Identify Theft - someone set up credit monitoring via Credit Sesame with Experian in my name/address using different email address. Fraud.
I have contacted Experian to dispute inquires made by Credit Sesame Inc (four in the last few weeks). I called Credit Sesame and requested to stop/block monitoring my credit report. I have no confidence that this will occur as the person would not give me a name or confirmation number (although they did say the would stop monitoring. I wanted to talk with their fraud dept. but was told he was the only person I could talk with) It was scary how easy it was to request the block and to have them indicate they would stop the inquiries...all I was asked to provide was my name, address and my email address. I then found out the original online request for monitoring (done fraudently by someone) was done on line with an email address that is not mine!!!
I read the other complaints and it looks like I am not the first person who has had their credit monitored by this company and had not requested it.
I would like written confirmation that they will not access or monitor my credit report and I would like their business practices to be investigated as obviously they do not have enough checks in balances in place to determine the validity of the person making said request.
Written letter confirming that they have ceased monitoring my credit report as I did not authorize it.
Investigation into to their business practices so that consumers such as myself are protected!!!!
Business' Initial Response
Please find copy of the contents of a letter that will be forwarded to Ms. ******* to address her concerns regarding an account opened fraudulently in her name.
Dear Ms. *******:
We did receive your case #XXXXXX from the Better Business Bureau and we do regret that Credit Sesame may have been used to improperly create an account in your name without your authorization. The account in question was deleted at your request and as such it can no longer be accessed and we are no longer actively monitoring your credit.
Please be aware that while we do provide consumers credit information such as their credit score and account balance information, we do not disclose vital personal information or account numbers in your account that could be used to further perpetrate fraud. In addition, Credit Sesame does not issue new credit and credit accounts could not have been created from within your account.
As a credit services provider, Credit Sesame does operate in full compliance with the requirements of Experian as well as applicable state and federal laws. We are audited annually for security and compliance by Experian as well as Verisign to ensure that we meet the highest standards of identity verification and computer security.
Credit Sesame is a very concerned with the fraudulent misuse of our site and has several layers of protection beyond what is required by law. You should know that in order for an ID thief to create an account in your name on Credit Sesame, they must have been able to provide your full name, address and social security number which we forward to Experian for confirmation. In addition to verification of this personal information, we also require the user creating the account to answer 3-5 "out of wallet" identity verification questions that further confirm the identity of the user. Although not required by law or by Experian, we further utilize a device identification service, Iovation. Iovation monitors computers that have been known to have been used to perpetrate fraud and checks for high-risk characteristics like masked IP addresses or mismatch between the time zone on the computer and its geolocation.
Unfortunately, in your case it appears that despite all of our protection mechanisms ID thieves may have been able to create an account using your information. It is likely that they could further exploit the information that they may have so we do recommend that you consider placing a security freeze on your credit file with all three credit bureaus if you have not done so already.
Should you wish to discuss this matter further, please feel free to contact me directly at (XXX) XXX-XXXX.
Director of Operations
Credit Sesame, Inc.
Consumer's Final Response
(The consumer indicated he/she DID NOT accept the response from the business.)
My reply is twofold:
1. I accept the written statement indicating that the company will cease monitoring my credit report.
2. I understand the authentication protocol outlined in the company's letter. Yet when I called there was no authentication of who I was as a caller. All I gave was my name, address and the correct email address (not the one in your records). And based on that information I was told the company would stop monitoring my account. I filed this report as based on the lack of professionalism in handling my call I had serious doubts about their follow through in ceasing to monitor my account and my concerns regarding identify protection.
I accept the letter regarding confirmation of ceasing to monitor my account.
I would like the company to address why their identification protocol was not in place when I originally called. It lays the foundation to wonder if protocol is being followed in practice in other areas.
Business' Final Response
This response is to clarify for Ms. ******* our procedures in regards to account deletion. Given the sensitive nature of credit data, Credit Sesame's policy to make inaccessible any account where there is a suspicion that it may have been opened fraudulently. We received email from Ms. ******* claiming that that a Credit Sesame account was opened in her name and she did not open the account. In that case, we do ask to confirm the user's name and address. In her case, the account was under a different address but in the same city. When we have this discrepancy, we check the information that the users provides to the underlying information that is contained in the users credit file data that was passed ***** by Experian. If we are able to corraborate the address information, as we were able to do in Ms. *******'s case, we delete the account. If we are unable to match the information we in some cases do need to ask for more personal information such as date of birth or SSN, but in Ms. *******'s case this was not required. I hope this serves to clarify our procedures.