Data protection breach - would you message a stranger involved?

[AmIAWeed]

I checked my credit score between Christmas and New Year as we're thinking about moving house.
My credit score is awful - there are multiple accounts from about 10 different companies I have had no dealings with, it would appear there is another person with my name and date of birth. For some reason when her debts have been passed to a debt company there has been a mistrace.
I can see her home address, who she owes money to, how much, when she has/hasnt made payments I know if they are credit cards, loans or hire purchase and the last 4 digits on her accounts.
I have contacted every company who are unbelievably slow to do anything.
Ive contacted the company I got my credit score through and signed up to the other 2 credit agencies and low and behold on one other she appears there as well (still waiting for access to the third)
Knowing her name and town I have found her on Facebook.
This is affecting my credit score, but its also a major data protection breach for her.
Would I be unreasonable to message her and tell her? Hopefully she'll kick off at the companies as well for sharing her info...or she might not as she owes most of them money!

Well id want to know if it was me.

I would be more concerned in putting in a complaint to the credit score companies. You must have redress for false information. The other person wont care

No. Report it via the credit scorer you use. There is an incorrect link and they need to make it right. They do that when you use their report function. As you have logged on to all of them you could report to all. But you only need to deal with one.. they are all use the same information and data source!

She may not have logged on to any credit checker. She may not know she has been mislinked. The one thing you don't want is direct contact with someone with a bad credit record - you have no idea how she might use that information.

Just report and get them to diconnect your credit reports.

Given her credit score, I very much doubt she's the sort to want to engage with you. Fuck her breach, what about your credit score? Get onto the credit scoring agencies asap to disentangle the two of you.

I have complained to the credit companies
1 - Transunion its been 2 weeks of messages and I think they finally have all the information they need, but still say it'll take upto 6 weeks to respond
2 - Equifax its taken over a week to get access to my report because I failed their verification questions (things like did you take out a credit card and in what month because my answers arent hers!)
3 - Experian wont help until I have a credit report from them, despite one debt collector telling me that's who they get their info from and the mis-trace, but I've also failed their verification so awaiting on them responding.
I'm annoyed its taking so slow, thankfully the house we found and loved and triggered all of this we've decided against buying but I wonder if the other person thinks they've also been victimised if the companies may move a little quicker

No, do not contact her. She is most probably a criminal who has stolen your identity to run up debts in your name. I’d report to the credit agency and police.

From ico.org.uk/your-data-matters/identity-theft/

Your identity is one of your most valuable assets. If your identity is stolen, you can lose money and may find it difficult to get loans, credit cards or a mortgage.

Your name, address and date of birth provide enough information to create another ‘you’. An identity thief can use a number of methods to find out your personal information and will then use it to open bank accounts, take out credit cards and apply for state benefits in your name.

What can I do if I'm a victim of identity theft?

If you think you are a victim identity theft or fraud, act quickly to ensure you are not liable for any financial losses.

Report all lost or stolen documents, such as passports, driving licences, credit cards and cheque books to the organisation that issued them.
Inform your bank, building society and credit card company of any unusual transactions on your statement.
Request a copy of your credit file to check for any suspicious credit applications.
Report the theft of personal documents and suspicious credit applications to the police and ask for a crime reference number.
Contact CIFAS (the UK’s Fraud Prevention Service) to apply for protective registration. Once you have registered you should be aware that CIFAS members will carry out extra checks to see when anyone, including you, applies for a financial service, such as a loan, using your address.

CIFAS – The UK’s Fraud Prevention Service
6th Floor
Lynton House
7 - 12 Tavistock Square
London
WC1H 9LT
www.cifas.org.uk

@PlanDeRaccordement one of the debts predates me getting married and having my current name. Its a pretty common name I have now so whilst she's shit at paying her bills I don't believe at this point its stolen identity if anything since getting married its me whose taken her name :/

What if she knows and is happy with the set up as she’s currently using your high credit score to run up more debts?

Messaging her on FB would be just about the worst thing you could do in this scenario.

That is the Catch 22 of joinign after mislink has occurred. You haven't a hope of giving them the right verification information.

Don't worry about it though. Transunion will repoirt ot to Equifax who will investigae and make corrections that then will trickle out to all the others. You'll have time to get it all put right before you need a mortgage.

It is unlikely that another person has the same birth date (day, month and year) AND full name as you. Even if she shares the same name and just adopted your birthdate to get credit, she’s done ID theft.

Even though a debt predates your marriage and name change, that does not mean she did not later alter the identity data associated with that debt during collections so it would match your identity.

If I were you, I’d want it investigated at the very least. You don’t have to be able to prove identity theft to report it, just that you have evidence it might have happened and multiple credit applications and debts taken out in your name when it was not you is one.

@PlanDeRaccordement what you say makes sense, thank you for the advice. I'll get onto CIFAS now as well

It seems pretty unanimous not to message her so I guess i'll continue to keep pushing the credit agencies and stop looking at houses until this is sorted.
I paid off a loan and credit card last year so was super excited to see if i'd gone from 'good' to 'excellent'...life is never so simple though is it!

Don't bother contacting her on Facebook or by any other means. She would be the type of person who would be very happy to be associated with you if she owes people loads of money as she can use your credit record to get more credit.

It also isn't that rare particularly with common names. You need to just concentrate on cleaning up your own credit record.

Unfortunately if you have been mixed up once it is extremely likely to happen again so I would apply for protective registration - it doesn't matter who had the name first.

Wow! Some serious judging of someone with poor credit! I have shocking credits due to past financial abuse and some of my own shocking decisions but I'm certainly not a criminal or 'the type who wouldn't want to engage'!

While I don't think contact via Facebook is appropriate I definitely would want to know. I'd be horrified to find out that my poor credit was affecting someone else so badly and I'd certainly be contacting the credit reference agencies to help OP get it sorted for her sake. If you've got this person's address then possibly a letter as it's a bit more formal?

Of course it is possible that they are well aware and are taking full advantage of it I just don't think it's fair to assume that to be the case.

Oh, and I found out that someone with my exact name and dob was actually born 10 mins before me in the very same hospital (mix up with obtaining a copy birth certificate) so while not common it's certainly not unheard of

I wouldnt necessarily jump to identity theft.

I've heard this happen quite a lot with people who have common names. An aquaintance with a very common name and a desirable email address in that name gets this loads. She and two other people with the same name have spent years trying to disentangle from each other. Every so often there is a fb update on the saga (that has been going on for over 10 years).

I wouldnt contact her directly, but you might want to contact the Information Commissioners Office about the data breach and its impact on you. You may even be entitled to compensation from the credit score companies.

You should take out protective registration as well.

From the CIFAS website - Companies and organisations who are signed up as members of the database will see you’re at risk and take extra steps to protect you, preventing fraudsters from using your details to apply for products and services.

I've enquired with CIFAS if I can take the protective registration now or if I should wait until the credit agencies have responded. I also asked them if they can advise anything else.

My honest thoughts are if it were identity theft - i.e. someone using my details wrongly they wouldn't have a Facebook profile that comes up when you search name and town. Regardless though I need them disassociated with my credit report and score. I wont contact the woman whose details I can see but keep pushing the credit agencies and the individual companies to get it sorted, and apply for the protective registration as soon as CIFAS say that's all I need to do (ie not get the issue fixed first).

@Cailleachian Pending how the credit agencies handle this I may report to the ICO, I think I need to give them the chance to fix the issue first and ask them specifically how they are addressing the data breach. If they ignore that element then I will report them for the sake of the other person whose details I can see. It's taken up a huge amount of time already but we didn't loose the house because of this (building works weren't signed off by building regs, didn't even have permission so it would have been a nightmare and we walked) so I don't think compensation is something to push for at this stage. Thanks for suggesting the ICO as another organisation to consider

I’d report it to the ICO (on their website there’s a section for personal data breach). They will investigate this and the companies involved will more than likely sort the issue out quickly when they know the ICO are involved.

Also, wouldn’t contact the other person just incase.

Oops! My message took ages to post so didn’t see someone had already mentioned ICO.

so one company has come back to the dispute logged via transunion refusing to amend the link. I've contacted them again - finally got through to someone who soundly remotely like a human who said it looks like the person who took my call has done nothing since I called in December but they are off today so he can;t confirm. Hes escalating to a manager and promised an update tomorrow at the latest.

I chased another debt collection agency who promised id get an update in 72 hours. Had a really pushy person demanding my current address to 'update their system with where I am now living' no idea how I didn't loose my temper with her but the poor lady on the phone after her in the complaints team had me in tears. She was lovely but said it'll take 8 weeks to investigate.

Only 1 company so far has written me a letter and agreed my dispute with Transunion.

The other 6 companies all have 'deadlines' to respond so i'm keeping track of each of them to make sure they reply in a suitable time - I've also told them all it is a data breach and the ICO will be informed.
I'm just collating all the information to send to them in-between work to get that started, I've also taken out the protective registration with CIFAS which should kick in within 48 hours.

Thank you all for your advice so far

Glad you’ve done the protective registration. Having that should get the credit agencies to take your concerns more seriously.

If the companies are aware of the data breach then they have to report it themselves which means a guaranteed fine I think. Quite a hefty one as well, regardless of whether they are working to correct it or not.
I hope it's not Identity theft otherwise it could probably be quite a lengthy process for you to disentangle yourself from it

and the saga continues!
All but 1 account for a debt company has been removed from my credit file.
The one that hasn't been removed is still being argued. I've had a letter from the debt company involved to say they used a credit agency search which gave my address so if that's incorrect contact the credit agencies. They updated their systems showing my address as a secondary address but continued to right to the original, as such they have refused Experian and TransUnion the right to remove (even though they removed all the others). TransUnion and Experian say it doesn't matter if they provided the information through their search products the debt company they've given that info say its me so it must be me!
They've got copies of my marriage certificate showing my name change was after the account, they've had proof of my address at the time the loan was taken out and nothing changed with everyone saying its someone elses problem. Only Experian have given me a 'final response' to my complaint so I can't yet go to the Ombudsman.
I totally lost it at the poor woman who answered the phone at the debt company, she's said she'll make my enquiry into a complaint and I asked why the hell it wasn't a complaint to begin with...they now have 8 weeks to resolve and want proof that this has impacted my life!

Goodness! Another 8 weeks!
I'm sorry this is still not sorted for you.