This summer, credit rating reporting giant Experian is changing its security protocols to make it more difficult for end users to log in to their system, in a move that will affect loan officers, brokers and others who routinely pull consumer credit reports.
All Experian users and resellers must adopt the new system by July 15.
The move was fueled by “concern over a growing number of attempts to obtain and misuse logon credentials by identity thieves,” Experian said in an internal letter distributed to resellers. In order to combat this, the firm is requiring resellers and users of its own portal to use some variety of “multi-factor authentication.”
Experian spokeswoman Susan Henson told Banker & Tradesman the company “is committed to maintaining high standards for data security, and continuously reviews its policies and procedures to look for opportunities to enhance security and data access practices.”
Multi-factor authentication systems require using a combination of something a person knows, something a person has, and/or something a person is, in order to access a system. For example, the person could type in a password (something they know) and speak into a voice pattern recognition recorder (something they are). Other multi-factor authentication methods include the use of hardware tokens (usually a keychain fob with a USB stick incorporated) which generate a one-time “token” that allows access when coupled with a password.
Cost/Benefit Analysis
Local industry professionals seemed to be taking the measures in stride.
“It would certainly put one more burden on us in order to procure credit history for a consumer, but based on what we went through with the data security law that the commonwealth passed last year, so long as the company gave us the proper protocol, we could integrate those changes pretty seamlessly,” said Kevin Sears, co-broker/owner of Sears Real Estate in Springfield, and the 2010 president of the Massachusetts Association of Realtors.
And some welcomed any improvements in security, despite the practical concerns.
“The problem is, identity theft, even with all these safeguards, is running rampant,” said Jackie Sulfaro, president of Medford-based mortgage brokerage Constitution Financial Group and past president of the Massachusetts Mortgage Association. “I’m sure people are looking to make these changes for the better, because it is still happening.”
The hardware tokens and “digital certificates” which can identify the particular computer associated with a user are the two primary, multi-factor authentication methods Louis Capobianco, president of West Haven, Conn.-based credit services reseller Avantus, said his company is using to comply with Experian’s requirement.
The two solutions have different costs and benefits, and his firm recommends different solutions for different customers. For instance, brokers or others who travel and frequently work at different computers might find digital certificates cumbersome.
“I think banks or a credit union [which have their own internal computer security] would probably do just fine with a digital certificate,” said Capobianco. “The hardware tokens are probably a little bit more of a thorough validation, based on how the hackers have exploited access to credit previously. There’s still a way that they can fraudulently access credit even with a digital certificate,” if they have managed to compromise a user’s computer.
Hardware tokens are generally more secure because they require users to physically possess the token in order to log in to the system, Capobianco said.
Different resellers may adopt different systems. Calls to Equifax and TransUnion, the other two big credit reporting agencies, were not returned by press time. But Capobianco felt confident that the other agencies would likely soon adopt multi-factor authentication as well.
“That’s usually the way it works. One of them will take the initiative, and the other two will jump on that bandwagon,” said Capobianco. “The industry is really moving in the direction of locking down data access.”
