I'm happy to see Experian fined. Last year, Experian kept sending me spam with the footer "This is not a marketing email" and I kept trying to unsubscribe. Eventually, I filed a complaint with the Consumer Financial Protection Bureau that this violated CAN-SPAM.
I'd like to think that my report contributed to this fine (although that's probably optimistic). In any event, Experian had to take the time to respond. They also canceled my unwanted "complimentary membership with Experian CreditWorks Basic", which ended the spam. So I recommend filing complaints if appropriate.
Your story sounded vaguely familiar to me, so I just looked in my email archive, and it appears I did the same thing around the beginning of 2021, when Experian also automatically signed me up for "CreditWorks" after I disputed fraud with them[0]. They were sending almost-daily spam. ("Your Dark Web scan is complete!" "Congrats, your membership's been upgraded!" "Important Information about your credit score!")
I wrote to the FTC instead of the CFPB, and got a form letter back for my efforts. Mail from *@*.experian.com is still blackholed, so I guess this is a good reminder that rule is there, if I'm ever required to deal with those assholes again.
[0] Supposed past-due electric utility account in a state in which I've never set foot, let alone owned or rented property. Interestingly, this only showed on my Experian report, but not TransUnion or Equifax, so I'm pretty sure it was a reporting mistake as opposed to intentional identity theft.
Ha! I recall the exact same thing happening to me. I guess they decided that if they sign people up for some nonsense service then there is a "business relationship" and they're free to spam all they want.
I’ve also had good results from reporting CAN-SPAM violations, or just threatening to. When I get marketing emails without a working unsubscribe link I send a message to customer support saying that I’ll report each subsequent email I get as a violation. In one case the violator didn’t offer email or chat based support so I just reported each email, and they quickly taped off before stopping entirely.
not only this but experian lets users sign up without confirming their email address.
someone registered on MY email address and I had to spend about 7 hours on multiple phone calls over a period of 5 weeks in order to get control of an account with my email address, all to turn off their incessant spam.
if you read their TOS technically you have to send a notarized letter with copy of photo ID social security number etc. etc. but thankfully i finally reached a human with a hint of reasonability.
This seems to have happened to me somehow. I was forced to sign up to unfreeze my credit report (after freezing it years ago without an account) and now it has 2FA configured with a phone number that isn't mine. I have no idea how that happened and now I'm concerned that a stranger has control over my account. Hooray!
I tried calling to reset my password, which pointed me back to the website. The only other option is to reset it by mail. Amazing.
Edit: and to top it off, the reset password page references a security question & PIN, without ever asking for those.
>If you do not know your security question or PIN, you will need to contact customer care to reset your password.
Edit 2: I just created a new account with a different email without a hitch. I got an email to the original address saying that there was a change to my account settings, leading me to believe that creating a new account simply changed the email address. Still no email confirmation though.
> if you read their TOS technically you have to send a notarized letter with copy of photo ID social security number etc. etc. but thankfully i finally reached a human with a hint of reasonability.
Does that mean if someone signs you up under a false name, it's impossible to unsubscribe under the rules-as-written?
In some dark future, you will need to sign up for all websites just to prevent someone for doing this very thing. "It's not our fault you didn't sign up and allowed a fraudster to do it."
I hope that wasn't me! To avoid their spam I changed my email address in their system to a bunch of random letters/numbers a year or 2 ago. I made it pretty long. If that was your email, I apologize.
I’m still bitter that a credit reporting agency let my information get stolen, then offered free credit monitoring through Experian, and Experian just seems to be using this free monitoring for upselling.
Hopefully this fine exceeds the revenue they generated from all this…
Experian once stole our credit card number, and wouldn’t stop making unauthorized charges to it.
Our bank was able to just block Experian, since Experian was a large percentage (“most”) of their fraud cases, and they didn’t want to pay to re-issue cards with new numbers.
A just punishment for Experian and other credit agencies is dissolution - these companies gain value purely through rent seeking and are publicly unaccountable while operating in an extremely important field. Either the costs of background checks should just be shifted directly onto banks or we should have a government run public ledger of defaulted debts.
They should fine them for credit triggers too, as the phone spam is atrocious. They legally sell your info and the fact you are looking for a loan to sketchy mortgage lenders who will spam you for weeks.
I know people who have experienced this firsthand, and it is terrifying. You can opt out of it, but nobody knows that until it's too late.
at least it is some accountability. i've recently gotten marketing emails from box.com that require a auth code to opt out. i'm not sure how that is legal
Seriously, it's ridiculous. There should be a one-click unsubscribe link at the bottom of every marketing email. You get click it, the email is immediately removed. None of this "please confirm your email" or "please wait ten days for processing" bullshit. Nobody is forwarding your marketing emails. It's not unreasonable to expect ESPs to generate the list at send time and not two weeks in advance.
For people cribbing about fine being too small think 100 dollar speeding fine bothers people earning 100K pa. I think it does, because fine is still lose of money no matter how small and fine also comes with further restrictions / penalties in case behavior does not change.
It's not just a monetary fine. There are various other requirements put on them, for example they are on the hook for additional record-keeping and compliance monitoring for 10 years, which probably means they need to be incredibly conservative about sending emails for at least that long.
A lot of marketing emails will have opt-out links on their HTML version, but the text version they send alongside it (if it's not just auto-generated from the HTML one) doesn't. I've sent fussy emails threatening GDPR and CAN-SPAM violation only to get confused replies telling me the link is right there, in [LOCATION]. Your opt-out needs to be accessible!
I'd like to think that my report contributed to this fine (although that's probably optimistic). In any event, Experian had to take the time to respond. They also canceled my unwanted "complimentary membership with Experian CreditWorks Basic", which ended the spam. So I recommend filing complaints if appropriate.