Are You Paying for Someone Else’s Mistakes? This Company’s Mix-Ups Could Be Scrambling Your Finances

Thomas Tolbert doesn’t own a motorcycle. But when he switched insurance companies earlier this year, his premium almost doubled based on an incident he supposedly had on one, he says.

Tolbert says he traced the bad information to his Comprehensive Loss Underwriting Exchange auto report, a collection of data auto insurers use to approve clients and set premiums. C.L.U.E. reports are generated and sold by LexisNexis Risk Solutions.

Consumers are often urged to regularly check for errors in credit reports from the big three bureaus — Equifax, Experian and TransUnion. But you may want to add LexisNexis to the list. (For more information on how to do that, check out part 2 of this story.)

The company aggregates and sells consumer data — about 150 different reports on people like you. While many data companies have a niche, such as credit or insurance, LexisNexis reports cover numerous aspects of consumers’ financial lives, helping other companies figure out whether to renew your insurance, approve your loan or offer you a job, among others. And, like credit reports from the big three, your LexisNexis file can contain mistakes, such as outdated information or data about someone else, which can adversely affect your finances.

While Tolbert’s report included the two vehicles he and his son drive, it also listed an alleged motorcycle incident probably involving a different Thomas Tolbert. (The other Tolbert could not be located for comment.) According to the report, which Tolbert provided to NerdWallet, the two Tolberts both live in Florida and at one time used the same insurer. They have different middle initials and different home addresses. LexisNexis had seemingly confused their data in what’s commonly known by industry experts as a “mixed file.”

Tolbert was able to correct his C.L.U.E. report, but he says it came too late for the insurer to lower his premium — so he tried to switch companies again. A new insurer initially quoted him about $370 per month for his cars, but soon revised the quote to about $620 because, Tolbert says, he was mixed up with the same individual again.

Tolbert says this situation has forced him to reduce his coverage and go without for a period of time. And the time he spends disputing the mixed file — which can feel like a game of whack-a-mole — is time he can’t devote to his work in real estate.

The lost time and high premium are “taking money out of my pocket,” he says.

A big problem likely to get worse

Errors in consumer reports are a big problem, says Alan Butler, senior counsel for the Electronic Privacy Information Center. “The burden ultimately should not be falling on consumers.”

People can have their reputations hurt by companies they’ve never heard of, and often don’t know until the damage is done, according to Michael Rapp, a Kansas City-based consumer attorney whose firm has reached dozens of settlements against LexisNexis and companies like it over more than a decade.

“This is the biggest thing you don’t know anything about,” he says.

In a written statement, LexisNexis spokesperson Jennifer Grigas Richman emphasizes that the company’s data procedures meet or exceed industry and regulatory requirements. “We cannot underscore enough our commitment to accuracy,” she says.

But consumer lawyers and privacy advocates worry the problem with mixed files and other data errors is likely to get worse. A Government Accountability Office report in 2013 noted “a vast increase” in the number and types of companies that collect and sell consumer data — often called data brokers — and suggested Congress consider stronger regulation of the industry, which includes LexisNexis. More than five years later, the regulatory landscape hasn’t changed much, but the industry has continued to grow and evolve.

These days, Rapp says, it’s almost impossible to avoid being tracked by data brokers — not just LexisNexis. “If you have a pulse, you have a report,” he says.

Data brokers “operate in a legal vacuum” when it comes to many kinds of consumer data, says Dr. Lydia de la Torre, a data protection law professor at Santa Clara University who has worked with companies including eBay and PayPal on privacy issues. Although lawmakers have recently proposed a series of regulations to protect consumers from the industry, de la Torre isn’t optimistic any will pass in the near term.

What they know about you

LexisNexis Risk Solutions compiles much of its information through public records, such as documents from courthouses and government agencies. Buying a home, getting married or registering a business can all show up in public documents and your LexisNexis file.

Going to college is one of the things that can populate your LexisNexis file.

Even if you never do any of those things, going about your life can still create a record that LexisNexis can collect. Going to college, holding a professional license, having a cell phone, registering to vote and using your email to register for a website are just some of the things that can also populate your file. According to the company’s website, it holds 83 billion public records on 282 million unique identities — an average of about 290 records per identity.

It also compiles data from private sources, according to Richman. For some reports, these sources include insurance companies, industry experts say.

“I’m really surprised if they don’t know what people had for breakfast,” says Kristi Kelly, a consumer law attorney in Fairfax, Virginia, who has argued several mixed-file cases against LexisNexis.

Data brokers like LexisNexis are essentially shopping malls for information, according to Ed DeForest, vice president and senior credit officer at Moody’s Investors Service. Companies that offer mortgages, insurance or other products can turn to LexisNexis to help determine a consumer’s risk profile.

While this ease of sharing information can streamline the approval process — generally a good thing — it can also exacerbate the impact of erroneous information. Once a mistake is made, it can efficiently spread from LexisNexis to its clients, including other companies that collect and sell consumer data. And this happens largely hidden from the public’s view.

The mistakes

For almost two decades, Donald Jaynes says, he received phone calls and mail for a man named Donald Whitehead. (Whitehead could not be reached for comment.) Companies were trying to reach him, wanting payment of bills. Jaynes says he first learned he was being confused with someone else when a credit check was done on him while leasing a car in 1997. He disputed the connection with all three credit bureaus, and Experian responded with a letter saying it had corrected its records. Jaynes doesn’t remember receiving letters from the other bureaus.

But Jaynes says that’s when the calls and mail started, leading him to spend hundreds of hours following up with the creditors that contacted him and trying to determine the source of their information. Jaynes says he traced the issue to LexisNexis and filed a dispute with the company. He says the calls and mail for Whitehead stopped after that, in 2016 — but only temporarily. After believing he had finally fixed the problem, Jaynes says he received another call for Whitehead in August of this year.

Jaynes, who lives in Indiana and worked as a CPA, says he often worried the confusion from his mixed file would prevent him from finding work or financing, despite his own good credit. He later learned, from a collections agent, that his Social Security number differs from Whitehead’s by a single digit.

While Jaynes and Tolbert have been mixed up with strangers, other consumers have found their data muddled with information from family members.

Freelance writer and digital content strategist Farah Fard says she was unable to access her bank account online on multiple occasions because the security questions didn’t pertain to her, but rather to her twin sister. Fard says she learned LexisNexis was her bank’s information source.

“I am just really sick of companies like this acting like it’s just an, ‘Oh well, oops,’ when it has real time consequences for those of us cleaning up these glaring mistakes,” she says.

In a written statement, LexisNexis’ Richman declined to comment on Fard’s case or any other, citing privacy concerns.

How mixed files happen

Mixed files can occur when the information provided to LexisNexis is wrong — such as if an auto insurer confuses two drivers when sharing its information. But mix-ups can happen even if the information provided to LexisNexis is right.

For example, the insurer that covered both Thomas Tolberts provided a document that showed its records hadn’t confused the two.

Mixed files can occur when an auto insurer confuses two drivers when sharing its information with LexisNexis, but they also happen when the data provided is correct.

So if the insurer’s information was correct, what led to the mix-up?

When LexisNexis doesn’t have — or doesn’t use — enough information about an individual when running a search, that can result in multiple people’s data ending up on one person’s report, according to attorney John Soumilas. The Philadelphia-based consumer lawyer has represented plaintiffs on multiple lawsuits against the company.

For example, Soumilas’ firm won a lawsuit in 2014 representing David Smith, a Michigan man who was initially denied a job after his background check turned up a criminal record belonging to a different David Smith. According to the judge’s ruling, LexisNexis hadn’t required the employer to provide a middle name.

Lawyers for LexisNexis contested the verdict, arguing that it had no prior notice that its procedures presented a problem, nor did it know of a reasonable alternative matching procedure that it failed to use, according to a court filing. The jury awarded Smith $375,000, but he eventually received about $75,000 in damages, because the trial court found the original damages award was excessive. An appeals decision agreed and found that LexisNexis had not willfully violated its obligations.

“There’s no good reason not to use a Social Security number when it’s available, or a date of birth, or a middle name,” Soumilas maintains.

In some cases, LexisNexis includes information even if names don’t match, according to Kelly, the consumer attorney in Virginia.

Kelly says she recently reached a settlement for a client whose car insurance premiums skyrocketed after LexisNexis placed accidents and claims belonging to four other people on her client’s report. The other people’s names were spelled differently from her client’s, and the birthdates and Social Security numbers didn’t match, either, Kelly says.

Common names can increase the risk for a mixed file at LexisNexis and other similar companies. So can non-Anglicized names, which might not fit neatly into companies’ matching algorithms, according to Kelly.

James Francis, a colleague of John Soumilas’ who has won settlements against LexisNexis and companies like it for 20 years, complains that LexisNexis seems to view its obligations to accuracy as “minimal, at best.”

LexisNexis spokesperson Richman wouldn’t comment on specific policies and declined to address Francis’ comment, but says that the company undergoes regular audits to ensure legal compliance.

No matter how an error begins, LexisNexis’ wide reach means consumers need to correct any misinformation the company spreads. But, as some consumers have learned, it’s much easier to find an error than to fix one.

Correcting the errors

LexisNexis has a dispute process for people who have found inaccurate or incomplete information on their file. The client of Kelly’s who faced sky-high car insurance rates got her record corrected within a few weeks after filing her dispute.

“We encourage consumers to notify us of potential inaccuracies in their data so that we can further ensure the accuracy of our information,” Richman says.

But for some, the process is less straightforward. The first step is to request a copy of your personal report. Fard, the writer, says it took three attempts over eight months to receive hers, after getting conflicting answers from customer service about whether it was possible to dispute the report. Jaynes says he had similar difficulties.

She says that for her, “It just seems like LexisNexis records are a mutation of information that just snowballs.”

Fard says she requested changes to her file last March, but as of August, she has yet to receive a response from LexisNexis.

For consumers who have a job offer or an insurance policy on the line, LexisNexis’ dispute process — even if it goes smoothly — may not be fast enough. Kelly’s client alleged she had to pay more than $1,500 for six months of car insurance — more than four times the market rate, according to the initial complaint. Soumilas’ client Smith, whose background check got mixed up with a criminal’s, was temporarily unemployed and was unable to pay his bills, according to evidence submitted at the trial.

In cases like Tolbert’s, a fixed report might not stay fixed, either. It can be difficult to truly solve an error “without real humans talking to real people and pulling up real records,” according to Rapp, the attorney.

And the fact that data brokers often share information makes corrections all the more complicated. You might find that the data broker that distributed an inaccurate report about you doesn’t know where the information came from, says Butler of the Electronic Privacy Information Center.

Scale of problem isn’t known

LexisNexis won’t say how many mixed files there are. During Smith’s lawsuit, the company contended that during a recent five-year period, it had generated 24 million consumer reports, and that its reports had an overall dispute rate of only 0.2% — which would be about 48,000 disputes about multiple issues, including mixed files, during that time. In a 2016 decision on the case, the 6th U.S. Circuit Court of Appeals called this rate “remarkably low.” Richman would not provide additional detail but called the inclusion of inaccurate data in its reports “rare.”

But these numbers are unlikely to reflect the extent of the problem, says Francis, the attorney. “That only would address the number of people who disputed, not the number of errors that are actually created. And not everybody disputes.”

A 2004 report by the Federal Trade Commission found that credit reports by Experian, Equifax and TransUnion contain Social Security numbers that are off by a digit or two about 1% to 2% of the time. A 2012 follow-up report found that, for credit reports with disputed collection information, data that didn’t belong to the consumer was alleged in 84% of cases. About 40% of those consumers were unable to find a resolution after a dispute, the FTC reported.

Accusations of incorrect information make up more than half of the credit or consumer reporting complaints the Consumer Financial Protection Bureau receives, according to a 2018 report.

And mixed files are a common problem Kelly sees in her cases with data brokers. She says a lot of her clients end up suing “the same consumer reporting agencies, including LexisNexis, over and over for the same violations because they don’t correct them.”

Operating in the ‘Wild West’

Complicating matters is the lack of federal regulation of consumer data. The Fair Credit Reporting Act, which entitles you to free annual reports and prompt resolution of disputes, among other things, applies to some LexisNexis reports, but not all. There is no comprehensive federal regulation covering the data broker industry — just a few state laws and some federal statutes regulating particular types of consumer data, many dating from the 1990s and earlier.

Lawmakers have proposed regulations in the past year that would affect data brokers, including laws that would expand FCRA protections, allow more thorough consumer opt-outs and levy stricter penalties on executives of companies found to be violating the rules. But Santa Clara University’s de la Torre doesn’t think any will be passed in the next couple of years because of other government priorities.

For now, many companies are operating “in the Wild West, and they just do whatever they want,” says Francis, the consumer lawyer.

Even on reports that are governed by the FCRA, Francis contends that companies’ practices for data retrieval can fall short of the FCRA standard, which requires credit reporting agencies to maintain “maximum possible accuracy” in their data.

LexisNexis’ Richman counters that the company is in strict compliance with the FCRA. “We strive to achieve the highest precision rate possible,” she says.

In the 6th Circuit Court’s 2016 decision on the Smith case, the panel noted, “A reasonable jury could conclude that Lexis negligently violated the FCRA by not requiring Smith’s middle name.” The appeals court affirmed the Michigan district court decision, which called the deficiencies in LexisNexis’ matching procedures “glaring.”

But the 6th Circuit also declined to uphold a portion of the damages the lower court awarded Smith, in part because the panel held that there was evidence LexisNexis’ procedures met or exceeded industry standards.

“I’m sure that the big companies spend a lot of money on compliance,” EPIC’s Butler says. “That doesn’t really provide much comfort if there’s still significant errors going on.”

And the errors we know about, Butler adds, are just “the tip of the iceberg.”

Tolbert is still fighting

Rather than attempt the traditional dispute process with LexisNexis again, Tolbert says, he served it with an intent to file suit. As of June, he said he had not received a response.

“I just want this matter resolved, and I want it to stay resolved,” Tolbert says. “[They] need to learn [they] can’t just do this to people and walk away.”