ClearScore's lax attitude towards personal data security

vadek

I recently tried to login to ClearScore with an account that I hadn't used for a long time. It rejected my login by telling me that my account already existed. Well, duh!! So I thought I'd try creating a new account, but it refused to accept the password that I'd set a few seconds earlier. So I tried a password reset and again, it refused to accept the new password.
So I contacted ClearScore and, after an initially friendly and helpful email asking which email address I wished to proceed with, they told me to send a picture of my passport or driving licence in the same frame as my face by an email attachment!! Good grief! How unprofessional can you get? Sending this kind of personal data in the clear by email is flouting basic security tenets.
I've now said I'll contact a couple of IT security specialists, and maybe the ICO, with this information to see what they think. I'm furious!

MyRealNameToo

What do you expect your "IT security specialists" to tell you? Why spend money on getting the professional opinion of experts about a third party website? 

Agree emailing things isnt ideal but thousands do it every day without issue. If you dont like their approach to infosec then just move on to another company who you think has a better policy. 

vadek

MyRealNameToo said:

What do you expect your "IT security specialists" to tell you? Why spend money on getting the professional opinion of experts about a third party website? 

Agree emailing things isnt ideal but thousands do it every day without issue. If you dont like their approach to infosec then just move on to another company who you think has a better policy. 

I don't expect them to tell me anything that I don't already know. I'm basically threatening ClearScore with publicity and maybe an ICO complaint

ClearScore is the only way to check my Experian credit score for free. I'm not aware of any free alternatives.

Emailing personal data such as they request may be a thing that people do without understanding the security risks. I don't believe it's worth the risk of potential identity theft.

singhini

vadek said:

MyRealNameToo said:

What do you expect your "IT security specialists" to tell you? Why spend money on getting the professional opinion of experts about a third party website? 

Agree emailing things isnt ideal but thousands do it every day without issue. If you dont like their approach to infosec then just move on to another company who you think has a better policy. 

I don't expect them to tell me anything that I don't already know. I'm basically threatening ClearScore with publicity and maybe an ICO complaint

ClearScore is the only way to check my Experian credit score for free. I'm not aware of any free alternatives.

Emailing personal data such as they request may be a thing that people do without understanding the security risks. I don't believe it's worth the risk of potential identity theft.

ClearScore is not the only way to check your Experian credit score (infact its not even possible to check your Experian credit score with ClearScore).

Isthisforreal99

All this drama over a fictional number provided by a CRA.

MeteredOut

Just wondering, what would be the basis of any complaint to the ICO? Yes, asking for both in a single email is not great from a security perspective, but is that in itself a breach of data security?

singhini

vadek said:

I recently tried to login to ClearScore with an account that I hadn't used for a long time. It rejected my login by telling me that my account already existed. Well, duh!! So I thought I'd try creating a new account, but it refused to accept the password that I'd set a few seconds earlier. So I tried a password reset and again, it refused to accept the new password.
So I contacted ClearScore and, after an initially friendly and helpful email asking which email address I wished to proceed with, they told me to send a picture of my passport or driving licence in the same frame as my face by an email attachment!! Good grief! How unprofessional can you get? Sending this kind of personal data in the clear by email is flouting basic security tenets.
I've now said I'll contact a couple of IT security specialists, and maybe the ICO, with this information to see what they think. I'm furious!

What are you expecting the IT Security Specialists to do?

vadek

I'd like to thank everyone for their help and useful advice. As I apparently can't lock this thread or block people (or AI bots), I'm now muting it so that I can't see any more friendly responses.

Grumpy_chap

AIUI, Clearscore uses Equifax.
I understand that MSE Credit Club previously used Experian but has now changed to an alternative data provider.

vadek

Experian has a free app. TransUnion is available via MSE Credit Club (or Lloyds Bank, if you're with them). Equifax is only available for free via ClearScore - otherwise you have to pay Equifax (after a free month).

Nasqueron

vadek said:

Experian has a free app. TransUnion is available via MSE Credit Club (or Lloyds Bank, if you're with them). Equifax is only available for free via ClearScore - otherwise you have to pay Equifax (after a free month).

To block people, click on their profile then (at least on a PC browser) there is an icon of a head/profile next to message, click that and choose Ignore - you can see they have posted sometimes but don't see their messages on the forum