Consumer complaint received 2024-12-12 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Problem with a company's investigation into an existing problem — Their investigation did not fix an error on your report
Company: EQUIFAX, INC.
State: OH

Complaint narrative:
I have been actively disputing multiple negative items on my credit reports, including XXXX instances of 30-day late payments, XXXX instances of 60-day late payments, XXXX instances of 90-day late payments, and XXXX instances of 120-day late payments. Despite my repeated efforts to resolve this matter, XXXX XXXX has continuously refused to assist, with investigations ending in the response, " ultimately, there is nothing we can do. '' They have acknowledged fault on their recorded lines but have failed to take any corrective action, leaving me with a severely damaged credit score. This ongoing issue has significantly impacted my reputation and has prevented me from achieving personal goals I am entitled to as a responsible consumer. 

The issue originates from a divorce in 2021, during which XXXX XXXX failed to notify me directly of any late or missed payments. Upon discovering these negative items on my credit report, I contacted XXXX XXXX to investigate the situation. I learned that my ex-wife was able to authenticate changes to my personal information, preventing XXXX XXXX from sending me important notifications or communications regarding the delinquencies. As a result, I was unaware of these issues until they appeared on my credit report while applying for a mortgage. I requested that XXXX XXXX review their recorded calls and confirm that I had not been in contact with them nor authenticated any information since 2021. They acknowledged that I had not communicated with them directly nor authenticated via their portal, yet they insisted it was still my responsibility to address the loan. 
Customer service representatives have confirmed that my ex-wife was using the portal to make changes to my account without my knowledge or consent. Despite this, XXXX XXXX refuses to take responsibility or offer any resolution, citing my supposed acknowledgment of responsibility when signing up for the portalsomething I did not do. Furthermore, they have refused to accept neglect on their part for not implementing proper and effective authentication methods. 
I have provided XXXX XXXX with a copy of the Divorce Decree, which clearly states that my ex-wife was required to remove a vehicle I co-signed for from my name within 30 days. Although they initially confirmed that the Decree would warrant an investigation, they later informed me that there was nothing they could do. This indicates that, despite acknowledging fraud and validating my claims, XXXX XXXX has taken no action to resolve the matter. 
In addition to these issues, I have discovered several critical security flaws with XXXX XXXX 's website and customer portal. These flaws expose personal data and make it vulnerable to unauthorized access. Some of the most concerning issues include : Outdated Software : XXXX XXXX is using XXXX  XXXX, which is outdated. The current version is XXXX. This version contains known vulnerabilities that are patched in more recent versions, which XXXX XXXX has neglected to update. 

Similarly, XXXX XXXX is outdated, with the current version being XXXX. This version is susceptible to vulnerabilities such as XXXX XXXX ( XXXX ) and other security flaws. 

Missing or Misconfigured HTTP Security Headers : The website and customer portal lacks proper implementation of Strict-Transport-Security ( HSTS ), which forces browsers to connect via HTTPS, leaving it vulnerable to man-in-the-middle ( MITM ) attacks. 

There are also missing or misconfigured XXXX cookies, which expose the website to Cross-Site Request Forgery ( CSRF ) attacks, potentially allowing attackers to impersonate users and perform unauthorized actions. 

Failure to Protect Consumer Data : Despite emphasizing the protection of personal data through federal law-compliant security measures, Credit Acceptance 's lack of recent security audits and failure to implement up-to-date security practices raises serious concerns about their commitment to safeguarding consumer information. 
I am filing this complaint with the CFPB requesting that XXXX XXXX immediately provide proof of their most recent security audits and demonstrate the measures they have taken to protect customer data, as required by law. If XXXX XXXX refuses this request, I will ask that the Consumer Financial Protection Bureau ( CFPB ) consider this a clear indication of Credit Acceptances neglect and failure to protect their consumers at which point I will request that the complaint to be made public. I demand that XXXX XXXX remove the previous stated delinquencies from all three of my credit bureau reports based on the fact that XXXX XXXX has knowingly and willingly allowed fraud to take place via their customer portal and consistently refused to accommodate any requests that I have previously made.

Company response to consumer: Closed with non-monetary relief