Forest Global Training Partners

Cyber Risks · Krebs on Security

It’s Still Easy for Anyone to Become You at Experian

Summary: KrebsOnSecurity reports that its author's Experian account was hijacked and that the only way to recover access was to recreate the account, because Experian still lets anyone re-register a credit file using the same personal information with a different email address. The process accepts any U.S. phone number or lets users skip phone verification via "Continue another way," asks three to five multiple-choice questions often drawn from public records, and sends the original email address only a notification after the change, while Equifax and TransUnion require a code sent to the email or phone on file before changes.

What you should know: Experian's own multi-factor authentication is defeated by the same flaw: a Mastodon reader reported that after re-registering with a new phone number, sign-in ran 2FA against the new number. Krebs notes Experian previously fixed a bypass that persisted for nearly seven weeks between Nov. 9 and Dec. 26, 2022, and that a 2015 breach affected 15 million customers.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related