Public Information - User Validation from Hades

[expatCanuck]

Anyone ever have to deal with identity validation screens -- that is, to validate your identity, you're asked to identify correct 'public information' about yourself?

On an issuer's site, after logging in, to access certain functionality (e.g. - contact info updates, balance transfer), I'm prompted to validate my identity  using public information questions (e.g. - height on my driver's license, county of the address where I've previously lived).  Now, I know the right answers, and am correctly selecting them, but when I supply them, the system displays a message that I've provided incorrect information.  

Does anyone have insight on how these systems work or, better still, how to resovle the issue?  I've been on the line with the issuer, and they don't seem to have a clue.

It could be incorrect source data (but where's that data coming from?) or incorrect programming, but how does one even begin to diagnose the issue?

Any & all insight welcome.

[Anonymous]

I pull ALL of my credit reports free annually, including third party verifiers such as Lexis Nexis, etc.  Most of those identity questions come from the alt-CRAs and their reports, so getting your reports and cleaning them up helps pass future ID walls.

One of my lenders used to ask me questions about my dad's second wife, who I have no relationship with, don't like, and really don't want to know anything about.  I took screen captures of those questions and advanced them to my attorney to draft up some paperwork against the lender.  Lender called me personally to negotiate a better outcome for them since the questions may have disclosed private third party information about someone other than me, but in the years since I have never seen anything else about her on my ID questions.

Kinda wish I turned over the evidence to dad's wife so she could sue the lender and ID company, though.  One regret for sure.

[expatCanuck]

I've been through the EX/EQ/TU reports.  They don't have (or, as far as I can see, don't display) data points like  DL height and county.

What are (the) alt-CRAs?  Is Lexis-Nexis one of them? (Their systems must be pretty slipshod to get hard data like height and county wrong. [I used to code for a living.])

[Anonymous]

---

@expatCanuck wrote:

I've been through the EX/EQ/TU reports.  They don't have (or, as far as I can see, don't display) data points like  DL height and county.

What are (the) alt-CRAs?  Is Lexis-Nexis one of them? (Their systems must be pretty slipshod to get hard data like height and county wrong. [I used to code for a living.])

---

PDF warning: http://lexisnexis.com/risk/downloads/idm/instantid-analyzing-results.pdf

"These sources include identity information from civil filings, property deeds, mortgages, phone directories, credit headers, utility records, driver license records, voter registration records, and many more."

InstantID is used by many lenders and banks to verify ID.  It is also used for some government contracts by the government and contractors.  I go over my LN report every year with a fine-toothed comb.

LN also provides something called  "motor vehicle report" which I believe includes DL data.

Equifax also has an ID report variety they offer outside of the consumer credit report that contains driver's license data.  You can request this data from Equifax separate from your consumer credit report.

TransUnion provides a report called "driver's history" which includes DL data, and they may also provide an ID verification product but I'm not sure.  You can request this report from TransUnion separate from your consumer credit report.  https://drivershistory.com/contact/fcra-disclosure-statement/

I believe there are 12 or 13 reports you can request for free annually that may include some or all DL data.

Note: When you apply for a banking account, investment account, credit card or loan, driver's license or other form of business transaction, you agree to let the other party provide your data to third parties.  THIS IS ALL DISCLOSED TO YOU in the application.  If you don't want to provide to third parties you can avoid it by not applying for products that report this information.

[expatCanuck]

---

@Anonymous wrote:

...

PDF warning: http://lexisnexis.com/risk/downloads/idm/instantid-analyzing-results.pdf

"These sources include identity information from civil filings, property deeds, mortgages, phone directories, credit headers, utility records, driver license records, voter registration records, and many more."

InstantID is used by many lenders and banks to verify ID.  It is also used for some government contracts by the government and contractors.  I go over my LN report every year with a fine-toothed comb.

...

---

Insanely helpful -- many thanks!! (Can't kudo that post enough.)

---

@Anonymous wrote:
...

Note: When you apply for a banking account, investment account, credit card or loan, driver's license or other form of business transaction, you agree to let the other party provide your data to third parties.  THIS IS ALL DISCLOSED TO YOU in the application.  If you don't want to provide to third parties you can avoid it by not applying for products that report this information.

---

Sure ... I'll just go without a bank account / 401K / credit card / mortgage / DL ...

---

[SBR249]

The CFPB calls them "specialty consumer reporting companies" and defines them as companies or agencies that collect specialized information about consumers and then generate reports that they sell to particular industries for specific purposes.

So for example the ChexSystem is one and they specialize in records about writing bad checks. Their customers are usually CUs and banks who utilize their reports to open deposit accounts for applicants. 

Other examples may include companies that collect employment records, insurance claims records, rent payments, utilities payments, etc. The CFPB actually publishes a list of these companies:

http://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf

The important thing to know is that by law, these companies must provide you with free access to your entire file once a year and they are required to at the minimum set up a toll-free telephone line for you to request access.

One final thing to note is that not all companies that collect data on consumers are considered reporting agencies and fall under the CFPB and FCRA regulations and not all reporting agencies will have a file on you. For instance if you've never been to a casino, you are unlikely to have a file open with a company that reports on gambling deadbeats or cardcounters. The CFPB actually doesn't recommend that you rush out and request a report from every single company on that list because it's just waste a lot of time most of the time, the sole exception they cite is in cases of identity fraud. 

[DaveInAZ]

---

@Anonymous wrote:

---

---

PDF warning: http://lexisnexis.com/risk/downloads/idm/instantid-analyzing-results.pdf

"These sources include identity information from civil filings, property deeds, mortgages, phone directories, credit headers, utility records, driver license records, voter registration records, and many more."

InstantID is used by many lenders and banks to verify ID.  It is also used for some government contracts by the government and contractors.  I go over my LN report every year with a fine-toothed comb.

LN also provides something called  "motor vehicle report" which I believe includes DL data.

---

Ah, interesting. A couple years ago when I was requesting a BT from Barclays online they asked me a couple questions about my sister. It freaked me out - she has really, really bad credit and usually has a few unpaid creditors trying to track her down, I get collections calls for her every so often, but at least the recorded "professional" ones - "If you're not Mary please hang up". Since I'm male & live alone I oblige and hang up. But I wondered how the heck they ever connected me with her, she lives in Ohio where we grew up, and I haven't lived in Ohio for 30+ years. Driver's license, when we both lived at our parent's house in the 1980s we both had that same address on our DL. I've had drivers license in 3 states since then, but Lexis Nexis must have a record of that OH DL from 30+ years ago. Big Brother at work.

[SBR249]

Not necessarily the drivers license though that may be true. Familial relationships show up on lots of publicly available databases. Every time someone put down a relative as next of kin or emergency contact that's a DP. Certainly there are government agencies that maintain records of families like the SSA. The connection could also be from records kept about your parents. 

Conversely, I think sharing an address probably isn't an automatic trigger for associating people as relatives considering sharing apartments and houses is a relatively common thing for unrelated people and even just using a friend's address as a mail drop is not unheard of. 

[expatCanuck]

Well, in any event, I've faxed the issuer (the phones just weren't cutting it) and asked it to advise what validation vendor / service they use, so that I at least have a shot at evaluating and correcting the data (or determining that they're implementation is flawed).

Stay tuned.