Consumer complaint received 2026-03-24 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Credit inquiries on your report that you don't recognize
Company: EQUIFAX, INC.
State: NC

Complaint narrative:
SWORN STATEMENT OF IDENTITY THEFT AND FRAUDULENT IMPERSONATION BY AT-LARGE ASSAILANTS Prepared for Submission to Law Enforcement and the Consumer Financial Protection Bureau XXXX CFPB ) CONFIDENTIAL FOR LAW ENFORCEMENT AND REGULATORY USE ONLY SECTION XXXX : VICTIM IDENTIFICATION VICTIM PERSONAL IDENTIFYING INFORMATION Full Legal Name : [ REDACTED On File with Filing Agency ] Social Security Number : [ REDACTED On File with Filing Agency XXXX XXXX & # XXXX ; XXXX License Number : [ REDACTED On File with Filing Agency ] State of Issue : North Carolina XXXX XXXX : STATEMENT OF FACTS I hereby declare under penalty of perjury that the following is true and correct to the best of my knowledge and belief. I am submitting this sworn statement to support a law enforcement identity theft report and a formal identity theft complaint with the Consumer Financial Protection Bureau ( CFPB ). My personal identifying information including my full legal name, Social Security number, date of birth, driver & # XXXX ; XXXX license number, home address, email address, and T-Mobile telephone numbers has been compromised through a series of confirmed, publicly documented data breaches affecting major credit bureaus, data broker companies, and telecommunications providers between XXXX and XXXX. My information was contained within the compromised datasets of each of the breaches identified in XXXX XXXX of this document, to a degree and capacity that is currently unknown and XXXX be ongoing. As a direct and proximate result of these breaches, XXXX ( XXXX ) at-large, unidentified assailants have been actively using my stolen identity to fraudulently represent themselves as me since approximately XXXX. These individuals are in possession of sufficient personal information including but not limited to my Social Security number, date of birth, driver & # XXXX ; XXXX license number, home address, email address, and IDENTITY THEFT VICTIM STATEMENT | XXXX XXXX XXXX XXXX | FOR LAW ENFORCEMENT & amp ; CFPB USE ONLY telephone numbers to convincingly pass identity verification checks across a wide range of businesses, financial institutions, government agencies, and service providers. Due to the extensive volume and accuracy of the stolen information available to the assailants, it is extremely difficult and in many cases practically impossible for businesses and organizations to detect, through standard verification procedures, that the individual presenting my credentials is not, in fact, me. SECTION XXXX : METHODS OF FRAUDULENT IMPERSONATION The assailant ( XXXX ) have employed the following multi-channel tactics to impersonate me across multiple jurisdictions. The sophistication and breadth of these methods is directly attributable to the comprehensive personal data made available to them through the data breaches documented herein : A. Falsified Government Identification and Documents The assailant ( XXXX ) have been providing falsified government-issued identification including driver & # XXXX ; XXXX licenses and identification cards bearing my personal information ( name, address, date of birth, Social Security number ) while displaying their own photograph or altered images. These fraudulent documents have been presented to businesses, financial institutions, rental agencies, law enforcement, and other entities that rely on photo identification as a primary form of verification. Because the biographical data on the fraudulent documents matches my legitimate records held by credit bureaus, data brokers, and government databases, these documents are extremely difficult to detect without biometric or forensic verification. The assailants have been operating with these materials since at least XXXX and XXXX have refined their documentation over time as additional breached data became available. B. Phone Number and Two-Factor Authentication Exploitation My XXXX telephone numbers ( XXXX ) XXXX and ( XXXX ) XXXX were exposed through XXXX & # XXXX ; XXXX multiple confirmed data breaches in XXXX, XXXX, and XXXX. The assailant ( XXXX ) have used these phone numbers to receive one-time passwords ( OTPs ), SMS verification codes, and two-factor authentication ( XXXX ) confirmations, allowing them to create or access accounts in my name across financial, retail, and government platforms. Through SIM-swapping techniques or unauthorized account access, these numbers XXXX have been redirected to devices controlled by the assailants, enabling real-time interception of verification messages intended for me. XXXX Email Address XXXX XXXX email address has been exposed through the data breaches documented in this statement. The assailant ( XXXX ) have used this email address to create, verify, or recover accounts fraudulently opened in my name. IDENTITY THEFT VICTIM STATEMENT | XXXX XXXX XXXX XXXX | FOR LAW ENFORCEMENT & amp ; CFPB USE ONLY This email has been used in conjunction with my phone numbers to satisfy multi-factor authentication requirements, giving the assailants a near-complete account access and recovery capability. XXXX XXXX Address Monitoring and Mail Interception My home address is known to the assailants as a direct result of the data breaches listed herein, several of which exposed historical and current address data. The assailant ( XXXX ) are believed to be monitoring mail delivery to my address through XXXX XXXX XXXX or similar postal tracking services, obtaining advance digital notice of incoming mail, financial documents, account statements, and new payment cards. This allows them to intercept critical financial and identity documents including credit cards, account notifications, and government correspondence without requiring physical presence at my address at the time of delivery, and without my knowledge. This method effectively disables the mail-based notification systems that would otherwise alert me to fraudulent account openings, changes to existing accounts, or other unauthorized activity. XXXX Complete Identity Package Cascading Breach Exploitation By combining data from multiple breaches SSN ( Equifax XXXX, XXXX XXXX XXXX XXXX, TransUnion XXXX ), address history ( National Public Data XXXX ), phone and account data ( XXXX XXXX XXXX ), driver & # XXXX ; XXXX license data ( XXXX XXXX, TransUnion XXXX ), and full credit report access ( XXXX XXXX ) the assailants have assembled a complete, current identity package. This comprehensive data set enables the assailants to answer knowledge-based authentication ( KBA ) security questions that financial institutions and credit bureaus use for identity verification including questions about past addresses, loan amounts, vehicle registrations, and account histories. The cumulative effect of multiple breaches means that each new incident added more detail and currency to the assailants & # XXXX ; identity package, progressively making their impersonation more convincing and harder to detect. SECTION XXXX : DATA BREACHES INFORMATION COMPROMISED The following publicly confirmed data breaches are identified as sources through which the personal identifying information of " REDACTED '' was compromised. The victim & # XXXX ; XXXX information was contained within the affected datasets of each breach listed below to an extent that is currently unknown. Each breach independently contributed to the complete identity profile now being exploited by the assailants identified in this statement. Company / Entity Year Data Exposed / Incident Summary Victim Exposure Status Equifax XXXX XXXX, XXXX, addresses, driver & # XXXX ; XXXX licenses, credit history XXXX XXXX Americans affected DATA COMPROMISED IDENTITY THEFT VICTIM STATEMENT | XXXX XXXX XXXX XXXX | FOR LAW ENFORCEMENT & amp ; CFPB USE ONLY XXXX XXXX Account data, SSNs, billing addresses, phone numbers XXXX XXXX records exposed DATA COMPROMISED XXXX XXXX XXXX, XXXX, driver & XXXX XXXX ; XXXX license, IMEI numbers, phone account data XXXX XXXX customers DATA COMPROMISED XXXX XXXX Full credit reports exposed via IDOR vulnerability for all XXXX consumers 47 days XXXX unauthorized access DATA COMPROMISED XXXX XXXX Consumer account hijacking identity thieves could re-register any account using a different email address DATA COMPROMISED XXXX XXXX Names, addresses, identity numbers, phone numbers, credit scores approximately XXXX XXXX consumers DATA COMPROMISED XXXX XXXX Account data, billing addresses, contact info XXXX XXXX XXXX customers affected DATA COMPROMISED XXXX & amp ; XXXX XXXX XXXX ransomware XXXX XXXX XXXX & amp ; XXXX XXXX business and consumer data accessed DATA COMPROMISED TXXXX XXXX Names, credit scores, loan balances, passport info, employer data XXXX consumer records ( XXXX XXXX ) DATA COMPROMISED AT & amp ; T XXXX SSNs, account numbers, passcodes, contact data XXXX XXXX current and former customers DATA COMPROMISED National Public Data XXXX XXXX, full name, historical addresses, relatives & # XXXX ; data approximately XXXX XXXX records stolen DATA COMPROMISED XXXX / XXXX XXXX XXXX, XXXX, XXXX & # XXXX ; XXXX XXXX number, contact info XXXX individuals ; breach occurred XX/XX/XXXX, disclosed XX/XX/XXXX DATA COMPROMISED XXXXn XXXX SSNs, DOBs, names XXXX XXXX XXXX. consumers via XXXX vendor compromise ( breach date : XX/XX/XXXX ) DATA COMPROMISED IMPORTANT NOTE : The above list reflects publicly confirmed, documented breaches as of the date of this statement. The actual scope of compromise XXXX be broader, as additional incidents XXXX not have been publicly disclosed, and data aggregators routinely combine information from multiple breach sources. The victim & # XXXX ; XXXX inclusion in each breach is based on documented exposure of personally identifying information matching his profile during the timeframes in which he was an active consumer of each affected service. SECTION XXXX : ONGOING HARM AND CONTINUING IMPACT IDENTITY THEFT VICTIM STATEMENT | XXXX XXXX XXXX XXXX | FOR LAW ENFORCEMENT & amp ; CFPB USE ONLY The identity theft being perpetrated against XXXX XXXX XXXX XXXX is active and ongoing as of the date of this statement. The harm is not limited to any single fraudulent transaction but constitutes a continuing course of criminal conduct with compounding effects : Fraudulent accounts opened in the victim & # XXXX ; XXXX name across financial, retail, telecommunications, and government service platforms, potentially spanning multiple counties and states. Damage to the victim & # XXXX ; XXXX credit profile through unauthorized account openings, unauthorized hard credit inquiries, and derogatory reporting by entities deceived by the assailants. Potential criminal record contamination the assailants XXXX be using the victim & # XXXX ; XXXX identity in connection with law enforcement encounters, arrests, or court proceedings, creating false criminal or warrant records tied to the victim & # XXXX ; XXXX name, XXXX, or driver & # XXXX ; XXXX license number. Ongoing interception of postal and electronic communications, depriving the victim of the ability to detect and respond to fraudulent activity through normal notification channels. Permanent compromise of core biographic identifiers SSN and date of birth can not be changed ; driver & # XXXX ; XXXX license number is extremely difficult to change meaning the risk of future harm is indefinite and ongoing. Substantial time, financial, and psychological burdens imposed by the continuous need to monitor, dispute, and remediate fraudulent activity across multiple accounts, agencies, and jurisdictions. XXXX VI : REQUESTED LAW ENFORCEMENT AND REGULATORY ACTIONS A. Police Report Multi-County Filing A formal identity theft police report should be filed in XXXX XXXX in which the assailants have been identified as, or are reasonably suspected of, impersonating XXXX XXXX XXXX XXXX. A report must be filed in XXXX XXXX, NC ( XXXX ) as XXXX XXXX of the victim & # XXXX ; XXXX residence and the primary jurisdiction for address-based mail interception and local fraud. XXXX XXXX & # XXXX ; XXXX report should reference this sworn statement, the CFPB Identity Theft Report, and all breach documentation herein. Law enforcement is requested to investigate whether the assailants have used the victim & # XXXX ; XXXX identity in connection with any law enforcement encounters, criminal proceedings, or warrant activity and to correct the record accordingly. B. XXXX XXXX XXXX XXXX. XXXX XXXX XXXX ( XXXX ) : XXXX is requested for investigation of mail monitoring, mail theft, and mail fraud under XXXX XXXX. XXXX and XXXX. Federal Trade Commission ( FTC ) : Identity Theft Report at identitytheft.gov should be filed in conjunction with this sworn statement. Federal Bureau of Investigation ( FBI ) Internet Crime Complaint Center ( XXXX ) : Referral is recommended given the multi-state, multi-platform, and financially motivated nature of the fraud. All applicable state and federal identity fraud statutes should be referenced, including XXXX XXXX. XXXX ( XXXX XXXX ) and N.C.G.S. XXXX ( Identity Theft ). IDENTITY THEFT VICTIM STATEMENT | XXXX XXXX XXXX XXXX | FOR LAW ENFORCEMENT & amp ; CFPB USE ONLY XXXX CFPB Identity Theft Report and Credit Bureau XXXX A formal Identity Theft Report will be simultaneously filed with the Consumer Financial Protection Bureau ( CFPB ) at identitytheft.gov or XXXX. The CFPB report, combined with this sworn statement and accompanying police report numbers, constitutes a legally recognized Identity Theft Report under the Fair Credit Reporting Act ( FCRA ), entitling the victim to : extended fraud alerts ( 7 years ), identity theft blocks on fraudulent tradelines, copies of fraudulent account applications, and the right to stop debt XXXX from collecting debts resulting from identity theft. Security freezes should be placed with all three major credit bureaus ( Equifax , XXXX XXXX ) and specialty bureaus including XXXX XXXX XXXX, XXXX, XXXX, and XXXX. Copies of this document and the accompanying police report numbers should be submitted to each bureau to trigger block and investigation procedures under FCRA XXXX. SECTION XXXX : SWORN DECLARATION AND SIGNATURE I, declare under penalty of perjury under the laws of the United States of America and the State of North Carolina that the foregoing is true and correct to the best of my knowledge, information, and belief. I am the victim of identity theft as described herein. I did not authorize the use of my personal information by any of the parties referenced in this document. I authorize law enforcement, the CFPB, the FTC, and any relevant agency or financial institution to use this document in connection with the investigation and remediation of the identity theft described herein.

Company response to consumer: Closed with explanation