Consumer complaint received 2024-12-12 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Problem with a company's investigation into an existing problem — Their investigation did not fix an error on your report
Company: CREDIT ACCEPTANCE CORPORATION
State: OH

Complaint narrative:
I have been actively disputing multiple negative items on my credit reports, including XXXX instances of XXXX late payments, XXXX instances of XXXX late payments, XXXX instances of XXXX late payments, and XXXX instances of XXXX late payments. Despite my repeated efforts to resolve this matter, Credit Acceptance has continuously refused to assist, with investigations ending in the response, " ultimately, there is nothing we can do. '' They have acknowledged fault on their recorded lines but have failed to take any corrective action, leaving me with a severely damaged credit score. This ongoing issue has significantly impacted my reputation and has prevented me from achieving personal goals I am entitled to as a responsible consumer. 

The issue originates from a divorce in 2021, during which Credit Acceptance failed to notify me directly of any late or missed payments. Upon discovering these negative items on my credit report, I contacted Credit Acceptance to investigate the situation. I learned that my ex-wife was able to authenticate changes to my personal information, preventing Credit Acceptance from sending me important notifications or communications regarding the delinquencies. As a result, I was unaware of these issues until they appeared on my credit report while applying for a mortgage. I requested that Credit Acceptance review their recorded calls and confirm that I had not been in contact with them nor authenticated any information since 2021. They acknowledged that I had not communicated with them directly nor authenticated via their portal, yet they insisted it was still my responsibility to address the loan. 
Customer service representatives have confirmed that my ex-wife was using the portal to make changes to my account without my knowledge or consent. Despite this, Credit Acceptance refuses to take responsibility or offer any resolution, citing my supposed acknowledgment of responsibility when signing up for the portalsomething I did not do. Furthermore, they have refused to accept neglect on their part for not implementing proper and effective authentication methods. 
I have provided Credit Acceptance with a copy of the Divorce Decree, which clearly states that my ex-wife was required to remove a vehicle I co-signed for from my name within 30 days. Although they initially confirmed that the Decree would warrant an investigation, they later informed me that there was nothing they could do. This indicates that, despite acknowledging fraud and validating my claims, Credit Acceptance has taken no action to resolve the matter.

In addition to these issues, I have discovered several critical security flaws with Credit Acceptance 's website and customer portal. These flaws expose personal data and make it vulnerable to unauthorized access. Some of the most concerning issues include : Outdated Software : Credit Acceptance is using Angular XXXX, which is outdated. The current version is XXXX. This version contains known vulnerabilities that are patched in more recent versions, which Credit Acceptance has neglected to update. 

Similarly, XXXX XXXX is outdated, with the current version being XXXX. This version is susceptible to vulnerabilities such as XXXX XXXX ( XXXX ) and other security flaws. 

Missing or Misconfigured HTTP Security Headers : The website and customer portal lacks proper implementation of Strict-Transport-Security ( HSTS ), which forces browsers to connect via HTTPS, leaving it vulnerable to man-in-the-middle ( MITM ) attacks. 

There are also missing or misconfigured SameSite cookies, which expose the website to Cross-Site Request Forgery ( CSRF ) attacks, potentially allowing attackers to impersonate users and perform unauthorized actions. 

Failure to Protect Consumer Data : Despite emphasizing the protection of personal data through federal law-compliant security measures, Credit Acceptance 's lack of recent security audits and failure to implement up-to-date security practices raises serious concerns about their commitment to safeguarding consumer information.

I am filing this complaint with the CFPB requesting that Credit Acceptance immediately provide proof of their most recent security audits and demonstrate the measures they have taken to protect customer data, as required by law. If Credit Acceptance refuses this request, I will ask that the Consumer Financial Protection Bureau ( CFPB ) consider this a clear indication of Credit Acceptances neglect and failure to protect their consumers at which point I will request that the complaint to be made public. I demand that Credit Acceptance remove the previous stated delinquencies from all three of my credit bureau reports based on the fact that Credit Acceptance has knowingly and willingly allowed fraud to take place via their customer portal and consistently refused to accommodate any requests that I have previously made.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation