Something is Rotten in the State of ING Direct

This complex tale started on Saturday and has not yet fully played out. I’m breaking the story now, but there will be updates to this post as additional details are known. Please read the post in its entirety before asking any questions… but questions are welcome.

The Players

ING Direct: My favorite bank, which I recommend often to both my friends and readers. Widely known for their helpful customer service, the fact that this is happening with them is mind-boggling. I’m truly disappointed.

Rick*: A friend of mine from college, who recently moved for a new job. Rick’s been having a little trouble getting established in his new apartment: the DMV mailed him his new license, but the US Postal Service seems to have lost it. His beater car isn’t behaving, so he’s planning to replace it with a new or recent-used car, paying about half cash and getting a loan for the other half. He doesn’t have much of a credit history. These facts may seem random, but they’ll all come into play in his story.

Creepy Shadow Company that Collects Information and Sells It: As of right now, we do not know what company this is. All we know is that they collect information about me, you… and of course, Rick. They then use this information to formulate multiple choice questions about a person. If you’ve ever tried to pull your credit report, you’ve come across these types of questions. They’ll ask you something about a loan you have, or a previous address, to make sure that you are you. They then sell these questions to credit reporting agencies and lenders, who use this information to validate your identity.

Rick’s Story: A Perfect Storm

With all of his car trouble and not being able to get his license (the DMV says talk to the post office, the post office says talk to the DMV…), Rick’s been getting quite frustrated lately. As his friend, I encouraged him to take things one step at a time, and focus his efforts on getting a bank account that’s accessible in his new location. He’s heard me gush before about how much I love my ING Electric Orange Savings account, so he asked me how long it would take to open one of those.

Because I knew that Rick already had an ING Orange Savings account, I told him that it would take less than a minute to fill out the forms to open one of their checking accounts. After all, I did it, and it took me only 42 seconds! (Yes, I timed it.) Rick was truly excited about the idea of getting one of their accounts and having a debit card with fee-free ATMs in every 7-11. He logged into his ING account and went to sign up. But he hit a snag — a pop-up came on the screen telling him he needed to call ING’s 1-800 number and validate his identity.

I’ll let Rick tell this part of the story himself, as he presented it in an email to ING Direct’s Ombudsman:

Once I connected with the representative, I provided my current address, phone number, date of birth, and [Social Security Number], as well as my ING Direct pin.

The final step, I was told, was a series of multiple choice questions which would complete the identification process. I answered the first two, both of which were applicable to me. The last three concerned a person with whom I am not familiar, so I answered accordingly. When the representative put my answers into the system, she informed me that, based on answering too many of them incorrectly, I would never be permitted to open an Electric Orange account. [emphasis added]

I thanked the representative and hung up. Assuming (erroneously, as I would find out) that the check was performed through one of the three credit bureaus, I immediately began contacting them, requesting copies of my credit report, and attempting to question the information they required for identification purposes. I cleared two of the three credit reports with no problem – the third will arrive in the mail, but based on my later interaction with ING, I suspect it will be clean as well.

Having used up my available routes, I decided to inquire further with ING regarding the identification process. I called the same security department phone number and talked with another representative. This time, I explained the entire situation again, including my efforts to check my credit. She explained that the identification procedure is not conducted through a direct credit check with any of the three credit bureaus. Instead, a third party company produces a series of questions that they believe will positively identify me. When I asked whether I could contact the company directly, or provide alternative forms of identification, she claimed that there was no other manner by which I could disprove the answers to the questions and prove that I am, in fact, myself. [emphasis added] The representative gave me this email address as a point of contact for continuing with this issue.

So, the apparently unchangeable bottom line is: there exists a company whom I have never explicitly authorized to store my personal information; this company is responsible for determining whether or not I know enough about the unverified information that they maintain to conduct business with their client. The company does not accept corrections to the information, and may at any time in the future damage my ability to establish relationships, financial and otherwise, with other organizations.

I view this matter as a very serious breach of my trust in ING as an organization.

Rick’s frustration is justifiable, and it’s actually worse than he explained in this email. In order to obtain his three credit reports so quickly, Rick put a fraud alert on them. This was my idea, based on the information we had at the time, so I take responsibility for its consequences. Once Rick receives and verifies his final credit report, he can remove the fraud alert. But we’re both concerned that this may affect Rick’s ability to get the car loan that he really needs at this point. His old car has too much damage to justify repairing it, but he needs to either get a new car or repair it within 30 days of having moved to his new state. I don’t know if having a fraud alert (even a removed one) on his credit reports is going to make this difficult… or impossible.

I pointed out in my description of Rick that he doesn’t have much of a credit history. This is important because, as I said, most of the time these verification questions will be about loans you hold or have held. Because Rick doesn’t have history like that, his “known associates” were used to validate his identity instead. The problem is they asked about someone who is not actually known to Rick.

Stephanie’s Thoughts

I am disappointed in ING Direct. This policy seems completely unlike them, and I do not understand it’s purpose. If the idea is to protect me in the case of someone trying to open an account in my name, how does it help me? Think about it: if some identity thief came along and tried to open an ING Electric Orange account in my name, I’d be the one banned from ever opening the account! It prevents the theft by hurting the victim. In the case of Rick and others like him, he’s banned from an account for life because of a five-question quiz that he had zero chance of answering correctly. He was doomed from the start, with no recourse.

I am truly frightened by the unknown company in question. ING told Rick that they cannot tell him the name of the company that they get their information from. There’s incorrect information being used to identify Rick, but he has no way to correct it. This company, whoever they may be, scares me. They collect information on all of us, from public and (likely) private records, and sell it, and we don’t even know who they are. Even if I knew who they were, this idea makes me devastatingly uncomfortable.

At this point, one of the companies we’re exploring with such an information service is LexisNexis. Brought to my attention by the Bargaineering post Request & Check Your Specialty Reports Annually, the LexisNexis Accurant Person Report “contains a wealth of information, including voter registration, possible associates, property (aircraft, watercrafts!) owned, etc.” [emphasis added]. Rick is planning to request his free LexisNexis Accurant Person Report, but there’s a snag there: he has to submit two forms of identification, one of which must be government issued and include his current address. Remember how I told you Rick’s new license is lost somewhere between the DMV and the post office? Awesome.

Once Rick finally gets his license and photocopies it along with a second form of ID and submits it to LexisNexis, they helpfully say it will take 30-60 days to receive his report. And that’s just until he gets his report – we have no idea how long it will take to dispute any incorrect information on it. Honestly, this could take years to sort out. Hopefully it doesn’t… but what do we do if LexisNexis is not the company supplying incorrect information about Rick’s identity? Questions like that are why this may take a long, long time.

What I want to see happen

I want a comment from ING. As both a customer and affiliate of theirs, I demand a statement. I want that statement to include the name of the company they contract for these validation questions. Just like credit reports, consumers have a right to see these reports and dispute incorrect information on them. We cannot exercise that right if we do not even know the name of the company by whom the information is provided.

I want ING’s statement to include a formal declaration of their policy: is it true that if a customer fails this validation test once, they are banned from opening the account for life? Does it extend to other ING accounts? Is he now never allowed to get an ING Direct mortgage? They’ve already said that Rick is free to keep his Orange Savings account and keep using that. I’m not sure that he’ll want to keep that account when the dust settles on all this, but it’s good to know his current account will not be affected.

Lastly, I want you to take this situation seriously, and take full advantage of your right to annual reports. Had Rick followed that advice when Bargaineering first published that article, this situation might never have occurred. If you pull your specialty reports once a year, you may be able to prevent this for yourself.

Your questions and comments on this situation are welcome, as long as they are in accordance with my comment policy.

*Of course, Rick isn’t his real name. If you know who Rick is, please respect his privacy if you choose to comment.

Update: ING Responds!