How a game of cat and mouse with a hacker exposed a TransUnion security flaw that left consumers vulnerable to identity theft

This story starts with a fellow PIRG staffer, a victim of hacking who turned to us after noticing a potential flaw with the security practices of TransUnion, one of the “big 3” nationwide credit bureaus. We’re not naming the person to protect them from further hacking.

It starts with a data breach

It’s unfair, but it happens – way too often.

When bad guys get their hands on your leaked information, they can cause mayhem – pinning debt onto you that isn’t yours, hurting your credit score, or even committing crimes in your name. Rectifying the damage is time-consuming and exasperating.

Whether you think you may be a victim or not, you should take steps such as freezing your credit files to minimize potential damages before it’s too late. But what happens when a consumer does everything right, yet a credit bureau – the entity that holds the keys to the consumer’s reputation and ability to obtain credit in the future – doesn’t? 

In the case of one consumer, a cat and mouse game with an identity thief uncovered a flaw in TransUnion’s security practices. 

It’s a situation that never should have happened. And it illustrates why consumers need and deserve more effective protection for the privacy of their critical information.

“Thank you for updating your login information”

Our colleague first realized something might be wrong when they received an unprompted email alert from TransUnion addressed to somebody else, thanking them for updating their account login information. 

After unsuccessfully trying to log in and recover their account using TransUnion’s website, they called TransUnion’s customer support and was able to easily regain access to their account by providing basic information an identity thief might possess, allowing them to bypass two-factor authentication or other security measures.

Unfortunately, the hacker simply changed the account info again, starting a game of cat and mouse that continued for weeks. 

So they asked U.S. PIRG what to do

We investigated how a thief could bypass two-factor authentication to get into an account. 

We called TransUnion’s customer service and were also able to change our own login information by simply providing phone representatives with our Social Security number, birthdate, current email address on file, and numerical part of our street address – all personally identifiable information that unfortunately is available to identity thieves due to countless data breaches. 

Even more concerningly, we were able to make those changes by having a two-factor authentication code sent to a phone number not on file and other times without a code sent to any number or email address at all. Furthermore, after changing our email addresses on file with phone representatives, we received email notifications about the changes to the new email address, not the one originally on file. And we did not receive any text notifications about the changes. 

That easy, over-the-phone account recovery process wasn’t something to be grateful for – it’s a glaring security flaw to be alarmed about. 

In the case of the PIRG staffer, it’s still unclear how the hacker accessed their account since they were able to receive email notifications about the changes. 

The risk to consumers

The security flaw we confirmed left consumers vulnerable to identity thieves who could have:

• Lifted a credit freeze if one was in place and applied for credit accounts in their name, 
• Disclosed sensitive information on their credit reports, such as open accounts, debts, bankruptcies, and foreclosures, and
• Accessed loan history information on their credit reports, which could be used to answer security questions that might be asked to access accounts at other credit bureaus or organizations that rely on out-of-wallet personal information. 

Getting the flaw fixed

It only took one short phone call to exploit a major security flaw. After conducting our tests, we called on TransUnion to address this flaw and enhance their security protocols. When we didn’t hear back, we reached out to Shira Ovide at the Washington Post, who investigated. TransUnion told Ovide that in response to our findings, it made some security changes but not until several weeks after we first notified them. 

We found that phone representatives now ask additional identity verification questions to change information over the phone. These might be questions generated from sources like your credit report, or the “secret question” you set up in your TransUnion account. While this appears to fix the flaw by adding a layer of security before an email address on file can be changed, notifications about such a change were still only sent to the new address on file. That means if a hacker still managed to change your login info after calling customer service, you wouldn’t know it. Ovide wrote about our findings in a Washington Post story. 

It’s a problem that there was a flaw in the first place, and it’s a problem that it took so long to get fixed. We urge TransUnion to make sure this doesn’t happen again by implementing more robust protocols to identify and prevent vulnerabilities like this in the future. Notifications should also be sent to both the email and phone number most recently on file whenever an account change is made over the phone or online.

Actions you can take

You can check if someone has hacked your TransUnion account by trying to log into it. If you’re not able to log in, and the website offers to send you an account recovery code to a phone number or email address that isn’t yours, then you should call TransUnion at 833-806-1627 to change your info and get back into your account.

Whether you’ve experienced this security flaw or not, there are other steps you can take to safeguard your personal information from identity theft in general. Here are some tips:

1. Freeze your credit files with all three credit bureaus. This prevents a thief from opening credit in your name. You can do this by phone or online. 
2. Check your credit reports regularly to make sure there are no credit card accounts, loans, or credit inquiries you don’t recognize. Go to annualcreditreport.com or call 1-877-322-8228. You can check your reports once a week at no charge by federal law.
3. Turn on two-factor authentication for any online account that offers it.
4. If you receive calls, texts, emails, or letters you weren’t expecting about a compromised account, don’t answer or click on links; instead find and use the official website and phone number. 
5. Don’t use the same password for more than one online account.
6. Report identity theft to the Federal Trade Commission at identitytheft.gov.