It Depends What The Meaning of "Credit Report" Is
Bob Sullivan has a must-read article “Her ATM card, but her impostor’s picture” about a woman whose SSN is being used by someone else:
For years, Margaret Harrison believed she had an impostor. There were signs her Social Security number was living a double life. Four years ago, an unemployment office in West Virginia almost denied her claim, saying she already had a job at a horse farm in Chelan, Wash. Three years ago, a teller at Bank of America looked up her account number by her Social Security number and then asked, “Is your name Pablo?
It is an interesting form of fraud: Pablo needs to function in the US, and thus needs a Social Security/national ID number. It seems that he’s not abusing it today for fraudulent loans. What happens when he ups and leaves? Do these things suddenly flow to Ms. Harrison? Probably.
To me, the most interesting part is how credit agencies are interpreting the term “credit report” in different ways, depending on who’s buying them. Consumers get one form, businesses get another. Perhaps that’s not what Congress has intended with the variety of credit reporting laws it has passed.
I was speaking to someone I ran into at a function completely unrelated to infosec, and the exact same thing happened to her. A recent immigrant started using her SSN — to get employment, and he even paid income taxes using it. They knew where he lived, etc, and reported it to the police (who did zero). After four years, the guy apparently had assimilated enough that he decided to incur some debt under “his” SSN, upon which he defaulted…