The entire credit system is a security nightmare. They all appear to use very basic "security" that has not been upgraded along with the rest of the world. Conflating identity and authorization, using deterministic values instead of random ones when necessary, and even for Equifax plain old sending people to the wrong domain.
