXX, I received an email from XXXX XXXX XXXX XXXX XXXX was trying to open a XXXX XXXX XXXX XXXX XXXX XXXX XXXX I called XXXX XXXX XXXX and they said they could do nothing since the account was not opened. I called TransUnion and they said that the credit freeze had been lifted. I asked them how, since I have a PIN and it was sent USPS to me & I havent told it to anyone. They said it was removed using my online TransUnion account. I told the agent that I didnt have an online account, and what good was a PIN if it can be so easily bypassed. The exchange was extremely unsatisfactory, but the agent did re-institute the credit freeze. On XX/XX/XXXX I decided to create online access with the 3 bureaus to prevent hackers from bypassing the freezes through online access. When I got to TransUnion, I was easily able to create online access, which was surprising. I thought that online access had already been created by the hacker. Today I went online to check the freezes and the XXXX and XXXX freezes were still in effect. However, I was not able to get into my TransUnion account. The next XXXX hours were spent on 3 different phone calls with XXXX call center agents. The upshot : my information was in 3 different profiles. The 1st : a free account created by the hacker on XX/XX/XXXX had the username of XXXX. The 2nd : a paid account created on XX/XX/XXXX by me had the username of XXXX The XXXX : a free account accidentally created by me with the username of XXXX The XXXX agent was the one who told me that I had XXXX accounts. She was able to delete the XXXX free ones before we were cut off. On the XXXX call, the first agent told me that there were XXXX different login pages, depending on whether the consumer has a paid or free account. Later in that call, supervisor XXXX deleted the account created by me on XX/XX/XXXX so that I could start over. With him on the line, I recreated the paid TransUnion account. Once it was created, I asked him how I could check on the freeze from this account. He said that I could not, that I could only check on the freeze from a free account. I asked him if someone created a free account, could they take off the freeze, and he said, Yes maam. After we hung up, I created a free account with TransUnion so that the hacker could not create one and hijack my account. My complaint : TransUnion is negligent in their security practices because a free account can be used to bypass a credit freeze without the PIN even if the user has a paid account or has placed the credit freeze over the phone, and that the company is deceptive and negligent in that there are 2 different login pages, depending on if the consumer has a paid or free account. TransUnion is also deceptive in their website, which tricks people into creating a paid account. ( I initially did not want a paid account, and still dont want one, but I must now have both to prevent a squatter from accessing my information. )

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation