Forest Global Training Partners

Cyber Risks · Krebs on Security

Scary Fraud Ensues When ID Theft & Usury Collide

Summary: An identity thief applied for a payday loan in a Krebs on Security reader's name in May 2021, and when the loan was never issued, intruders later used his existing record at tribal lender Mountain Summit Financial to push through a $1,000 loan at 546.56 percent interest over Thanksgiving weekend, with funds sent to a Bank of America account he did not recognize. MSF told him in a January 14, 2022 breach notification that an outsider may have accessed customer accounts and personal information including name, date of birth, government identification numbers, bank account and routing numbers, and that it was working with the FBI, the California Sheriff's Office, and the Tribal Commission for Lake County.

Key Takeaway: MSF approved and disbursed the loan without ever pulling his credit file, and because the company's authentication was based on email addresses, the fraud surfaced only when the intruders reused his real address rather than changing it. Had they changed it, the first notice would likely have come from a collection agency pursuing a defaulted loan he never requested.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related