Experian Bug Exposed Security Pins That Shielded Credit Reports

Oct 6, 2018

This post contains references to products from one or more of our advertisers. We may receive compensation when you click on links to those products. Terms apply to the offers listed on this page. For an explanation of our Advertising Policy, visit this page.

After a wild year of Equifax recovering from its massive data breach, which exposed personal information of millions of Americans, a new credit reporting bureau is in hot water.

A report by NerdWallet has revealed a serious flaw in Experian’s security system, which was supposed to protect the pins of customers who wanted to unfreeze their credit reports.

Experian explains what a credit freeze is on its website, but issues in its own system allow criminals to do exactly what the company says a credit freeze is supposed to prevent in the first place:

“A security freeze will prevent potential lenders from accessing your credit report, stopping a thief from opening an account or getting credit—even if they have your personal information,” Experian writes. 

Experian’s system issued consumers a PIN to access their frozen credit reports. However, if a consumer forgot their pin and wanted to retrieve it, they had to answer a set of security questions. Anyone could potentially access your report because Experian would accept a blanket “None of the above” answer to these questions.

Once someone had access to an account they could unfreeze the credit report and start to open credit cards in customers’ names — pending other personal details like social security number and date of birth.

“This means that even if you had taken the step to freeze your Experian credit report, an identity thief could have unfrozen it and still tried to open a credit account in your name,” Mike Litt, a director for consumer group PIRG, told Yahoo Finance.

Experian confirmed the loophole did exist.

“While we are confident that our authentication is secure and no credit files are at risk, we have taken additional steps to make the process more secure,” Experian said in a statement. “We continue to regularly monitor our systems, taking immediate action when warranted to strengthen data security.”

Many consumers took advantage of credit freezes in the wake of the Equifax breach in hopes of protecting their identity and credit score. The Equifax breach exposed more than 148 million Americans’ personal data including their social security number, address and more.

Since a credit freeze may not even protect your information it’s important to routinely check your credit report to ensure that no new accounts have been opened in your name. A slew of banks like Chase, Citi and Capital One allow you to check your credit score for free through their websites.

Featured image by i_frontier / Getty Images.

Chase Sapphire Preferred® Card

WELCOME OFFER: 80,000 Points

TPG'S BONUS VALUATION*: $1,650

CARD HIGHLIGHTS: 2X points on all travel and dining, points transferrable to over a dozen travel partners

*Bonus value is an estimated value calculated by TPG and not the card issuer. View our latest valuations here.

Apply Now
More Things to Know
  • Earn 80,000 bonus points after you spend $4,000 on purchases in the first 3 months from account opening. That's $1,000 when you redeem through Chase Ultimate Rewards®. Plus earn up to $50 in statement credits towards grocery store purchases within your first year of account opening.
  • Earn 2X points on dining including eligible delivery services, takeout and dining out and travel. Plus, earn 1 point per dollar spent on all other purchases.
  • Get 25% more value when you redeem for airfare, hotels, car rentals and cruises through Chase Ultimate Rewards®. For example, 80,000 points are worth $1,000 toward travel.
  • With Pay Yourself Back℠, your points are worth 25% more during the current offer when you redeem them for statement credits against existing purchases in select, rotating categories.
  • Get unlimited deliveries with a $0 delivery fee and reduced service fees on eligible orders over $12 for a minimum of one year with DashPass, DoorDash's subscription service. Activate by 12/31/21.
  • Count on Trip Cancellation/Interruption Insurance, Auto Rental Collision Damage Waiver, Lost Luggage Insurance and more.
  • Get up to $60 back on an eligible Peloton Digital or All-Access Membership through 12/31/2021, and get full access to their workout library through the Peloton app, including cardio, running, strength, yoga, and more. Take classes using a phone, tablet, or TV. No fitness equipment is required.
Regular APR
15.99%-22.99% Variable
Annual Fee
$95
Balance Transfer Fee
Either $5 or 5% of the amount of each transfer, whichever is greater.
Recommended Credit
Excellent/Good

Editorial Disclaimer: Opinions expressed here are the author’s alone, not those of any bank, credit card issuer, airlines or hotel chain, and have not been reviewed, approved or otherwise endorsed by any of these entities.

Disclaimer: The responses below are not provided or commissioned by the bank advertiser. Responses have not been reviewed, approved or otherwise endorsed by the bank advertiser. It is not the bank advertiser’s responsibility to ensure all posts and/or questions are answered.