Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history.“If somehow I can make small change and help to improve this, inside myself I can feel that I did something that actually matters and helped others.” Kushnir said the crooks learned they could trick Experian into giving them access to anyone’s credit report, just by editing the address displayed in the browser URL bar at a specific point in Experian’s identity verification process.Following Kushnir’s instructions, I sought a copy of my credit report from Experian via annualcreditreport.com — a website that is required to provide all Americans with a free copy of their credit report from each of the three major reporting bureaus, once per year.Normally at this point, Experian’s website would present four or five multiple-guess questions, such as “Which of the following addresses have you lived at?” Kushnir told me that when the questions page loads, you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report.“Just last year, Experian ignored repeated briefing requests from my office after you revealed another cybersecurity lapse the company.” Sen. Wyden’s quote above references a story published here in July 2022, which broke the news that identity thieves were hijacking consumer accounts at Experian.com just by signing up as them at Experian once more, supplying the target’s static, personal information (name, DoB/SSN, address) but a different email address."