TL;DR: In 2022 KrebsOnSecurity showed that crooks could create a new Experian account over a victim’s existing one using personal details and a different email, then reset the PIN and offer to lift the freeze. In November 2023 Krebs found it was still possible: his own account had been hijacked, and re-registering accepted any US phone number and asked security questions answerable from public records. Equifax and TransUnion required a code sent to the email or phone on file. The defence is simple: create your own account at all three bureaus (“plant your flag”), freeze your credit, and keep the account email active so you see warnings.
What happened
KrebsOnSecurity’s July 2022 investigation described two readers whose Experian accounts were hijacked even though they used strong, unique passwords. The thieves didn’t guess passwords. They appear to have opened new Experian accounts in the victims’ names, using personal information and a different email address.
- One victim learned of it from an Experian notice; password resets then went to the impostor’s email, and his PIN and security questions had changed.
- The other only found out when credit monitoring flagged an attempted Chase account in his name. His freeze had been lifted once the new account was created.
Krebs then tested it on himself: using his SSN, date of birth and multiple-choice questions mostly answerable from public records, he re-created his Experian account with a new email. Experian changed the email without confirming the old one, let him reset his PIN and offered to lift his freeze. TransUnion and Equifax refused the same trick and sent him to their password reset flows.
Experian called these “isolated incidents of fraud using stolen consumer information.”
It happened again in 2023
In November 2023 Krebs reported that his own Experian account had been hijacked. Entering his SSN and birthday showed his identity tied to an email address he hadn’t authorised, and the only way back in was to recreate the account. What he found:
- Re-registering required a phone number, but any US number was accepted, and there was a "Continue another way" option to skip it.
- Of five multiple-choice security questions, only two related to his real history, and both were about past street addresses that are easy to find online.
- Once re-registered, the account gave full access to his credit file and the ability to freeze or unfreeze it.
- Experian emailed the old address to say the profile had changed, but the notice was informational only, with no way to stop the change.
By contrast, Krebs said Equifax and TransUnion require a code sent to the email or phone already on file before allowing changes. Experian’s spokesperson said it uses a "multi-layered security approach" and that consumers can turn on multi-factor authentication. Krebs questioned how much MFA helps if someone can simply create a new account.
The lesson: plant your flag
If an account already exists in your name with your email, it’s much harder for someone else to create one. So:
- Create an online account at Equifax, Experian and TransUnion yourself, with a strong unique password. Krebs’s 2023 advice was to create an Experian account even if you don’t otherwise need one, so Experian will email you if someone changes your file.
- Turn on multi-factor authentication where it’s offered, including Experian’s optional MFA.
- Freeze your credit at all three (how).
- Use an email you check. Notices to the original email may be your only early warning.
- Check your freeze status regularly. Log in every few months and make sure each freeze still shows as active.
- Add a fraud alert if you’ve been targeted (how).
The same logic applies to USPS Informed Delivery, the IRS (get an IP PIN) and Social Security (create your my Social Security account).
Signs someone has taken over your bureau account
- an email from a bureau saying your account details or email changed;
- you can’t log in, and password resets don’t arrive;
- a monitoring alert about a credit application you didn’t make;
- your freeze shows as lifted.
If it happens
Call the bureau, explain the account was taken over, and ask them to restore your email, re-freeze and add a fraud alert. Report it at IdentityTheft.gov. Check your credit reports for new accounts at AnnualCreditReport.com.
Why your details were enough
Thieves pass identity checks with data from breaches and brokers. A free email exposure check shows what’s circulating about your email.
Frequently Asked Questions
Can someone create an Experian account in my name?
KrebsOnSecurity showed it was possible in 2022 using a victim’s personal details and a different email. Experian called it isolated.
What does "plant your flag" mean?
Creating your own accounts at agencies like the credit bureaus, IRS and Social Security so impostors can’t create them first.
Can a thief lift my credit freeze?
In the Krebs cases, a new Experian account led to the freeze being lifted or offered to be lifted. Keep your own account active and monitored.
Is Experian still vulnerable to this?
Krebs reported in November 2023 that his own Experian account had been hijacked and that re-registration still relied on easily researched answers. Create your account, turn on MFA and check your freeze regularly.
What should I do if my bureau account email changed?
Call the bureau immediately, ask them to restore your account and re-freeze, and report it at IdentityTheft.gov.
Sources
- KrebsOnSecurity: Experian, you have some explaining to do (Jul 2022)
- KrebsOnSecurity: It's still easy for anyone to become you at Experian (Nov 2023)
- FTC IdentityTheft.gov