Credit Reporting Agencies Don’t Just Report Credit Scores

Credit Reporting Agencies Don’t Just Report Credit Scores

Justin Sherman

November 9, 2022

The United States has three primary credit reporting agencies, which provide information on individuals’ bill payment history, loans, and other financial activity to prospective lenders, banks, and other institutions. These companies are Equifax, TransUnion, and Experian.

As credit reporting agencies, they are governed by the Fair Credit Reporting Act (FCRA), a piece of legislation that governs credit bureaus, tenant screening services, and other consumer reporting agencies. The FCRA gives individuals the right to see their own credit report and requires companies to investigate cases where individuals dispute the accuracy of information about them, among others.

But the credit reporting agencies are also data brokers. They are data brokers in the basic sense that they broker access to information, such as information on someone’s credit card payments. They are also data brokers as some of them sell other information, too: Equifax, for example, advertises data related to individuals’ automobile use, restaurant activity, insurance plans, travel and leisure preferences, and more. It claims that some of this information, like its service “The Work Number” that monetizes workers’ data, is segmented from its other datasets.

Equifax and TransUnion are publicly traded, U.S.-incorporated companies, which means they must file regular reports with the U.S. Securities and Exchange Commission (SEC). These SEC reports hold some information about Equifax and TransUnion’s data brokerage practices. Importantly, companies submitting SEC filings must make those filings truthful to the best of their knowledge. As the SEC puts it, “a person who is found to have knowingly and willfully submitted false, fictitious, and/or fraudulent statements to the SEC may be subject to criminal sanctions under federal law.”

For informational purposes, excerpts from Equifax and TransUnion’s recent SEC filings pertaining to their data brokerage activities are highlighted below.

Experian is based in Ireland and listed on the London Stock Exchange. It is therefore not subject to the same regulatory requirements as Equifax and TransUnion. Instead, companies listed on the London Stock Exchange are required to publish an annual financial report “not later than four months after the end of its financial year.” Under Section 401 of the UK’s Financial Services and Markets Act, it is also a criminal offense for a covered company to knowingly or recklessly make false or misleading statements—or knowingly or recklessly create false or misleading impressions. In Ireland, where Experian is incorporated, the Consumer Protection Act makes it illegal for companies to make a false or misleading claim about products, services, and prices.

Akin to the report excerpts from Equifax and TransUnion, excerpts from Experian’s latest annual report for 2022 are also included below.

Equifax describes valuing its datasets at hundreds of millions of dollars, further expanding its data brokerage activities into other countries, and using machine learning and other techniques to conduct analysis on its datasets that include healthcare, employment, and other information. TransUnion describes buying other data brokers in 2022, including Argus Information and Advisory Services and the financial services unit of data broker Verisk, and buying up data provider Neustar and identity services company Sontiq in December 2021. It also describes emerging verticals in the areas of tenant and employment, technology, insurance, and media and that it offers marketing solutions to clients on top of brokering access to credit reports.

And Experian, for its part, states that it made billions of dollars in the last year from business-to-business “data” activities with external customers, ranging from North America to the Asia-Pacific—more revenue than it generated from any other listed business activity. The annual report also states that Experian bought a company Salary Limited, after which it launched a product called “Work Report,” described by Experian as “the UK’s first service that automates the digital sharing of payroll information on behalf of the consumer.” Part of this service, per Experian, is “the UK’s first National Employer Database (NED), a single source of verified employer names, covering 99% of all UK employees.”

Collectively, these documents underscore that the companies market themselves as credit reporting agencies while also generating significant revenue streams outside of that business vertical. It is also unclear the extent to which these companies’ data brokerage practices are firewalled from one another with technical and corporate controls—such as those, for instance, which could segment data used for FCRA-regulated credit reporting from data used to help insurance companies profile and run advertisements to consumers.

Equifax Form 10-Q (quarterly filing), for quarter ending September 30, 2022

Equifax’s recent Form 10-Q filing to the SEC includes the following information:

• Equifax listed its “data processing equipment and infrastructure” assets as worth $306.3 million as of September 30, 2022—up from $299.6 million as of December 31, 2021. (p. 7)
• “We develop, maintain, and enhance secured proprietary information databases through the compilation of consumer specific data, including credit, income, employment, criminal history, asset, liquidity, net worth and spending activity, and business data, including credit and business demographics, that we obtain from a variety of sources, such as credit garnering institutions, and income and tax information primarily from large to mid-sized companies in the U.S. We process this information utilizing our proprietary information management systems.” (p. 12)
• In 2022, Equifax bought Efficient Hire, “a provider of cloud recruiting, onboarding, and human resources management solutions, within the Workforce Solutions operating segment,” and bought Data Crédito, “a consumer credit reporting agency in the Dominican Republic, within the International operating segment.” (p. 15)
• Under its Purchased Intangible Assets, Equifax lists its “Purchased data files” as worth a gross of $1.073 billion and a net of $571.1 million and its “Proprietary database” as worth a gross of $706.5 million and a net of $605.5 million. (p. 17) It elaborates that “Purchased data files represent the estimated acquisition data fair value of consumer information files acquired primarily through various acquisitions primarily in the U.S., Australia, and Canada. We expense the cost of modifying and updating credit files in the period such costs are incurred.” (p. 16)
• Equifax has “separate agreements with Google, Amazon Web Services, IBM, Tata Consultancy Services, and others to outsource portions of our network and security infrastructure, computer data processing operations, applications development, business continuity and recovery services, help desk service and desktop support functions, operation of our voice, data, and cloud computing networks, maintenance and related functions, and to provide certain other administrative and operational services.” (p. 20)
• “We have a large and diversified group of clients, including financial institutions, corporations, government agencies, and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational history, criminal history, healthcare professional licensure, and sanctions, demographic, and marketing data. We use advanced statistical techniques, machine learning, and proprietary software tools to analyze available data to create customed insights, decision-making, and process automation solutions and processing services for our clients.” (p. 23)

On the growth of some of its data services verticals, the company added:

• For Equifax’s Verification Services, it said: “Revenue increased by 13% and 25% for the third quarter and first nine months of 2022, respectively, compared to the same periods in 2021. The increase in revenue for both periods was due to growth in talent solutions, government, and consumer finance verticals, along with acquisition revenue principally from Insights, offset by a decline in the mortgage vertical due to significantly slower U.S. mortgage orientation activity in 2022 due to higher interest rates. Verification Services benefited across all verticals from the continued growth of employment and income records in The Work Number database.” (p. 28)
• For Equifax’s Financial Marketing Services, it said: “Revenue decreased by 8% and 9% for the third quarter and first nine months of 2022, respectively, compared to the same period in 2021. The decreases for both periods were driven by lower fraud, risk management, and other data services revenue.” (p. 30)

TransUnion Form 10-Q (quarterly filing), for quarter ending June 30, 2022

TransUnion’s recent Form 10-Q filing to the SEC includes the following information:

• “On April 8, 2022, we completed our acquisition of Verisk Financial Services (‘VF’), the financial services business unit of Verisk Analytics, Inc. … We are retaining the leading core businesses of Argus Information and Advisory Services, Inc. and Commerce Signals, Inc. (collectively, ‘Argus’), and intend to divest the remaining non-core businesses. Argus is relied upon by leading financial institutions, payments providers, and retailers worldwide for competitive studies, predictive analytics, models, and advisory services to provide a clear perspective on where their business stands today and to best position them for success in the future.” (p. 11)
• From the previous year, TransUnion states: “On December 1, 2021, we completed the acquisition of Neustar, Inc. (‘Neustar’). We acquired 100% of the equity interests of Neustar for $3,099.7 million in cash… Neustar, a premier identity resolution company with leading solutions in Marketing, Risk, and Communications, enables customers to build connected consumer experiences by combining decision analytics with real-time identity resolution services driven by its OneID platform. The acquisition of Neustar provides immediate scale to our identity resolution services through Neustar’s large, well-established customer base, accelerates the future growth of our identity-based solutions, and expands our powerful digital identity capabilities through the addition of distinctive data and analytics, enabling consumers and businesses to transact online with greater confidence. We engaged in business activities with Neustar prior to the acquisition that were not material.” (p. 12)
• Also from the previous year, TransUnion states: “On December 1, 2021, we completed the acquisition of Sontiq, Inc. (‘Sontiq’). We acquired 100% of the equity interests of Sontiq for $642.6 million in cash… Sontiq provides solutions including identity monitoring, restoration, and response products and services to help empower consumers and businesses to proactively protect against identity theft and cyber threats. The acquisition of Sontiq provides access to an attractive new base of customers and consumers through a highly recurring subscription-based revenue model and also complements and expands our Consumer Interactive solutions portfolio by providing valuable identity protection services for consumers. Sontiq’s identity security monitoring products incorporate our credit data, are highly complementary to our capabilities, and are expected to significantly increase our opportunities for growth.” (p. 13)
• On December 17, 2021, TransUnion “completed the sale of our Healthcare business for total consideration of $1,706.4 million in cash… The terms and conditions of the transaction are set forth in the Stock Purchase Agreement dated as of October 26, 2021, by and between Trans Union LLC and nThrive, Inc. (‘nThrive’). We also entered into a transition services agreement (‘TSA’) that requires Trans Union LLC to provide certain administrative and operational services to nThrive on a transitional basis for generally up to 24 months.” (p. 15)

On revenue streams, datasets, and growing verticals, TransUnion added:

• “The Financial Services vertical, which accounted for 46.8% of our U.S. Markets revenue for the six months ended June 30, 2022, consists of our consumer lending, mortgage, auto, and cards and payment lines of business, and our recently acquired Argus business. Our Financial Services clients consist of most banks, credit unions, finance companies, auto lenders, mortgage lenders, FinTechs, and other consumer lenders in the United States. We also distribute our solutions through most major resellers, secondary market players, and sales agents. Beyond traditional lenders, we work with a variety of credit arrangers, such as auto dealers and peer-to-peer lenders. We provide solutions across every aspect of the lending lifecycle; customer acquisition and engagement, fraud and ID management, retention, and recovery. Our products are focused on mitigating risk and include credit reporting, credit marketing, analytics and consulting, identity verification and authentication, and debt recovery solutions.” (p. 25)
• “Emerging Verticals include Insurance, Services and Collections, Tenant and Employment, Technology, Commerce & Communications, Public Sector, Media, and other emerging verticals we serve, as well as our recently acquired Neustar business. Our solutions in these verticals are also data-driven and address the entire customer lifecycle. We offer onboarding and transaction processing products, scoring and analytic products, marketing solutions, fraud and identity management solutions, and customer retention solutions.” (p. 25)
• “Our solutions are based on a foundation of data assets across financial, credit, alternative credit, identity, phone activity, digital device information, marketing, bankruptcy, lien, judgment, insurance claims, automotive and other relevant information obtained from thousands of services including financial institutions, private databases, and public records repositories. We refine, standardize, and enhance this data using sophisticated algorithms to create proprietary databases. Our acquisition of Neustar, and particularly its OneID platform, further enhances our ability to deliver real-time, persistent identity resolution of disparate data fragments and attributes, in a privacy compliant manner.” (p. 31)
• “We sell our solutions to leading consumer lending banks, credit card issuers, alternative lenders, online-only lenders (‘FinTechs’), Point of Sale (‘POS’)/Buy now Pay Later (‘BNPL’) lenders, auto lenders, auto insurance carriers, cable and telecom operators, retailers, and federal, state, and local government agencies. We have been successful in leveraging our brand, our expertise, and our solutions and have a leading presence in several high-growth international markets. Millions of consumers across the globe also use our data to help manage their personal finances and take precautions against identity theft.” (p. 32)
• “We operate primarily on contributory data models in which we typically obtain updated information including a growing set of public record and alternative data, at little or no cost, as we develop new solutions and expand into new industries and geographics. We are evolving our hybrid public-private cloud technology infrastructure to ensure that our systems remain highly secure, reliable, scalable, and performant by design.” (p. 32)

Experian Annual Report, for year ending March 31, 2022

Experian’s latest annual report includes the following information:

• Experian states that it spent $1 billion on “data and information technology costs” in the last year. (p. 159)
• The company states that it made $3.313 billion in revenue from external customers from “data” activity. This is broken down into $2.033 billion from North American external customers, $528 million from Latin American external customers, $409 million from UK and Ireland external customers, and $343 million from external customers in Europe, the Middle East, Africa, and the Asia-Pacific. (p. 176)
• Experian states that its databases are worth, as of March 31, 2022, $1.515 billion. (p. 192)
• “In September 2015, Experian North America suffered an unauthorized intrusion to its Decision Analytics computing environment that allowed unauthorized acquisition of certain data belonging to a client, T-Mobile USA, Inc. We notified the individuals who may have been affected and offered free credit monitoring and identity theft resolution services. In addition, government agencies were notified as required by law.” (p. 214)
• It lists, under “purchase of other intangible assets,” “databases” for $180 million. (p. 216)
• “…on 5 May 2022 we completed the acquisition of the trade and assets comprising Salary Finance Limited’s Work Report and National Employer Database in the UK for US$29m with contingent consideration of US$14m payable on achievement of a number of integration and data coverage objectives.” (p. 219)
• Business-to-business “data” activity generates more revenue for Experian than its business-to-business “decisioning” category and its consumer services category. (p. 5)
• It lists multiple data-oriented services:
  • “Experian Ascend,” described as “our pioneering combination of data, technology, and analytics helps businesses gain powerful insight to make quick and accurate lending decisions.” (p. 17)
  • “Experian Health,” described as “our range of patient engagement solutions makes healthcare more accessible, seamless, and convenient for patients and medical staff.” (p. 17)
  • “PowerCurve,” described as “our component-based decisioning platform helps businesses to make better customer decisions by deploying rich data and advanced analytics for analyzing credit risk, decisioning, including marketing, identity, and fraud, and affordability across the full customer lifecycle.” (p. 17)
• “Our B2B clients are organizations that purchase our data assets, technology solutions, and analytics.” (p. 23)
• “Many of our data contributions are also our clients. They often supply us with data through a give-to-get model. Our ability to combine, clean, sort, and aggregate data from thousands of data contributors creates a more complete picture of consumer or business interactions across markets.” (p. 24)
• Experian states that it has 12,000 “data contributors” in the United States. (p. 24)
• “Unrivaled in its scale, quality, and integrity,” “we hold and manage the credit history and repayment data of 1.4 billion people and 191 million businesses” worldwide. (p. 27)
• Experian states that its key customers for business-to-business data are banks, automotive dealers, retailers, and telecommunications companies. It adds, “we aggregate data from many sources and turn it into information they can use for many different purposes.” Further, it states that “we also provide marketing data relevant to consumer lifestyles which helps businesses understand their customers better and serve them with tailored products.” (p. 31)
• Its revenue model for business-to-business data is “primarily transactional with some contribution from license fees.” (p. 31)
• “Main competitors: Equifax, TransUnion, Dun & Bradstreet, BoaVista, LiveRamp, and Epsilon.” (p. 31)
• “We are focused on further penetrating the Health, Automotive, and Mortgage verticals, while further building our position in the Verification and Employment Services area.” For example, the company states, “we have established a solid base in employer services in the USA which in turn enables us to access employment records for specified and consented use cases. We will continue to expand the number of records we hold as well as establishing capabilities in some of our other geographies.” (p. 40)
• “Every month we receive around 34,000 submissions from data providers in the USA, and update around 1.3 billion records — 98% within 24 hours.” (p. 52)

—

Justin Sherman (@jshermcyber) is a senior fellow at Duke University’s Sanford School of Public Policy, where he leads its data brokerage research project.