Security Risks

We are contacting you from the Hey Jude App. We’re a digital assistant service that helps our members with tasks that they need.

We've got a client who has been trying to sign up with Transunion for their True Credit report.

When they tried to process the payment on the website, the client received a message saying 'Something went wrong but there were no further details.

Our client called Transunion and a consultant by the name of Lebogang told the client to email the ID & proof of residence to them so they could update the profile, and the Transunion consultant also agreed they would call back in 10 minutes.

An hour later, Lebogang (Transunion consultant) didn't call back. The client decided to call Transunion again and a different consultant by the name of Naomi (Transunion consultant) told the client to give the OTP sent on the phone so that Naomi (Transunion consultant) could log into the profile.

The client requested assistance from the daughter because sharing an OTP is considered high risk, something which the client would have thought Transunion would be mindful of.

However, Naomi (TransUnion consultant) said that she couldn't access the client's profile, and considering Transunion already had the client's ID and proof of residence, client wasn't comfortable sharing the OTP too.

We would like to raise these risks with Transunion. In our client's opinion, Transunion should have better basic security protocols, especially for a company that is trying to sell you a security product.

Also, it doesn't make sense that a new client isn't able to upload their id and proof of residence themselves onto the Transunion website. Or that the payment error isn't specific enough to tell you why this failed.