Hacker News Reader

Comment by toomanyrichies | Hacker News Reader

> the best is to freeze your credit report

A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thieves already have all the info needed to unfreeze your credit?

View on HN

When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...

They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit.

What do you want to bet it uses stuff like your SSN to verify?

For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id.

[1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

Yeesh.

> Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms.

Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate.

edit: Driver's license numbers were also leaked in some cases. Fun.

Even worse: In a number of states, the DL number is deterministic based upon name and DOB.

http://www.highprogrammer.com/alan/numbers/dl_us_shared.html

I don't know if it's still the case, but Virginia used to your SSN as an ID. There was an opt-out for that, which I exercised about 25-30 years ago, so I don't know if that policy is still in place.

There was no mention made that unfreeze PINs were leaked. When you freeze your report with the three CRAs, you are given an unlock code or PIN needed to unfreeze it.

(At least for Equifax) you can get a new pin if you provide a basic form of identification. Guess what they accept? The very things that were stolen.

That's not clear from their help article about it [1], depending on what, in their definition, constitutes "proper identification forms":

"If you lose the PIN that was issued to you when you added the Security Freeze to your credit file, you may request a new one in writing. Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms."

[1]: https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.

Reply on news.ycombinator.com