Credit Bureaus Want Your Banking Data -- Should You Give It to Them?

You're driving home from work in the rain when someone swerves in front of you. Before you know it, you're hydroplaning.

The front end of your trusty Accord smashes into the other car. Pieces of your left headlight scatter across the highway, clacking as they hit the ground. You wobble home on your tweaked axle after filing a police report and making sure no one needs medical attention.

Now it's a month later, and the auto insurance company's reimbursement check for your totaled car has finally arrived. It's a generous settlement for a 15-year-old sedan, but not enough to pay cash for some decent wheels. So you're at the dealership applying for an auto loan on a lightly-used Civic, the best value around. You'll use the settlement for a down payment, but you need to borrow the rest. And your credit's not exactly sterling.

"You’re right on the edge of having a good score," says Sam, the salesman at the dealership. "We might be able to lower your interest rate to 8% from 12% if you want to try using your UltraFICO™ Score."

UltraFICO™? What's he talking about?

UltraFICO™ to the rescue

As soon as this spring, consumers nationwide could see a new opportunity to increase their Experian credit scores.

You can get the details on this new score in What Is the UltraFICO™ Score and What Does It Mean for You? -- but, in a nutshell, UltraFICO™ can instantly pump up your Experian credit score. It could go up by enough to turn a loan rejection into an approval or a high-interest-rate approval into a lower-interest-rate one.

For this to happen, you'll have to let FICO, Experian, and Finicity, partners in creating this new score, access and analyze the transactions in at least one of your checking, savings, or money market accounts. A financial algorithm will recalculate your regular Experian score by adding information about

• how long your account has been open (longer is better),
• the recency and frequency of your transactions (recent and regular activity is good),
• your history of positive account balances, and
• evidence that you consistently keep a cushion of at least several hundred dollars.

David Shellenberger, Vice President of Scores and Predictive Analytics at FICO, told The Ascent in late December that the company planned to make the score generally available later in the first quarter of 2020. And it's possible you've already come across it, because it entered a pilot phase at the end of 2018.

Before it becomes widely available, we thought you should know whether you might be trading away too much privacy and security if you opt in to supplying your bank account data at the moment you apply for certain loans.

Obvious benefits, nebulous costs

Back at the dealership, Sam wants to make the sale. You've already been there for hours test driving cars and negotiating a price. Do you pull the trigger and try out UltraFICO™? There’s no guarantee that it will increase your score. You might be trading away your banking data for nothing. Still, you could save a couple thousand dollars over the next few years if this new service increases your score.

You tell Sam you need a coffee break. You'll be back in a few. You need to think about it.

The obvious benefit of a higher credit score is that you might qualify for a loan when you'd otherwise be declined. Or you might qualify for a lower interest rate instead of a higher one. You might be able to drive off today with a car you can afford instead of taking the bus or getting another ride from a friend.

We normally make the easy choice even if it's not the logical or the right one. It's easy to type your bank account login details into a web form and check a box that says you agree to the terms and conditions and privacy policy. It's easy to think that your privacy is already a lost cause.

It's also easy to be led astray by your emotions, short-term thinking, outside pressure, self-justification, and confusion. These are five of the 10 financial sins in economist Dan Ariely and coauthor Jeff Kreisler's Dollars and Sense: How We Misthink Money and How to Spend Smarter.

It's harder to question, let alone understand, the long-term implications of giving up more personal information. Few of us understand the breadth and depth of data collected about us or its potential uses.

Most people are happy to give away their banking data

In a 2018 nationwide survey of 540 consumers, Experian found that 70% are "are willing to provide additional financial information to a lender if it increases their chance for approval or improves their interest rate for a mortgage or car loan."

Almost half said they were comfortable providing their utility payment history, and more than a third said they were comfortable sharing bank account transactions and mobile phone payment history. Nearly 50% said they were better borrowers than their credit scores indicated.

UltraFICO™ is free for consumers. So is its cousin, Experian Boost, which can help you increase your Experian credit score based on mobile phone and utility payment data from one or more bank accounts you link to your Experian credit report.

But, as the saying goes, if you're not paying for something, you're not the customer; you're the product. So it's smart to question what you might sacrifice and what might happen to your data when you opt in to UltraFICO™, Experian Boost, or any other service that asks for your bank account data.

Lauren Saunders, associate director of the National Consumer Law Center, certainly questions it. In November 2019, she testified about big data in financial services before the U.S. House of Representatives Committee on Financial Services, saying that "with some services there are questions as to whether the consumer's opt-in will allow ongoing use by any lender that accesses the service -- or by the credit bureau more broadly -- potentially in ways that the consumer does not expect or understand."

"These broader uses of transaction data for credit underwriting bear monitoring, especially in light of the dismal record of the credit reporting agencies in being overly aggressive in selling the sensitive financial information of consumers," she continued.

What happens to consumer-permissioned data?

When you sign up for Experian Boost, you're opting into targeted advertising for credit offers -- what Experian calls "credit cards and loans matched for you." This isn't a secret; it's right there on the sign-up page. But do you want to receive targeted advertising, or do you just want a higher credit score? You can't have one without the other.

Also, it's not clear what happens with all the banking information you grant the company access to when you sign up for Experian Boost. When The Ascent asked Experian how the company uses the bank account transaction data a consumer provides to use this service, a company spokesperson said only that "debits associated with non-eligible accounts are ignored, as they are not part of Experian Boost."

But being ignored by a scoring algorithm and being ignored by the company's consumer data collection business aren't the same thing.

We don't yet know what you're agreeing to when you sign up for UltraFICO™. Since this score wasn't consumer-facing at the time of writing, a FICO spokesperson told us the company wasn't able to disclose the terms and conditions yet. We found only a generic set of terms and conditions for a wide range of FICO products on the company's consumer website.

Does UltraFICO™ put you at risk?

To learn how much of your banking history the UltraFICO™ algorithm will analyze, log into your bank account and see how many months of history your financial institution makes available. That's the same amount of data the algorithm will have access to, according to Shellenberger. He says it's typically about 28 months' worth of history, though it may sometimes only be 12 months' worth.

"Sharing sensitive bank account data, including account balance, payment patterns, spending history, and overdraft history can certainly create additional security risks for consumers," said Attila Tomaschek, a researcher at ProPrivacy, a company that educates consumers about online privacy risks.

"By essentially giving Finicity access to your bank account information, you are opening yourself up to increased risks of identity theft, as well as of having your sensitive financial data shared with third parties or compromised through a data breach."

In a written statement, Finicity told The Ascent that "securing data involved in any particular service is an absolute priority," and "Finicity goes beyond industry best practices in encryption, monitoring, and alerting. We went through 64 bank-led security assessments last year. We go through regular Soc 2 Type 2 audits as well as a bank consortium led Trusight audit."

What does that mean, though? As Saunders said in her testimony, "While data aggregators promise high levels of security, and many impose security requirements on end users, consumers have no capacity to evaluate the trustworthiness, security protocols, motives, or activities of either data aggregators or the companies that offer services based on account data."

A blog post from Finicity discussing the importance of penetration testing, tokenized access, and a company culture of security awareness provides confidence that the company knows what it's doing in terms of protecting consumer data. At the same time, most consumers haven't forgotten the Equifax data breach, the details of which are still unfolding.

One of those details is that "Equifax basically left all our data out on the lawn for anyone to walk off with -- the upshot of failing to encrypt the databases that store some of the most sensitive details of our lives," writes business columnist and consumer advocate David Lazarus in an L.A. Times article about the Equifax breach. "And Equifax is by no means alone in such negligence. Most large U.S. companies similarly do not encrypt the data they take from customers," he adds.

Equifax and Experian are two separate companies. Finicity is also a separate company, as is FICO. But Lazarus's column should make any consumer think twice before voluntarily providing personal information to any company.

Experian already knows much more about us than we realize

You know Experian is a credit scoring company. But did you also know that Experian has a product called ConsumerView, "the world's largest consumer database," that contains "thousands of attributes on more than 300 million consumers and 126 million households"?

ConsumerView is a marketing service Experian offers to businesses to help them provide more targeted marketing through both digital and traditional channels. It includes data on "demographics, purchasing habits, lifestyles, interests, and attitudes."

More specifically, it includes

• age, gender, education, occupation, and marital status;
• property and mortgage data;
• shopping habits in 38 categories and through specific channels (retail, online, or both); and
• "a unique, permanent identifier to each consumer record, which helps maintain contact with consumers wherever they move."

Experian’s ConsumerView brochure tells businesses, "we can help you target exact individuals across channels, devices, and publishers." Experian calls it "omnichannel marketing." The FTC calls it "cross-device tracking."

This knowledge might make you reluctant to share more personal data with Experian. Or it might make you think that your privacy is already a lost cause, so what difference does it make to share one more thing, especially if it will save you money?

The risk of providing your account credentials

If you've ever used personal financial management software like Mint, Personal Capital, or Mvelopes, you've already used the technology that UltraFICO™ employs -- technology that's well over a decade old and has been tested for many years.

"There is risk whenever and wherever you share data, from the gas pump to online retailing," Finicity told us. However, "In regard to bank account access, on top of all our security measures to protect consumer data, today's market use of one time passcodes and two-factor authentication adds another layer of security that would make unauthorized access to bank accounts exceptionally hard."

Further, if you're concerned about providing your banking credentials when using UltraFICO™, simply change your banking password once your UltraFICO™ Score has been generated. And if you're using an insecure password -- one that you've repeated across multiple accounts, for example -- change it both before and after you apply for your loan so you're not giving out credentials that could be used to access your other accounts. You'll be safer in the unlikely event of a data breach.

This is always a smart security practice to follow, especially for financially sensitive accounts: Never reuse passwords, and change passwords regularly.

You can't put the genie back in the bottle, though. Experian Boost's Terms of Use Agreement says, "If you cease to be our customer, we may continue to use and share your information as described in this Policy." Rapidly changing privacy laws may let customers control how their information gets used, though it's still too early to determine just how effective these laws will be in limiting security risks incurred by using these credit-boosting services.

How to improve your credit score without giving away your banking data

You have other options for increasing your credit score, especially if you have a few months before you need to apply for credit.

Applying for a secured credit card and using it responsibly can help you build your score if you have no credit, limited credit, or poor credit.

Reducing your credit utilization and making all your payments on time are two more things that can improve your score substantially and don't require granting access to your bank account data.

Further, these options will typically improve your score at all three credit bureaus, not just one.

It's ultimately your call whether the deal is worth it. And now you have a better idea of what the deal actually is.

Decisions about what personal finance data to share and with whom shouldn't be made on the spot. Let Sam the car salesman wait until you feel comfortable deciding what you want to share.

Sources

1. Andriotis, AnnaMaria (2018). Wall Street Journal. "Why Your FICO Score Could Get a Boost in 2019."
2. Ariely, Dan, and Jeff Kreisler (2017). "Dollars and Sense: How We Misthink Money and How to Spend Smarter."
3. ConsumerInfo.com (2020). Experian Boost Terms of Use Agreement.
4. Experian (2018). "The State of Alternative Credit Data."
5. Experian (2020). "Only Experian Can Raise Your FICO® Score Instantly."
6. Experian (2018). ConsumerView.
7. Fair Isaac Corporation (2019). UltraFICO™ Score Fact Sheet.
8. Federal Trade Commission (2017). "Cross-Device Tracking."
9. FICO, Experian, and Finicity (2018). PR Newswire. "Experian, FICO and Finicity Launch New UltraFICO™ Credit Score."
10. Finicity (n.d.). "UltraFICO™ Score FAQ."
11. King, Jim (2019). Finicity. "Data Security in the Era of Consumer-Permissioned Data."
12. Lazarus, David (2020). Los Angeles Times. "Equifax left unencrypted data open to Chinese hackers. Most big U.S. companies are just as negligent."
13. Saunders, Lauren (2019). National Consumer Law Center. "Testimony Before the U.S. House of Representatives Financial Services Task Force on Financial Technology Regarding ‘Banking on Your Data: The Role of Big Data in Financial Services."