Hacker News Reader

Comment by BugsJustFindMe | Hacker News Reader

Fun fact from the trenches: I tried enrolling online for their post-hack free 1 year identity monitoring offer, but when it came time to verify myself by answering questions they clearly started asking me questions about someone else's profile because none of the questions made any sense. Then when I answered wrong (of course, because I'm not whoever that person is) I was given a phone number to call instead.

Combine that info with https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri... and it's enough to throw one into paroxysms.

This chaos is maddeningly absurd, and in a just world their business would be completely shut down by the government.

View on HN

>but when it came time to verify myself by answering questions they clearly started asking me questions about someone else's profile because none of the questions made any sense

Just a note, this most likely is not what happened. Identify verification questions typically will ask questions like "Who is your current house mortgage with?" when you have none and they will include a "None of the above" answer, which you're supposed to pick. It's totally intentional.

Yes, but man is it confusing. The question should be something like "Do you have a home mortgage and if so who is it with?"

It's supposed to look real so people who aren't you fail the question. They will think, "well he lives near X or uses Y for something else, so it's probably that one". There isn't any indication that it may be false.

I don't understand your complaint at all. Phrasing the question differently doesn't deter people who are guessing, but it does deter people who don't understand what is being asked! People clearly (myself included) get confused at those questions and think they're incorrect - so change the question. Doing so doesn't make it harder to guess the answer, but it does make it easier to show that you know the right answer.

When I went through one of these there was NO none of the above answers. Basically, you're screwed because you realize they are asking about someone else who was at your address 50 years ago, who drives a motorcycle (no option to say no such thing), has 3 kids who had college loans (no answer to say no such thing), and is on their 3rd housing mortgage (no option to say no such thing).

And what else can you do? You select randomly and then pass the 'id verification' with flying colours and then on the phone with the customer service rep, you verbally refute each one. The service rep says that they don't see any on that on their end.

Basically, it's like a web script that's not hooked up to anything in the backend... Like their recent "has your information been leaked" web forms.

I suspect that's the case across the entire industry.

I recently tried to dispute something on my Equifax report and I could not get past the verification stage. The answers to all the questions were obvious, but after failing the verification several times, I started wondering, "Did I open an account with x, y, or z back in 2011?"

The best ones are where you did legitimately open a credit line 20 years ago with some store but the list of options only include the backing bank's name ("BANCORP BANK, INC").

Most of those questions have a real answer available. They'll occasionally toss in ones where you have to enter "none," but most aren't like that. If you got something where every single correct answer was "none," something probably got screwed up. Otherwise it would be way too easy to spoof!

I had an interesting experience with these 'trick questions' doing the Creditkarma signup - I was asked four questions, three of which were fakes ('none of the above'), only the last question was legitimate. Either that's a random edge case, or a very sneaky intentional design...

Barclays' "3D Secure" asks two questions when verifying an online purchase and I can only recall a single occasion when one wasn't 'none of the above'.

It does ask for your sort code as a third question though, that's a one in four chance if you were picking randomly.

I've done identity verification dozens of times. I know how that works. The questions they asked were more specific and therefore more wrong. More along the lines of "Who owns the mortgage on your house at address 1234 Abcd Rd, Somecity, Somestate, 991234?" and "You made your last college loan payment on <wrongdate>. Which lender was it to?" Because my thought is "House? Where? When?" And when that happens for every question one gets miiighty suspicious.

Also another crazy thing is freezing your credit is meaningless with Experian. You and or any hacker can get your freeze pin by using your personal info that is now public. They don't even bother with any two way verification offering!

https://www.experian.com/ncaconline/freezepin

We are so screwed by these laggards!

>and in a just world their business would be completely shut down by the government.

They should apply HIPAA rules to data that can be used for identity theft.

For the uninitiated (as I was): it’s a set of rules that determine how medical records must be stored, and the consequences associated with leaking them: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad...

Page 24 specifies “Amount of a civil money penalty”.

> in a just world their business would be completely shut down by the government.

Or, hopefully, just sued into bankruptcy.

Beware! If you sign up for their free identity monitoring, they make you forfeit your write to sign onto a class action lawsuit over the breach!

On mobile now, but they clarified somewhere that forfeitification does not apply to this particular hack, after getting lot of heat.

That's right. You'd only be forfeiting the right to sue in the event that they get hacked again. Which to be fair is looking decently probable at this point.

Edit: I would like to know at this point, which got taken down faster after it was first reported on... This tweet, or the perfectly fine video interview of CISO Susan Mauldin with the Cazena CEO from 2016 before the breach? That one went down quickly after it was reported on by Hollywood LA News.

It's gotta be close. I believe that both were taken down in less than 24 hours.

Glad to hear that! Thanks for giving clarification.

Reply on news.ycombinator.com