By Jane Black It should have been a joyous occasion. In March, Cisco engineer Alex Vegas' wife, Mary, checked into Mathilda Hospital in Hong Kong where she gave birth to the couple's first child, Eliza. But when Vegas tried to pay the bill, his credit card was refused. It was a shock, since Vegas says he has had the card since 1993 and has never paid a bill late.
So instead of celebrating, Vegas spent hours on the phone with his credit-card company trying to figure out what was wrong. Eventually, he was referred to Experian, one of the Big Three credit-reporting agencies (along with TransUnion and Equifax), which informed him that he had bad credit due to unpaid student loans. Vegas didn't have any student loans.
When he looked closely at his Experian credit report, he realized the problem: The report was tracking three Social Security numbers -- his own, his brother Alejandro's, and another unknown person's. Any bad debt the others racked up would hurt his rating.
MAJOR MISTAKES. Vegas called Experian to clean up the mess, but, according to Vegas, the company told him he would have to sort it out with the individual creditors. The creditors referred him back to Experian.
Vegas even called the Federal Trade Commission (FTC), the federal watchdog responsible for enforcing the Fair Credit Reporting Act (FCRA), which mandates that credit agencies and creditors "follow reasonable procedures to assure maximum possible accuracy." The FTC followed its standard procedure and told Vegas it could not take on individual cases, only class actions.
He asked if anyone else had a similar problem with Experian. The agency wouldn't release the data and recommended that Vegas file a request under the Freedom of Information Act. "Getting my credit report fixed was becoming my full-time job," says Vegas, who works between Hong Kong and Virginia.
HORROR STORY. The FCRA is often held up as a model for new privacy laws to regulate the heaps of personal data collected by everyone from government agencies to banks and e-commerce companies. But Vegas' horror story underscores how difficult it is to protect and manage personal data, even with the law on your side. After all, the error on his credit report was blatant. Each American has only one Social Security number. It should have been clear to Experian representatives -- or even a simple piece of software -- that something was amiss.
Accuracy underpins the system of instant credit that Americans enjoy. And Experian maintains that cases like Vegas' are exceptions to the rule. According to Donald Girard, its public relations director, Vegas' problem was complicated because he was calling from Hong Kong, not his registered address in Virginia. Girard adds that Experian's customer-service center receives more than 1 million calls a month, and most claims are settled promptly.
Still, Vegas isn't the only one who has had trouble righting wrongs in a credit report. On July 29, a federal jury in Portland, Ore., awarded Judith Thomas $5.3 million for her six-year battle to separate her own credit history from that of another woman -- Judith Upton -- with TransUnion, another big credit agency. The two women live in different states, but their Social Security numbers differ by just one digit. The award, which included $5 million in punitive damages and $300,000 to compensate for Thomas' stress and resulting medical problems, is the largest since the FCRA was passed in 1970.
FUNDAMENTAL FLAW? Thomas asked TransUnion to correct the errors on numerous occasions. But each time the company removed a charge or bad debt, it reappeared because TransUnion failed to inform creditors that the two women's records were confused. TransUnion says the mistakes were a fluke, but Thomas' attorney, Robert Sola, its system for correcting errors is fundamentally flawed: "The right hand doesn't know what the left hand is doing. Their procedure doesn't comply with the law."
Even when a failure to comply is clear, it's difficult to prevail. "You can go to court, but [the credit agencies] have more money to fight than you," says Denise Richardson, a real estate paralegal in Hollywood, Fla. She would know. For seven years, Richardson disputed an error on her credit report that alleged she had defaulted on a loan. (In fact, the bank itself had written off a part of the loan but sent information to the credit agencies that it was she who hadn't paid.) In 2001, she settled with Fleet Bank, the original lender, and the three credit unions for an undisclosed sum.
To improve compliance, consumer advocates say the FCRA must be strengthened. For one thing, the law should mandate minimum penalties if a credit agency doesn't correct errors within a reasonable period of time. If every violation were worth $1,000, the credit bureaus would have a clear incentive to get it right, says Edmund Mierswinski of the U.S. Public Interest Research Group, a consumer-advocacy outfit affiliated with activist Ralph Nader.
DELAYED REACTIONS. Denise Richardson believes Congress also should remove time limits that require consumers to challenge mistakes in their credit reports within two years of the time an error is introduced. This is key because many people don't check their credit reports unless they're applying for a new mortgage, car loan, or credit increase. If they suddenly find a mistake, it may be too late to challenge.
That's what happened to Adelaide Andrews, a California woman whose Social Security number and driver's license were stolen and used by an imposter to rent cable service. In 1996, Andrews sued credit agency TRW (which has since changed its name to Experian) for failing to take reasonable steps to protect her. The case went all the way to the Supreme Court, which dismissed it in November, 2001, because the suit wasn't filed within the two-year statute of limitations. This despite research from the FTC that demonstrates that, like Andrews, 20% of victims of ID theft don't become aware of a problem for more than two years.
Carefully monitoring your credit report wouldn't be such a burden if you didn't have to pay for it. Though prices vary from state to state, consumers on average pay about $10 each time they want to check their credit report. The credit agencies make money selling your report, but it's your job to make sure it's correct. "After all my trouble, that's the thing that irks me most," says Richardson. "We have to pay them to do their work for them."
FULL-TIME JOB. Experian's Girard says that's the price of a world of instant credit. Experian receives 30 million to 40 million new bits of information each day. The sheer volume -- and the privacy rights of consumers -- prevent it from monitoring and challenging each new piece of data. Moreover, he adds that Experian and others have made it easier and cheaper for consumers to examine their credit report online. Experian runs frequent free, 30-day trials where consumers can get unlimited access to their reports.
As more info is collected and stored, monitoring and correcting personal data files could become a full-time job for more people, as it did for Alex Vegas. He did ultimately resolve his situation -- but only after BusinessWeek Online contacted Experian to inquire about the mixup. It shouldn't have to be that way. The FCRA is designed to protect consumers, but too many are still falling through some gaping cracks. Black covers privacy issues for BusinessWeek Online. Follow her twice-monthly Privacy Matters column, only on BusinessWeek Online