Much of the controversy surrounding The Work Number, Equifax’s employment-verification database that contains sensitive information on salaries for around 1/3 of the U.S. workforce, has dealt with debt collectors’ access to the data. But lenders can get at your reports just by claiming they have your permission.

In its response to earlier stories about The Work Number, Equifax — one of the three major U.S. credit-reporting agencies — had stressed that lenders could only access an employee’s record with that person’s permission.

But Carol, who uses The Work Number regularly as part of her job as a mortgage fraud investigator, explains to Consumerist that most borrowers have already given their mortgage lenders permission to access the info, which could include your salary, at any point it chooses to in the future. And even if the lender doesn’t have that permission, there isn’t really anything stopping it from getting that data.

CHECKING UP ON YOU
“What many people may not realize is that in almost every case where an individual has obtained a mortgage loan, they have given consent for somebody to re-verify the information in the mortgage application file,” Carol explains. This consent would include accessing income information held by The Work Number, even years after the fact.

She points to the “Acknowledgement and Agreement” section of the Uniform Loan Application — the “1003” — the standard mortgage loan application document.

It reads:

“Each of the undersigned hereby acknowledges that any owner of the loan, its servicer, successors, and assigns, may verify or reverify any information contained in this application or obtain any data relating to the loan, for any legitimate business purpose through any source, including a source named in this application or a consumer reporting agency.”

We asked Equifax about lenders having protracted, post-closing access to borrowers reports, and a rep for the company pointed us to exactly the same language on form 1003.

Additionally, says Carol, most lenders will require the borrower to sign a separate authorization form that includes similar (and in many cases broader) language authorizing parties to verify and validate information.

HONOR SYSTEM
As for Equifax’s contention that those accessing the information need the employee’s permission to do so, Carol says it’s really just an “honor system” where the lender merely has to promise that it has permission.

“As part of obtaining income information, you click a box acknowledging that you have authorization to obtain the information,” she explains. “But at no point are you requested to provide that actual authorization.”

She points out that this is the exact same system set up for requesting credit reports, so it’s nothing new.

“You don’t fax a signed release to a credit reporting agency to get them to release a credit report,” says Carol. “You simply check a box acknowledging that you have authorization to access the records.”

In response to these concerns, the Equifax rep tells Consumerist, “Our clients agree in their agreements that they will have consumer consent in advance of pulling a consumer’s income verification. We regularly audit our clients to make sure they are using our data in full compliance of the agreement we have with them and FCRA guidelines. If a client is not able to successfully pass an audit, there are consequences up to and including termination of the relationship.”

Carol confirms that these audits to take place.

“In the past we have been asked to provide documentation of our authorization after the fact,” she explains, though she does point out that this is all after the data has been received from Equifax.

And even though she believes that her employer would terminate anyone caught making a request without any sort of permission, she tells Consumerist, “I can see the potential for misuse here for those lacking scruples.”

DE FACTO DEBT COLLECTORS?
Though, in a recent Forbes.com piece, Equifax stated that, “The Work Number does not provide debt collectors with salary/pay rate/income information,” Carol says the veracity of that claim might depend on how you view the term “debt collection.”

She explains that when a mortgage is in default, many lenders/servicers will assign the mortgage to a company specializing in the foreclosure process.

“Once that happens, that party, which is in essence a debt collector and calling the borrower for that purpose, is also the servicer and/or ‘owner’ of the mortgage,” claims Carol, “and can thus use a Work Number account under that category. At that point, the authorization in the file, which specially covers servicers and assigns, is 100% usable to obtain income information.”

However, a statement from Equifax claims quite the opposite:

“Should a consumer default on his or her account, if the lender employs a third party debt collection agency, that agency can verify only employment information — not income — from Equifax Workforce Solutions in its effort to collect on the account.”

YOU CALL THAT A PIN?
Finally, we heard from another Consumerist reader, Peter, who immediately went to log into The Work Number when he found out that his employer is one of the more than 2,000 companies that uses the service.

“Sleuthing around my employer’s intranet, I found the instructions for obtaining Employment and Salary verification (which you need to do when, say, applying for a Mortgage) and those instructions gave login info for the Work Number website,” he writes. “It turns out, the ‘security’ for this site (for my employer anyway) involves nothing more than
supplying your SSN (which is your UserID) and DOB (which is your default PIN).”

He says those two pieces of information were all he needed to obtain access to his full report.

“Some employer clients use SSN as the login and others choose something different,” the Equifax rep tells Consumerist. “Each company sets their default PIN scheme at the time of implementation and that PIN is good for the initial login only, then they are asked to enroll in our risk-based authentication tool and change their password to something of their choice.”

SEE IF EQUIFAX HAS YOUR NUMBER
This is where we remind you that you can check if your employer is involved with the The Work Number. To do so, go HERE and click on “Find Employer Name” right above the Log In button. That will bring up a window where you can search for your employer.

If your employer is supplying info to The Work Number, you are entitled to one free report every 12 months. To get that, click HERE and follow the steps.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.