WEBVTT 00:00:00.000 --> 00:00:02.439 Welcome back to the deep dive. You know that 00:00:02.439 --> 00:00:06.799 feeling that a moment of profound anxiety when 00:00:06.799 --> 00:00:09.699 your whole financial life flashes before your 00:00:09.699 --> 00:00:12.019 eyes. Maybe you're trying to secure a really 00:00:12.019 --> 00:00:14.300 crucial business loan or maybe you're just trying 00:00:14.300 --> 00:00:16.140 to rent an apartment and you know there's this 00:00:16.140 --> 00:00:18.879 massive unseen entity out there that's holding 00:00:18.879 --> 00:00:21.280 all the keys to that decision. And that entity 00:00:21.280 --> 00:00:24.379 is almost always one of the big three credit 00:00:24.379 --> 00:00:26.399 reporting agencies and not just scorekeepers 00:00:26.399 --> 00:00:29.300 anymore. Not by a long shot. They are. you know, 00:00:29.300 --> 00:00:32.060 these foundational pillars of our economic access. 00:00:32.280 --> 00:00:34.520 They're the gatekeepers who determine if you 00:00:34.520 --> 00:00:36.560 qualify for credit, what interest rate you're 00:00:36.560 --> 00:00:38.600 going to pay. Or even, like you said, if you 00:00:38.600 --> 00:00:40.700 can rent that new place using a service like 00:00:40.700 --> 00:00:42.859 SmartMove. Exactly. And that's where it gets 00:00:42.859 --> 00:00:45.420 really personal, really fast. And what happens 00:00:45.420 --> 00:00:47.820 when the systems run by these giant, I mean, 00:00:47.840 --> 00:00:50.140 systems built on mountains of incredibly sensitive 00:00:50.140 --> 00:00:53.520 personal data, what happens when they fail? When 00:00:53.520 --> 00:00:55.880 identity theft leaves you fighting a ghost in 00:00:55.880 --> 00:00:58.960 the machine or when a simple error takes years, 00:00:59.079 --> 00:01:01.640 not weeks, to correct and you're just trapped 00:01:01.640 --> 00:01:04.140 in this financial limbo. That's the real world 00:01:04.140 --> 00:01:06.680 consequence of their power. It's immense. It 00:01:06.680 --> 00:01:08.799 is. And that's why today we're taking a deep 00:01:08.799 --> 00:01:12.719 dive into one of those giants, TransUnion. The 00:01:12.719 --> 00:01:14.719 listener provided us with a truly comprehensive 00:01:14.719 --> 00:01:18.299 stack of sources covering this company and, well. 00:01:18.730 --> 00:01:21.849 Our mission today is to peel back all those layers 00:01:21.849 --> 00:01:25.750 of its operation. We need to understand its really 00:01:25.750 --> 00:01:28.909 bizarre origins. It's a story that begins with 00:01:28.909 --> 00:01:31.810 railroad logistics and old industrial empires. 00:01:31.870 --> 00:01:34.799 What you'd expect. Not at all. And then we need 00:01:34.799 --> 00:01:37.859 to trace its explosive growth into this global 00:01:37.859 --> 00:01:41.439 identity management powerhouse, all fueled by 00:01:41.439 --> 00:01:44.719 big data and AI. And crucially, we have to reconcile 00:01:44.719 --> 00:01:47.260 that image, you know, the image of high tech 00:01:47.260 --> 00:01:50.200 ambition with the persistent legal and security 00:01:50.200 --> 00:01:52.760 challenges that constantly land them in regulatory 00:01:52.760 --> 00:01:56.099 hot water. Yes, we have to figure out how a company 00:01:56.099 --> 00:01:58.180 that holds the financial profile of a billion 00:01:58.180 --> 00:02:01.019 people worldwide can simultaneously be called, 00:02:01.079 --> 00:02:03.719 and this is a direct quote, incapable. of operating 00:02:03.719 --> 00:02:06.620 lawfully. That quote is just staggering. It is. 00:02:06.680 --> 00:02:08.819 So let's ground this immediately with some scale 00:02:08.819 --> 00:02:10.460 just to get a sense of what we're dealing with. 00:02:10.500 --> 00:02:12.169 Okay, let's do it. We're talking about an American 00:02:12.169 --> 00:02:14.729 consumer credit reporting agency. It's headquartered 00:02:14.729 --> 00:02:17.610 in Chicago, founded back in 1968. Right. As of 00:02:17.610 --> 00:02:20.370 2024, the sources show us the financial magnitude 00:02:20.370 --> 00:02:23.289 of this thing. We're looking at $4 .18 billion 00:02:23.289 --> 00:02:26.590 in annual revenue. $4 billion. And they have 00:02:26.590 --> 00:02:30.849 13 ,400 employees. But the real staggering figure, 00:02:30.969 --> 00:02:32.150 the one that's hard to get your head around, 00:02:32.370 --> 00:02:35.949 is the data footprint. The data. They hold information 00:02:35.949 --> 00:02:40.569 on over 1 billion individual consumers. 1 billion. 00:02:41.150 --> 00:02:43.150 With a B. One billion. And that's across more 00:02:43.150 --> 00:02:46.389 than 30 countries. And in the U .S. alone, they 00:02:46.389 --> 00:02:49.169 have, what, 200 million files? Which means they 00:02:49.169 --> 00:02:51.930 have a profile on nearly every single credit 00:02:51.930 --> 00:02:54.370 active consumer in the entire country. Almost 00:02:54.370 --> 00:02:56.770 everyone. It's hard to wrap your mind around 00:02:56.770 --> 00:02:58.909 that kind of volume. You really can't. It truly 00:02:58.909 --> 00:03:02.009 is. And that scale is why their history matters. 00:03:02.520 --> 00:03:04.979 It's why their technology matters. And it's why 00:03:04.979 --> 00:03:07.099 their constant legal struggles matter so much. 00:03:07.199 --> 00:03:08.639 So I guess our starting point has to be that 00:03:08.639 --> 00:03:11.240 essential question, right? How did this massive 00:03:11.240 --> 00:03:14.960 entity formed nearly six decades ago pivot from 00:03:14.960 --> 00:03:18.319 industrial infrastructure to becoming the gatekeeper 00:03:18.319 --> 00:03:21.669 for global consumer identity data? And why is 00:03:21.669 --> 00:03:24.349 that whole transition just fraught with constant 00:03:24.349 --> 00:03:27.310 legal oversight and operational failure? That's 00:03:27.310 --> 00:03:29.189 the core of it. OK, so let's unpack this. We 00:03:29.189 --> 00:03:31.229 have to start with the origins because the history, 00:03:31.330 --> 00:03:33.289 like you said, is not what you expect from a 00:03:33.289 --> 00:03:37.110 credit bureau. This is Section 1. From tank cars 00:03:37.110 --> 00:03:41.610 to credit scores, the foundation and scale. And 00:03:41.610 --> 00:03:44.379 this historical nugget. is, for me, one of the 00:03:44.379 --> 00:03:46.400 most fascinating details in all the sources. 00:03:46.599 --> 00:03:48.360 Because when you think about the founding of 00:03:48.360 --> 00:03:51.319 a credit reporting agency, you usually imagine, 00:03:51.419 --> 00:03:53.699 you know, small -time accountants consolidating 00:03:53.699 --> 00:03:55.599 local ledgers or something. Right, a couple of 00:03:55.599 --> 00:03:57.819 local banks deciding to share information on 00:03:57.819 --> 00:04:00.780 who pays their bills on time. Exactly. But TransUnion 00:04:00.780 --> 00:04:02.520 was born from a completely different kind of 00:04:02.520 --> 00:04:04.599 corporate leviathan, a totally different world. 00:04:04.800 --> 00:04:06.699 So tell us about that lineage. Where did they 00:04:06.699 --> 00:04:08.500 actually come from? TransUnion was initially 00:04:08.500 --> 00:04:12.159 formed in 1968, and it was formed as a holding 00:04:12.159 --> 00:04:14.599 company. A holding company for what? Not a bank, 00:04:14.680 --> 00:04:17.860 I'm guessing. Not a bank. A holding company for 00:04:17.860 --> 00:04:20.579 the Union Tank Car Company. Union Tank Car Company. 00:04:20.699 --> 00:04:25.480 So railroad cars, industrial shipping, massive 00:04:25.480 --> 00:04:27.959 steel containers moving bulk materials around 00:04:27.959 --> 00:04:30.860 the country. That's it. A far, far cry from digital 00:04:30.860 --> 00:04:32.819 credit scores. What kind of scale are we even 00:04:32.819 --> 00:04:35.019 talking about with a company like that back then? 00:04:35.180 --> 00:04:37.300 Well, the Union Tank Car Company was instrumental 00:04:37.300 --> 00:04:40.000 in the physical infrastructure of American commerce. 00:04:40.569 --> 00:04:43.930 I mean, it owned at least tens of thousands of 00:04:43.930 --> 00:04:46.649 these specialized rail cars. So a major player. 00:04:46.829 --> 00:04:49.269 A huge player. Yeah. And here is where the history 00:04:49.269 --> 00:04:52.610 connects to massive industrial power. Through 00:04:52.610 --> 00:04:55.490 that company, TransUnion is a direct descendant 00:04:55.490 --> 00:04:58.589 of Standard Oil. The Standard Oil. John D. Rockefeller's 00:04:58.589 --> 00:05:02.000 Standard Oil. The very same. Wow. OK, that. That 00:05:02.000 --> 00:05:04.019 immediately reframes the whole nature of this 00:05:04.019 --> 00:05:06.180 organization. It does, doesn't it? This wasn't 00:05:06.180 --> 00:05:08.560 founded by some financial startups in a garage. 00:05:08.620 --> 00:05:11.000 It's a direct corporate descendant of the original 00:05:11.000 --> 00:05:13.240 industrial titans that built the American economy. 00:05:13.899 --> 00:05:16.459 These were companies built on control, on controlling 00:05:16.459 --> 00:05:19.439 vital physical infrastructure. Exactly. And you 00:05:19.439 --> 00:05:22.139 can see it as a transfer of that model of centralized, 00:05:22.240 --> 00:05:25.699 almost monopolistic scale power. Oh, so? Instead 00:05:25.699 --> 00:05:27.639 of controlling the distribution of crude oil 00:05:27.639 --> 00:05:31.319 via a network of rail cars, they evolved to control 00:05:31.319 --> 00:05:33.779 the distribution of consumer identity and financial 00:05:33.779 --> 00:05:37.759 data. That's a powerful analogy. It is. The scale 00:05:37.759 --> 00:05:40.060 of operation that was required to manage a massive 00:05:40.060 --> 00:05:42.259 fleet of rail cars in the mid -20th century. 00:05:42.779 --> 00:05:45.420 That's the same corporate DNA that now manages 00:05:45.420 --> 00:05:48.339 a billion consumer profiles globally. It's a 00:05:48.339 --> 00:05:50.839 compelling historical symmetry. So once they 00:05:50.839 --> 00:05:53.300 reformed in 1968, they didn't waste any time 00:05:53.300 --> 00:05:56.899 pivoting from, you know, steel and rails to data. 00:05:57.040 --> 00:05:59.579 They moved with incredible speed and decisiveness. 00:05:59.639 --> 00:06:03.240 Just one year later, in 1969, they acquired the 00:06:03.240 --> 00:06:05.339 credit bureau of Cook County. Cook County. So 00:06:05.339 --> 00:06:07.839 that's Chicago. Right. And this was an incredibly 00:06:07.839 --> 00:06:10.800 strategic move. It instantly gave them a massive 00:06:10.800 --> 00:06:13.240 ready -made foundational data set. So they didn't 00:06:13.240 --> 00:06:15.540 have to build it themselves. Nope. That one acquisition 00:06:15.540 --> 00:06:19.040 brought them 3 .6 million credit accounts overnight. 00:06:19.399 --> 00:06:22.199 3 .6 million. Just like that. Just like that. 00:06:22.259 --> 00:06:25.879 So that single move, acquiring 3 .6 million accounts, 00:06:26.120 --> 00:06:28.519 it immediately established them as a serious 00:06:28.519 --> 00:06:31.620 national plan. It let them bypass the years, 00:06:31.680 --> 00:06:34.420 maybe decades it would have taken to build a 00:06:34.420 --> 00:06:36.379 data reservoir account by account. It was a huge 00:06:36.379 --> 00:06:39.509 shortcut. A massive one. And as the decades passed, 00:06:39.829 --> 00:06:43.250 the value of that consolidated data just grew 00:06:43.250 --> 00:06:45.649 exponentially. You can see it reflected in their 00:06:45.649 --> 00:06:47.449 ownership changes. Yeah, talk about that. In 00:06:47.449 --> 00:06:50.329 1981, they were acquired by the Marmon Group 00:06:50.329 --> 00:06:54.709 for approximately $688 million. And this is in 00:06:54.709 --> 00:06:57.410 1981 dollars. Exactly. To put that figure in 00:06:57.410 --> 00:07:00.610 context for 1981, it shows you the recognized 00:07:00.610 --> 00:07:04.740 immense value of centralized consumer data. long 00:07:04.740 --> 00:07:06.720 before we even conceptualized the internet or 00:07:06.720 --> 00:07:08.860 mobile banking. The value was already there. 00:07:09.019 --> 00:07:10.759 And then the private equity world caught on, 00:07:10.779 --> 00:07:12.740 right? They saw the massive potential here, which 00:07:12.740 --> 00:07:14.839 led to a string of these high stakes ownership 00:07:14.839 --> 00:07:17.180 transitions. Absolutely. The sources list some 00:07:17.180 --> 00:07:19.300 real heavy hitters. Madison Dearborn Partners, 00:07:19.620 --> 00:07:21.800 Goldman Sachs Capital Partners, Advent International. 00:07:22.139 --> 00:07:24.259 A big name. They were all invested in realizing 00:07:24.259 --> 00:07:27.569 the full value of this data asset. And this whole 00:07:27.569 --> 00:07:30.449 cycle culminated in TransUnion becoming a publicly 00:07:30.449 --> 00:07:33.129 traded company. When was that? That was in June 00:07:33.129 --> 00:07:36.649 2015. They listed on the NYSE under the ticker 00:07:36.649 --> 00:07:40.209 TRU. This was a clear signal that the company's 00:07:40.209 --> 00:07:42.730 valuation had moved into the multi -billion dollar 00:07:42.730 --> 00:07:45.949 stratosphere. Now, financially, we need to contextualize 00:07:45.949 --> 00:07:47.990 them a little bit within the environment they 00:07:47.990 --> 00:07:49.649 operate in. We keep referring to the big three. 00:07:49.769 --> 00:07:52.930 Where does TransUnion actually sit in that competitive 00:07:52.930 --> 00:07:55.930 structure? They're incredibly powerful. But the 00:07:55.930 --> 00:07:58.129 sources do confirm that TransUnion is generally 00:07:58.129 --> 00:08:00.430 considered the smallest of the big three, right 00:08:00.430 --> 00:08:03.329 alongside Experian and Equifax. Which probably 00:08:03.329 --> 00:08:05.410 means they have to be more aggressive to keep 00:08:05.410 --> 00:08:08.500 up. It often does, yes. That relative positioning 00:08:08.500 --> 00:08:10.740 can mean they have to be more strategic, more 00:08:10.740 --> 00:08:13.180 aggressive in their expansion and their acquisitions 00:08:13.180 --> 00:08:15.740 just to maintain competitive ground. But the 00:08:15.740 --> 00:08:18.560 word smallest here is, I mean, it's truly relative 00:08:18.560 --> 00:08:21.480 based on those 2024 figures you mentioned. Oh, 00:08:21.500 --> 00:08:24.560 absolutely. A company with $4 .1 million in revenue, 00:08:24.899 --> 00:08:28.839 $667 million in operating income, and $10 .9 00:08:28.839 --> 00:08:32.240 billion in total assets is hardly marginal. Not 00:08:32.240 --> 00:08:34.879 at all. They're a massive, highly profitable 00:08:34.879 --> 00:08:38.809 financial engine. Their scale ensures they are 00:08:38.809 --> 00:08:41.350 a core piece of the global credit infrastructure, 00:08:41.610 --> 00:08:44.529 full stop. And with that enormous power comes 00:08:44.529 --> 00:08:47.669 a corresponding legal responsibility. This is 00:08:47.669 --> 00:08:50.389 one that every single consumer, every one of 00:08:50.389 --> 00:08:52.470 you listening, needs to be aware of. That's the 00:08:52.470 --> 00:08:56.090 core mandate. It's defined by U .S. law. TransUnion, 00:08:56.090 --> 00:08:58.169 along with the other two bureaus, is required 00:08:58.169 --> 00:09:01.049 to provide consumers with one free credit report 00:09:01.049 --> 00:09:03.809 every single year. That's the basic social contract, 00:09:03.990 --> 00:09:06.090 right? It is. They get to aggregate all this 00:09:06.090 --> 00:09:08.850 incredibly sensitive data about you. And in return, 00:09:08.990 --> 00:09:10.929 you have a legally mandated right to see what 00:09:10.929 --> 00:09:12.990 they are collecting. That free annual report 00:09:12.990 --> 00:09:15.870 is the absolute baseline. But as we transition 00:09:15.870 --> 00:09:18.330 into their modern strategy, we see that TransUnion's 00:09:18.330 --> 00:09:20.850 business has moved far, far beyond just tracking 00:09:20.850 --> 00:09:22.570 whether you missed your last credit card payment. 00:09:22.889 --> 00:09:26.509 Oh, that shift is dramatic and highly profitable. 00:09:27.009 --> 00:09:31.009 Let's move into Section 2, the data empire. Expansion 00:09:31.009 --> 00:09:33.389 beyond the credit score. This is where we trace 00:09:33.389 --> 00:09:35.450 their evolution from a traditional static report 00:09:35.450 --> 00:09:38.830 provider into a true predictive data services 00:09:38.830 --> 00:09:41.669 powerhouse. Okay, so this strategic shift, it 00:09:41.669 --> 00:09:44.649 really began over a decade ago with a technological 00:09:44.649 --> 00:09:47.149 innovation called Credit Vision. That was in 00:09:47.149 --> 00:09:50.210 2013. Now, that sounds like a simple upgrade, 00:09:50.350 --> 00:09:53.929 but what exactly did it change in how they score 00:09:53.929 --> 00:09:56.210 consumer risk? It was a really fundamental change 00:09:56.210 --> 00:09:59.029 in their methodology. Before Credit Vision, credit 00:09:59.029 --> 00:10:01.549 reports provided a relatively static snapshot. 00:10:02.000 --> 00:10:04.419 A snapshot in time. Right. It just said, here's 00:10:04.419 --> 00:10:06.159 what this person owes right now. Exactly. It 00:10:06.159 --> 00:10:08.860 told a lender, as of this month, this consumer 00:10:08.860 --> 00:10:12.240 has paid X and owes Y. Credit Vision introduced 00:10:12.240 --> 00:10:15.019 a new concept called trended data. Trended data. 00:10:15.159 --> 00:10:17.000 So what does that look like in practice? Well, 00:10:17.039 --> 00:10:18.620 instead of just providing the current balance 00:10:18.620 --> 00:10:21.259 and the status of an account, trended data shows 00:10:21.259 --> 00:10:23.580 the consumer's financial pattern over a much 00:10:23.580 --> 00:10:26.139 longer period. We're often talking 24 months 00:10:26.139 --> 00:10:28.259 or even more. So it's looking at the trajectory, 00:10:28.440 --> 00:10:31.629 not just the point in time. Precisely. It shows, 00:10:31.809 --> 00:10:34.029 for example, not just that you paid off a loan, 00:10:34.149 --> 00:10:36.909 but how you did it. Did you just make minimum 00:10:36.909 --> 00:10:39.830 payments for years? Or did you aggressively pay 00:10:39.830 --> 00:10:42.289 down the principal? Did your credit card debt 00:10:42.289 --> 00:10:45.029 spike seasonally, like every December? Or was 00:10:45.029 --> 00:10:47.029 it stable throughout the year? So instead of 00:10:47.029 --> 00:10:49.610 a single photo, the lender gets a full, detailed, 00:10:49.830 --> 00:10:52.850 predictive film of your financial behavior. That 00:10:52.850 --> 00:10:55.690 is the perfect analogy. It allows for much more 00:10:55.690 --> 00:10:57.950 sophisticated, forward -looking risk modeling. 00:10:58.129 --> 00:11:00.700 And the goal is to better predict. what you'll 00:11:00.700 --> 00:11:03.259 do next. Yes, to better predict future consumer 00:11:03.259 --> 00:11:05.820 repayment habits and long -term debt behavior. 00:11:06.200 --> 00:11:09.200 This data is significantly more valuable to their 00:11:09.200 --> 00:11:11.240 business customers because it allows for this 00:11:11.240 --> 00:11:13.820 really granular pricing of risk. Meaning a bank 00:11:13.820 --> 00:11:15.960 can give a lower interest rate to someone who 00:11:15.960 --> 00:11:18.340 pays down their balance even if their score isn't 00:11:18.340 --> 00:11:21.379 perfect. Exactly right. A bank can offer a lower 00:11:21.379 --> 00:11:23.779 rate to a consumer who consistently pays down 00:11:23.779 --> 00:11:26.200 balances, even if their current score is just 00:11:26.200 --> 00:11:28.500 average. So this really marks the beginning of 00:11:28.500 --> 00:11:31.080 their strategic shift into using data, not just 00:11:31.080 --> 00:11:33.240 for reporting, but for actual predictive analysis. 00:11:33.539 --> 00:11:35.519 But the real evidence of their transformation 00:11:35.519 --> 00:11:38.299 lies in their acquisitions, which pulled them 00:11:38.299 --> 00:11:40.960 into completely new industries. That's the critical 00:11:40.960 --> 00:11:43.100 roadmap for understanding the modern transunion. 00:11:43.279 --> 00:11:45.200 And we have to start with one of the most significant. 00:11:45.679 --> 00:11:49.379 The acquisition of TLO -LLC back in 2013 and 00:11:49.379 --> 00:11:52.720 2014. TLO. TLO was founded by a man named Hank 00:11:52.720 --> 00:11:56.200 Asher, and its proprietary technology, TLO -SP, 00:11:56.399 --> 00:11:59.600 is absolutely central to their expanded data 00:11:59.600 --> 00:12:03.139 strategy. The name TLOX sounds incredibly advanced. 00:12:03.419 --> 00:12:05.620 What does the XP stand for and what does this 00:12:05.620 --> 00:12:08.120 algorithm actually do? Well, TLO guest is often 00:12:08.120 --> 00:12:10.700 said to stand for extreme processing, and it's 00:12:10.700 --> 00:12:12.700 essentially an enterprise data fusion technology. 00:12:13.039 --> 00:12:15.399 Data fusion. Functionally, it excels at aggregating 00:12:15.399 --> 00:12:17.740 massive, disparate, often publicly available 00:12:17.740 --> 00:12:20.500 data sets. So think property records, professional 00:12:20.500 --> 00:12:23.159 licenses, utility hookups, vehicle registrations, 00:12:23.320 --> 00:12:25.860 even social media data. All these little digital 00:12:25.860 --> 00:12:27.720 breadcrumbs we leave everywhere. All of them. 00:12:27.779 --> 00:12:30.399 And then it uses a proprietary algorithm. algorithm 00:12:30.399 --> 00:12:33.539 to uncover non -obvious relationships between 00:12:33.539 --> 00:12:36.480 these seemingly unconnected fragments of a consumer's 00:12:36.480 --> 00:12:39.179 life. So it builds a comprehensive, connected 00:12:39.179 --> 00:12:42.639 profile of a person that goes way beyond their 00:12:42.639 --> 00:12:45.480 mortgage balance. Precisely. It turns all these 00:12:45.480 --> 00:12:47.759 disparate data points into an identifiable network 00:12:47.759 --> 00:12:50.679 of you. And here's the profound implication of 00:12:50.679 --> 00:12:53.970 this acquisition. The sources specify that TLSP 00:12:53.970 --> 00:12:56.330 allows licensed investigators and law enforcement 00:12:56.330 --> 00:12:59.610 professionals to access personally identifiable 00:12:59.610 --> 00:13:02.990 information PII. which is correlated from credit 00:13:02.990 --> 00:13:05.909 header data. Wait, hold on. Accessing PII derived 00:13:05.909 --> 00:13:08.269 from credit header data. That means they are 00:13:08.269 --> 00:13:10.169 using information that was gathered primarily 00:13:10.169 --> 00:13:12.429 for financial reporting and then repurposing 00:13:12.429 --> 00:13:15.750 it for investigative and surveillance adjacent 00:13:15.750 --> 00:13:18.090 purposes. Yes. Doesn't that fundamentally cross 00:13:18.090 --> 00:13:20.169 a line from consumer credit reporting into something 00:13:20.169 --> 00:13:22.490 more like data brokerage and investigative services? 00:13:22.789 --> 00:13:26.450 It absolutely blurs that line. TransUnion isn't 00:13:26.450 --> 00:13:28.409 just serving banks and mortgage lenders anymore. 00:13:28.649 --> 00:13:30.850 They are providing essential tools for things 00:13:30.850 --> 00:13:34.070 like skip tracing, fraud detection, and due diligence 00:13:34.070 --> 00:13:37.389 in completely non -financial contexts. So by 00:13:37.389 --> 00:13:39.830 merging their traditional financial data reservoir 00:13:39.830 --> 00:13:43.809 with PLOX aggregation capabilities, they establish 00:13:43.809 --> 00:13:46.590 themselves as this core utility in the broader 00:13:46.590 --> 00:13:48.690 risk management and investigative landscape. 00:13:49.360 --> 00:13:51.779 It moves them well beyond the simple FICO score. 00:13:51.919 --> 00:13:53.759 And they were expanding laterally at the same 00:13:53.759 --> 00:13:56.700 time into other huge data -rich markets like 00:13:56.700 --> 00:13:59.120 healthcare. They seem to view identity verification 00:13:59.120 --> 00:14:02.740 as this universal service needed across all sectors. 00:14:03.120 --> 00:14:05.460 That's correct. In September 2013, they acquired 00:14:05.460 --> 00:14:08.240 a company called eScan Data Systems. And this 00:14:08.240 --> 00:14:10.559 wasn't some small side project. They integrated 00:14:10.559 --> 00:14:12.879 that technology into what became their ClearIQ 00:14:12.879 --> 00:14:15.620 platform. ClearIQ. And this is for hospitals. 00:14:15.919 --> 00:14:18.279 Yes. This platform helps hospitals and healthcare 00:14:18.279 --> 00:14:20.799 systems track patient demographic and insurance 00:14:20.799 --> 00:14:23.659 information. Why does a credit bureau need to 00:14:23.659 --> 00:14:25.580 be in the business of tracking patient data? 00:14:25.720 --> 00:14:27.480 What's the connection there? It all goes back 00:14:27.480 --> 00:14:30.879 to their core competency, verification for monetization. 00:14:31.879 --> 00:14:34.879 ClearIQ supports benefit verification and post 00:14:34.879 --> 00:14:38.200 -service eligibility determination. In the incredibly 00:14:38.200 --> 00:14:41.399 complex world of health care billing, hospitals 00:14:41.399 --> 00:14:44.259 need to quickly confirm who a patient is, what 00:14:44.259 --> 00:14:46.500 their insurance covers, and ultimately whether 00:14:46.500 --> 00:14:48.320 they can pay for the services they received. 00:14:48.519 --> 00:14:50.960 And TransUnion is applying its deep data processing 00:14:50.960 --> 00:14:54.080 expertise to streamline that whole crucial verification 00:14:54.080 --> 00:14:56.950 process. They're inserting themselves... directly 00:14:56.950 --> 00:14:59.429 into the health care payment workflow. So whether 00:14:59.429 --> 00:15:01.529 it's verifying your ability to pay for a car 00:15:01.529 --> 00:15:03.429 loan or verifying your insurance eligibility 00:15:03.429 --> 00:15:06.990 after a hospital visit, it's the same core data 00:15:06.990 --> 00:15:09.909 processing function just applied to massive new 00:15:09.909 --> 00:15:11.929 revenue streams. It demonstrates their strategy 00:15:11.929 --> 00:15:14.970 perfectly. Identity management is sector agnostic. 00:15:15.090 --> 00:15:17.970 And from there, they aggressively pursued the 00:15:17.970 --> 00:15:20.169 digital sphere, recognizing the massive shift 00:15:20.169 --> 00:15:23.210 toward online transactions and the rising threat 00:15:23.210 --> 00:15:26.120 of digital fraud. This involved a rapid series 00:15:26.120 --> 00:15:28.639 of really focused acquisitions, all aimed at 00:15:28.639 --> 00:15:31.940 identity and fraud protection. It did. In 2015, 00:15:32.100 --> 00:15:36.259 they acquired TrustDev for $21 million. It specialized 00:15:36.259 --> 00:15:39.039 in digital verification and online fraud prevention 00:15:39.039 --> 00:15:43.820 for e -commerce. Right. Then, in 2017... came 00:15:43.820 --> 00:15:46.840 Factor Trust. This was a really critical acquisition 00:15:46.840 --> 00:15:49.320 because it specialized in alternative credit 00:15:49.320 --> 00:15:51.740 data. Alternative credit data. Does that mean 00:15:51.740 --> 00:15:54.399 non -traditional forms of payment history, like 00:15:54.399 --> 00:15:57.320 things other than loans and credit cards? Precisely. 00:15:57.419 --> 00:15:59.860 It means looking beyond the traditional bank 00:15:59.860 --> 00:16:02.240 credit lines and mortgages to capture data points 00:16:02.240 --> 00:16:04.580 like your utility payments, your telecommunications 00:16:04.580 --> 00:16:07.039 payments, or your history with short -term or 00:16:07.039 --> 00:16:09.690 small -dollar lending. And that's strategic because 00:16:09.690 --> 00:16:11.809 it allows TransUnion to build a more complete 00:16:11.809 --> 00:16:14.269 financial picture, especially for people who 00:16:14.269 --> 00:16:16.629 might be credit invisible. Exactly. For consumers 00:16:16.629 --> 00:16:19.029 who are credit invisible or have a thin file 00:16:19.029 --> 00:16:21.169 in the traditional system, it also allows them 00:16:21.169 --> 00:16:23.210 to sell risk profiles that the other two members 00:16:23.210 --> 00:16:25.289 of the big three might often miss. And their 00:16:25.289 --> 00:16:28.070 commitment to becoming this enterprise identity 00:16:28.070 --> 00:16:31.610 management titan, it really culminated in 2021 00:16:31.610 --> 00:16:35.470 with two truly massive deals. Yes, two huge and 00:16:35.470 --> 00:16:39.299 very complimentary deals. The acquisition of 00:16:39.299 --> 00:16:43.000 Sontic, which included IdentityForce, for $638 00:16:43.000 --> 00:16:46.259 million. And what was their focus? That acquisition 00:16:46.259 --> 00:16:49.259 focused squarely on identity security and identity 00:16:49.259 --> 00:16:51.720 theft protection products that are marketed directly 00:16:51.720 --> 00:16:54.539 to consumers. So this strengthened their consumer 00:16:54.539 --> 00:16:57.139 -facing products. But the truly staggering investment 00:16:57.139 --> 00:17:00.460 that year was the $3 .1 billion acquisition of 00:17:00.460 --> 00:17:03.320 NuStar. That's a multi -billion dollar bet on 00:17:03.320 --> 00:17:06.759 a completely new enterprise data platform. NuStar 00:17:06.759 --> 00:17:09.099 was the absolute game changer. It significantly 00:17:09.099 --> 00:17:11.819 expanded TransUnion's enterprise data capabilities, 00:17:12.180 --> 00:17:14.779 particularly in linking identities across multiple 00:17:14.779 --> 00:17:18.039 channels online, mobile, Physical. So connecting 00:17:18.039 --> 00:17:20.619 the dots. All of them. New Star was a powerhouse 00:17:20.619 --> 00:17:22.279 in digital marketing, customer intelligence, 00:17:22.440 --> 00:17:24.940 and contact services. This acquisition meant 00:17:24.940 --> 00:17:27.059 TransUnion was no longer just reporting on your 00:17:27.059 --> 00:17:29.440 debt. They were now selling businesses the ability 00:17:29.440 --> 00:17:31.839 to identify, target, and communicate with you 00:17:31.839 --> 00:17:35.140 across all platforms with extreme accuracy. That 00:17:35.140 --> 00:17:37.259 really solidified their transformation, didn't 00:17:37.259 --> 00:17:39.519 it? It turned them from a credit bureau into 00:17:39.519 --> 00:17:43.039 this end -to -end global enterprise identity 00:17:43.039 --> 00:17:45.640 service provider. They're selling predictive 00:17:45.640 --> 00:17:48.819 power and verification certainty. And this expansion 00:17:48.819 --> 00:17:51.240 wasn't just through buying giant tech companies. 00:17:51.500 --> 00:17:53.819 They also innovated around specific consumer 00:17:53.819 --> 00:17:57.720 behaviors to expand the whole universe of reportable 00:17:57.720 --> 00:18:00.319 data. Like in the housing sector. Exactly. Take 00:18:00.319 --> 00:18:02.420 housing. This is where they integrate elements 00:18:02.420 --> 00:18:04.960 of your daily life right into your financial 00:18:04.960 --> 00:18:08.720 profile. How did that start? In 2014, TransUnion 00:18:08.720 --> 00:18:10.940 commissioned an analysis that confirmed something 00:18:10.940 --> 00:18:13.960 pretty beneficial for consumers. Reporting rental 00:18:13.960 --> 00:18:16.279 payment information could positively affect credit 00:18:16.279 --> 00:18:18.420 scores. Especially for people with a limited 00:18:18.420 --> 00:18:20.920 credit history. Especially for them. And this 00:18:20.920 --> 00:18:23.039 led directly to the launch of a product called 00:18:23.039 --> 00:18:25.759 Resident Credit. So resident credit makes it 00:18:25.759 --> 00:18:29.160 easy for property owners, for landlords, to report 00:18:29.160 --> 00:18:32.000 tenant data timeliness, amount paid directly 00:18:32.000 --> 00:18:34.500 to the credit bureau. Exactly. It's an elegant 00:18:34.500 --> 00:18:36.660 way for them to expand their reportable universe. 00:18:37.119 --> 00:18:39.839 It integrates housing history, which is a fundamental 00:18:39.839 --> 00:18:42.160 indicator of reliability, into your financial 00:18:42.160 --> 00:18:44.579 report, broadening the data available for risk 00:18:44.579 --> 00:18:47.119 assessment and creating an entirely new data 00:18:47.119 --> 00:18:49.500 flow for TransUnion. And they facilitate the 00:18:49.500 --> 00:18:51.779 actual checks for landlords, too, using products 00:18:51.779 --> 00:18:54.500 like Smart Move. Right. Smart Move is the consumer 00:18:54.500 --> 00:18:57.660 facing monetization tool for this market. It 00:18:57.660 --> 00:19:00.339 facilitates credit and background checks specifically 00:19:00.339 --> 00:19:02.799 for landlords, and they often partner with property 00:19:02.799 --> 00:19:05.019 management platforms to do it. So it's an efficient 00:19:05.019 --> 00:19:08.279 way to verify a potential renter's identity and 00:19:08.279 --> 00:19:11.299 financial stability using TransUnion's own consolidated 00:19:11.299 --> 00:19:14.079 data assets. It's a closed loop. This aggressive 00:19:14.079 --> 00:19:17.079 expansion, all fueled by these strategic acquisitions, 00:19:17.200 --> 00:19:20.380 it quickly outgrew their previous branding. The 00:19:20.380 --> 00:19:23.180 sources note a massive rebranding effort in 2023 00:19:23.180 --> 00:19:26.059 to try and unify all these disparate services. 00:19:26.400 --> 00:19:28.779 It was absolutely necessary. I mean, the sources 00:19:28.779 --> 00:19:31.359 state they had to unify thousands of existing 00:19:31.359 --> 00:19:33.619 B2B products. It was getting too complex. So 00:19:33.619 --> 00:19:35.759 they bundled this new offering into seven cohesive 00:19:35.759 --> 00:19:38.339 business lines, all built around the true prefix. 00:19:38.920 --> 00:19:41.000 OK, let's break down what those prefixes actually 00:19:41.000 --> 00:19:43.119 represent strategically, because this is really 00:19:43.119 --> 00:19:46.579 where that huge NuStar acquisition manifests. 00:19:47.079 --> 00:19:49.980 It is. So we have Truevalidate. That's their 00:19:49.980 --> 00:19:52.519 identity verification and fraud prevention suite. 00:19:52.680 --> 00:19:55.319 It uses the advanced digital tools they got from 00:19:55.319 --> 00:19:57.680 TrustEve and NuStar's digital linking capabilities. 00:19:57.960 --> 00:20:00.319 OK, so that's security. What about True Audience? 00:20:00.700 --> 00:20:03.519 True Audience is clearly geared toward marketing 00:20:03.519 --> 00:20:06.599 and advertising. This is the core NuStar integration. 00:20:07.160 --> 00:20:09.960 It allows businesses to create these highly accurate, 00:20:10.099 --> 00:20:12.759 targeted consumer profiles for advertising across 00:20:12.759 --> 00:20:15.480 all channels. And True Contact. That manages 00:20:15.480 --> 00:20:17.339 customer contact information and communication 00:20:17.339 --> 00:20:19.680 strategies, also built on the New Star Foundation. 00:20:20.039 --> 00:20:22.299 It ensures businesses can reach their customers 00:20:22.299 --> 00:20:24.380 reliably and securely. And then there are the 00:20:24.380 --> 00:20:27.380 others, True Vision, True IQ. Right. True Vision, 00:20:27.579 --> 00:20:30.460 True IQ, True Empower and True Lookup. They round 00:20:30.460 --> 00:20:32.900 out the suite, focusing on things like data analytics, 00:20:33.180 --> 00:20:35.680 business intelligence and consumer credit self 00:20:35.680 --> 00:20:38.099 -management tools. This entire suite, it just 00:20:38.099 --> 00:20:40.359 demonstrates that TransUnion is selling far, 00:20:40.480 --> 00:20:42.640 far more than just a credit score. They're selling 00:20:42.640 --> 00:20:45.579 integrated predictive identity services for fraud, 00:20:45.799 --> 00:20:48.420 marketing and verification on a global scale. 00:20:48.539 --> 00:20:50.779 And that global scale is expanding constantly. 00:20:51.079 --> 00:20:53.279 You see this in their international deal flow, 00:20:53.420 --> 00:20:56.190 like the intention to buy the UK. based call 00:20:56.190 --> 00:20:59.910 credit information group in 2018 for $1 .4 billion. 00:21:00.369 --> 00:21:03.990 A huge deal. And the massive $560 million deal 00:21:03.990 --> 00:21:08.329 in 2025 to buy a majority stake, 94 % in their 00:21:08.329 --> 00:21:11.170 Mexican arm TransUnion to Mexico. The ambition 00:21:11.170 --> 00:21:14.990 is it's purely global data dominance. That synthesis 00:21:14.990 --> 00:21:17.430 is crucial. They've leveraged the original industrial 00:21:17.430 --> 00:21:20.089 scale of their standard oil lineage and applied 00:21:20.089 --> 00:21:22.809 it to modern data aggregation. They are innovators 00:21:22.809 --> 00:21:25.940 in AI and identity management. But this brings 00:21:25.940 --> 00:21:27.980 us to the profound disconnect that's highlighted 00:21:27.980 --> 00:21:30.200 in the sources. Exactly. What's so fascinating 00:21:30.200 --> 00:21:32.640 here is the persistent legal storm. This massive 00:21:32.640 --> 00:21:35.299 technological ambition and global reach are constantly 00:21:35.299 --> 00:21:37.900 undermined by operational failures at the most 00:21:37.900 --> 00:21:39.859 fundamental level of consumer data management. 00:21:40.039 --> 00:21:42.710 Right. And that brings us to Section 3. The regulatory 00:21:42.710 --> 00:21:45.630 storm, which shows us that managing this massive 00:21:45.630 --> 00:21:48.670 data scale comes with huge financial and legal 00:21:48.670 --> 00:21:50.910 risk. So let's start with the cost of just simple 00:21:50.910 --> 00:21:53.130 error and inaction, because the sources provide 00:21:53.130 --> 00:21:55.430 some staggering examples of what happens when 00:21:55.430 --> 00:21:58.450 this massive automated system fails to perform 00:21:58.450 --> 00:22:02.230 its most basic duty, fixing a mistake. The first 00:22:02.230 --> 00:22:04.490 case is foundational, and it's a chilly one. 00:22:04.630 --> 00:22:08.839 The Judy Thomas case from 2003 in Oregon. Mrs. 00:22:08.940 --> 00:22:11.559 Thomas sued after spending years, literally years, 00:22:11.700 --> 00:22:13.680 trying to correct inaccuracies on her report. 00:22:14.019 --> 00:22:16.319 She was eventually awarded a truly stunning $5 00:22:16.319 --> 00:22:20.180 .3 million. $5 .3 million? What was the core 00:22:20.180 --> 00:22:22.880 failure that led to a verdict of that size? It 00:22:22.880 --> 00:22:24.980 was the operational negligence over such an extended 00:22:24.980 --> 00:22:28.039 period of time. The sources state it took TransUnion 00:22:28.039 --> 00:22:30.559 a devastating six years to remove incorrect, 00:22:30.720 --> 00:22:32.619 damaging information from her credit report. 00:22:32.839 --> 00:22:37.430 Six years. For a consumer, six years of inaccurate 00:22:37.430 --> 00:22:39.769 reporting means being blocked from mortgages, 00:22:39.930 --> 00:22:42.549 denied affordable credit or even being denied 00:22:42.549 --> 00:22:45.630 employment opportunities. The judgment was awarded 00:22:45.630 --> 00:22:47.849 not just for the economic damage, but for the 00:22:47.849 --> 00:22:50.509 profound emotional distress and lost opportunities 00:22:50.509 --> 00:22:53.250 caused by this systemic bureaucratic failure. 00:22:53.490 --> 00:22:56.430 That just highlights the utter helplessness consumers 00:22:56.430 --> 00:22:58.930 feel when they're trying to battle an automated 00:22:58.930 --> 00:23:01.869 system that seems incapable of course correction. 00:23:02.230 --> 00:23:04.549 And it wasn't a one -off incident. The Sloan 00:23:04.549 --> 00:23:07.690 case in 2006 involved a victim of identity theft 00:23:07.690 --> 00:23:09.950 who spent two years trying to correct erroneous 00:23:09.950 --> 00:23:12.309 information with the agencies. Two years is still 00:23:12.309 --> 00:23:14.329 an eternity when your finances are on the line. 00:23:14.450 --> 00:23:17.089 It is. And while TransUnion and Experian settled 00:23:17.089 --> 00:23:19.930 out of court, the plaintiff, Mrs. Sloan, went 00:23:19.930 --> 00:23:24.089 on to win $351 ,000 against Equifax. The attorney's 00:23:24.089 --> 00:23:26.210 quote in the sources is so telling. He said, 00:23:26.250 --> 00:23:28.069 she wrote letters. She called them. They saw 00:23:28.069 --> 00:23:29.950 the problem. They just didn't fix it. They saw 00:23:29.950 --> 00:23:32.069 the problem. They just didn't fix it. That's 00:23:32.069 --> 00:23:35.829 not about an isolated data entry error. It suggests 00:23:35.829 --> 00:23:38.910 a systemic prioritization of automating massive 00:23:38.910 --> 00:23:42.849 data flow over the necessary human -driven process 00:23:42.849 --> 00:23:45.450 of dispute resolution and accuracy correction. 00:23:45.809 --> 00:23:48.470 That is the crucial insight. Their systems are 00:23:48.470 --> 00:23:50.690 clearly designed for efficiency and massive -scale 00:23:50.690 --> 00:23:53.380 processing. But they seem to lack the necessary 00:23:53.380 --> 00:23:56.400 operational competence, or maybe the institutional 00:23:56.400 --> 00:23:59.839 will, to handle the one -off complex human disputes 00:23:59.839 --> 00:24:02.940 effectively, even when a consumer's entire financial 00:24:02.940 --> 00:24:05.019 life is at stake. And beyond just operational 00:24:05.019 --> 00:24:07.619 error, the regulators also targeted their monetization 00:24:07.619 --> 00:24:10.460 tactics, specifically around deceptive and concealed 00:24:10.460 --> 00:24:13.140 fees. Yes, this involved numerous user complaints 00:24:13.140 --> 00:24:16.079 related to a lack of transparency. Many, many 00:24:16.079 --> 00:24:18.000 consumers complained that they were unknowingly 00:24:18.000 --> 00:24:21.180 signed up for a concealed $17 .95. per month 00:24:21.180 --> 00:24:23.420 recurring charge how did that happen it happened 00:24:23.420 --> 00:24:25.000 when they initially tried to check their credit 00:24:25.000 --> 00:24:27.940 score or access a specific report And this practice 00:24:27.940 --> 00:24:30.480 of luring consumers into costly unwanted subscriptions 00:24:30.480 --> 00:24:33.039 is what drew the heavy hand of the federal government. 00:24:33.220 --> 00:24:35.339 Which brought in the Consumer Financial Protection 00:24:35.339 --> 00:24:39.759 Bureau, the CFPB, leading to that landmark CFPB 00:24:39.759 --> 00:24:43.819 fine in 2017. This was a highly public and severe 00:24:43.819 --> 00:24:46.720 penalty. TransUnion and Equifax were jointly 00:24:46.720 --> 00:24:50.940 fined $5 .5 million and then ordered to pay $17 00:24:50.940 --> 00:24:54.859 .6 million in restitution to consumers. And the 00:24:54.859 --> 00:24:57.859 CFPB stated reasons were damning. They said they 00:24:57.859 --> 00:25:00.039 were deceiving consumers about the usefulness 00:25:00.039 --> 00:25:02.240 and the actual cost of the credit scores they 00:25:02.240 --> 00:25:04.490 sold. Right. Wait, deceiving consumers about 00:25:04.490 --> 00:25:06.769 the usefulness of the scores. How did that work? 00:25:06.829 --> 00:25:08.769 What does that mean? Well, the fine stemmed from 00:25:08.769 --> 00:25:11.029 the fact that the scores being heavily marketed 00:25:11.029 --> 00:25:13.369 and sold to consumers were often proprietary 00:25:13.369 --> 00:25:15.769 educational scores. They were sometimes called 00:25:15.769 --> 00:25:17.970 vantage scores. OK, so what's the problem with 00:25:17.970 --> 00:25:20.029 that? The problem is that these scores were not 00:25:20.029 --> 00:25:23.009 the actual FICO scores that 90 percent of lenders, 00:25:23.130 --> 00:25:25.690 banks and mortgage companies rely on to make 00:25:25.690 --> 00:25:28.210 their real world lending decisions. So consumers 00:25:28.210 --> 00:25:30.690 were paying a monthly fee for information that 00:25:30.690 --> 00:25:33.160 had very limited practical value. in the actual 00:25:33.160 --> 00:25:35.920 lending market. Exactly. The CFPB argued they 00:25:35.920 --> 00:25:38.099 were lured into these costly recurring payments 00:25:38.099 --> 00:25:40.980 with false promises about the score's utility. 00:25:41.259 --> 00:25:43.319 So they were essentially monetizing consumer 00:25:43.319 --> 00:25:46.450 anxiety. Selling people a tool they believed 00:25:46.450 --> 00:25:49.289 was essential for getting a loan, but that tool 00:25:49.289 --> 00:25:51.730 was in reality functionally useless for that 00:25:51.730 --> 00:25:54.190 specific purpose. It's a clear violation of trust. 00:25:54.490 --> 00:25:56.910 It is. And the regulatory pressure forced them 00:25:56.910 --> 00:26:00.349 to make mandatory operational changes. In 2015, 00:26:00.670 --> 00:26:02.650 following a settlement with the New York Attorney 00:26:02.650 --> 00:26:05.509 General, all three bureaus were compelled to 00:26:05.509 --> 00:26:07.890 agree to operational improvements. What kind 00:26:07.890 --> 00:26:10.109 of improvements? Including using trained employees 00:26:10.109 --> 00:26:12.789 to respond when a consumer flagged a mistake. 00:26:13.339 --> 00:26:16.519 They literally had to be legally forced to deploy 00:26:16.519 --> 00:26:19.700 qualified human personnel to properly resolve 00:26:19.700 --> 00:26:22.519 consumer disputes with lenders. Yes. That just 00:26:22.519 --> 00:26:25.480 underscores how much regulatory muscle is required 00:26:25.480 --> 00:26:28.160 to ensure even basic fairness in the system. 00:26:28.359 --> 00:26:30.359 And the resulting flood of complaints confirms 00:26:30.359 --> 00:26:33.460 the severity of the operational issues. In 2018, 00:26:33.799 --> 00:26:35.720 the sources cite that credit bureaus received 00:26:35.720 --> 00:26:38.039 the most complaints of all companies filed with 00:26:38.039 --> 00:26:41.380 the CFPB. The most. Out of every company. The 00:26:41.380 --> 00:26:44.130 most. Out of all consumer complaints across the 00:26:44.130 --> 00:26:47.730 entire financial spectrum, 34 % more than a third 00:26:47.730 --> 00:26:51.400 were directed squarely at the big three. That 00:26:51.400 --> 00:26:53.519 is a massive percentage of consumer frustration 00:26:53.519 --> 00:26:56.279 focused on this one single sector. But the most 00:26:56.279 --> 00:26:59.140 severe legal challenge, the one that really underscores 00:26:59.140 --> 00:27:02.000 the true gravity of data failure in our modern 00:27:02.000 --> 00:27:04.140 surveillance environment, relates to national 00:27:04.140 --> 00:27:06.559 security lists. This is where the tension between 00:27:06.559 --> 00:27:08.960 their role as a credit reporter and their expansion 00:27:08.960 --> 00:27:11.119 into risk management and investigative services 00:27:11.119 --> 00:27:14.079 via acquisitions like T .L. Oaks really comes 00:27:14.079 --> 00:27:16.960 to a head. This brings us to the largest FCRA 00:27:16.960 --> 00:27:20.660 verdict in history in 2017. A California jury 00:27:20.660 --> 00:27:23.579 awarded a massive $60 million verdict under the 00:27:23.579 --> 00:27:26.359 Fair Credit Reporting Act, the FCRA. What was 00:27:26.359 --> 00:27:28.759 the core violation here? This sounds huge. The 00:27:28.759 --> 00:27:30.500 damages were awarded to a class of consumers 00:27:30.500 --> 00:27:32.660 who were falsely reported as being on a government 00:27:32.660 --> 00:27:34.619 -laped of terrorists and other security threats. 00:27:34.940 --> 00:27:37.460 What? TransUnion was attempting to provide businesses 00:27:37.460 --> 00:27:40.259 with a tool to screen potential threats, but 00:27:40.259 --> 00:27:42.960 their data matching processes were, well, catastrophically 00:27:42.960 --> 00:27:45.740 flawed. Being falsely flagged as a terrorist 00:27:45.740 --> 00:27:49.150 or a security risk? I mean, that's not just an 00:27:49.150 --> 00:27:51.869 inconvenience that can have catastrophic, life 00:27:51.869 --> 00:27:54.549 altering consequences. It could block you from 00:27:54.549 --> 00:27:57.150 boarding planes, getting certain jobs or even 00:27:57.150 --> 00:27:59.529 opening a basic bank account. Absolutely. The 00:27:59.529 --> 00:28:01.809 Fair Credit Reporting Act requires consumer reporting 00:28:01.809 --> 00:28:04.569 agencies to employ maximum possible accuracy 00:28:04.569 --> 00:28:08.470 when compiling reports. Falsely linking a consumer 00:28:08.470 --> 00:28:11.289 to a security threat is perhaps the most egregious 00:28:11.289 --> 00:28:13.779 violation of that duty imaginable. The emotional 00:28:13.779 --> 00:28:16.500 distress alone must be immense. Immense. And 00:28:16.500 --> 00:28:19.460 the practical damage is incalculable. This $60 00:28:19.460 --> 00:28:22.019 million verdict serves as a staggering benchmark 00:28:22.019 --> 00:28:24.579 for the operational risk TransUnion takes on 00:28:24.579 --> 00:28:26.900 when its data systems fail, especially as they 00:28:26.900 --> 00:28:29.400 move beyond simple credit scores into these highly 00:28:29.400 --> 00:28:31.660 sensitive identity verification tools. And the 00:28:31.660 --> 00:28:34.000 regulatory climate shows no sign of easing up 00:28:34.000 --> 00:28:36.380 on them. The sources conclude this section with 00:28:36.380 --> 00:28:38.700 CFPB delivering a blistering statement just a 00:28:38.700 --> 00:28:41.240 few years ago. In April 2022, the Consumer Financial 00:28:41.240 --> 00:28:43.500 Protection Bureau made a dramatic public declaration. 00:28:43.799 --> 00:28:46.460 They stated that TransUnion is, and I quote again, 00:28:46.660 --> 00:28:49.099 incapable of operating its businesses lawfully. 00:28:49.259 --> 00:28:52.339 That is just an astonishing condemnation for 00:28:52.339 --> 00:28:55.180 a federal regulatory body to use language that 00:28:55.180 --> 00:28:57.799 suggests the corporate entity itself lacks the 00:28:57.799 --> 00:29:00.849 foundational competence to obey the law. That 00:29:00.849 --> 00:29:03.289 speaks volumes about the disconnect we've been 00:29:03.289 --> 00:29:06.269 tracking. It does. Brilliant technological ambition 00:29:06.269 --> 00:29:09.450 combined with profound operational negligence. 00:29:09.529 --> 00:29:11.630 What were the reasons they cited for such a strong 00:29:11.630 --> 00:29:15.119 statement? The CFPB cited trans unions' repeated 00:29:15.119 --> 00:29:17.759 failure to provide proper consumer disclosures, 00:29:17.880 --> 00:29:20.480 their repeated failures to properly investigate 00:29:20.480 --> 00:29:23.559 disputes, and their inability to adhere to previous 00:29:23.559 --> 00:29:25.539 consent orders they had already agreed to. So 00:29:25.539 --> 00:29:27.519 they weren't learning from their mistakes. The 00:29:27.519 --> 00:29:29.460 statement implies a corporate culture that places 00:29:29.460 --> 00:29:31.920 revenue generation through complex new products 00:29:31.920 --> 00:29:35.000 far above the basic, legally mandated duty of 00:29:35.000 --> 00:29:37.940 accuracy and consumer protection. This tension 00:29:37.940 --> 00:29:40.599 between innovative data aggregation and this 00:29:40.599 --> 00:29:43.440 constant operational failure, it leads us directly 00:29:43.440 --> 00:29:45.559 into our final section, because a company that 00:29:45.559 --> 00:29:48.339 holds a billion profiles is also an immense target 00:29:48.339 --> 00:29:51.599 for cyber threats. Section four, vulnerability 00:29:51.599 --> 00:29:55.019 and adaptation, security and the big picture. 00:29:55.160 --> 00:29:58.200 A company like TransUnion faces a perpetual security 00:29:58.200 --> 00:30:01.339 battle, and the sources reveal two major incidents 00:30:01.339 --> 00:30:04.640 that show very different vectors of attack. One 00:30:04.640 --> 00:30:07.019 is external supply chain risk, and the other 00:30:07.019 --> 00:30:10.200 is just basic internal security weakness. Okay, 00:30:10.299 --> 00:30:12.700 let's look first at the complex digital supply 00:30:12.700 --> 00:30:15.779 chain vulnerability. This was the malware redirect 00:30:15.779 --> 00:30:19.500 incident in 2017. This was a subtle but highly 00:30:19.500 --> 00:30:22.460 malicious attack. It wasn't a direct breach of 00:30:22.460 --> 00:30:25.599 their central servers. Instead, TransUnion's 00:30:25.599 --> 00:30:27.880 Central American Division website was reported 00:30:27.880 --> 00:30:30.420 to be redirecting its visitors to malicious third 00:30:30.420 --> 00:30:32.400 -party websites. And what were those sites doing? 00:30:32.940 --> 00:30:34.779 These sites specialized in attempting what are 00:30:34.779 --> 00:30:37.339 called drive -by downloads of malware, often 00:30:37.339 --> 00:30:39.660 disguised as essential software updates, like 00:30:39.660 --> 00:30:41.960 an Adobe Flash update. And the actual weak point 00:30:41.960 --> 00:30:44.440 wasn't TransUnion's own code, but a third -party 00:30:44.440 --> 00:30:47.140 vendor. Precisely. The attack was performed by 00:30:47.140 --> 00:30:49.200 hijacking third -party analytics JavaScript, 00:30:49.599 --> 00:30:51.660 specifically from a company called FireClick. 00:30:52.079 --> 00:30:54.740 This highlights a crucial modern security challenge. 00:30:55.160 --> 00:30:57.420 Your security perimeter is no longer just your 00:30:57.420 --> 00:30:59.859 own servers. It's defined by the weakest link 00:30:59.859 --> 00:31:02.279 in your entire supply chain. The weakest link 00:31:02.279 --> 00:31:04.759 in the chain of external vendors whose code, 00:31:04.920 --> 00:31:07.319 widgets or analytics you rely on to run your 00:31:07.319 --> 00:31:11.059 website. And TransUnion's immense scale just 00:31:11.059 --> 00:31:14.619 amplifies this supply chain risk globally. Then 00:31:14.619 --> 00:31:17.539 we have the other side of the coin. The direct 00:31:17.539 --> 00:31:21.420 internal facing breach noted in 2022, which involves 00:31:21.420 --> 00:31:24.279 their international operations and an almost 00:31:24.279 --> 00:31:27.039 absurd level of internal negligence. This was 00:31:27.039 --> 00:31:31.680 the South Africa ransomware attack in 2022. Hackers 00:31:31.680 --> 00:31:35.380 operating under the group name N480SEC2U claimed 00:31:35.380 --> 00:31:37.619 responsibility for breaching a TransUnion South 00:31:37.619 --> 00:31:40.240 Africa server. And what did they get? They allegedly 00:31:40.240 --> 00:31:43.079 stole data belonging to 54 million customers, 00:31:43.339 --> 00:31:46.259 a staggering number, and then demanded a ransom. 00:31:46.440 --> 00:31:49.319 54 million records stolen. That is a massive 00:31:49.319 --> 00:31:51.940 breach. But the detail provided in the sources 00:31:51.940 --> 00:31:54.019 regarding the mechanism of the breach, that's 00:31:54.019 --> 00:31:55.980 what is truly shocking given the stakes. We have 00:31:55.980 --> 00:31:57.960 to stop there for a second because this one detail 00:31:57.960 --> 00:32:00.259 encapsulates the entire problem we've been discussing 00:32:00.259 --> 00:32:02.460 this whole time. The claim made by the hackers, 00:32:02.619 --> 00:32:04.660 and it's one that's circulated widely, was that 00:32:04.660 --> 00:32:06.460 the password they used to get into the server 00:32:06.460 --> 00:32:09.900 was simply the word password. Password. The company 00:32:09.900 --> 00:32:12.500 that holds the financial identity of a billion 00:32:12.500 --> 00:32:15.480 people. that is building billion dollar AI systems 00:32:15.480 --> 00:32:19.140 to predict future behavior, was allegedly relying 00:32:19.140 --> 00:32:22.420 on a server protected by the most basic, utterly 00:32:22.420 --> 00:32:26.640 negligible password possible. It just. It defies 00:32:26.640 --> 00:32:29.640 belief. It really does. It is the ultimate operational 00:32:29.640 --> 00:32:32.160 disconnect. You have state -of -the -art technological 00:32:32.160 --> 00:32:34.859 ambition, the new star acquisitions, the true 00:32:34.859 --> 00:32:38.799 validate platforms, the TLOX processing juxtaposed 00:32:38.799 --> 00:32:42.480 with security negligence so fundamental it suggests 00:32:42.480 --> 00:32:45.400 a profound critical failure in basic operational 00:32:45.400 --> 00:32:48.700 risk management. This one incident dramatically 00:32:48.700 --> 00:32:51.400 illustrates the danger of internal security weakness 00:32:51.400 --> 00:32:53.619 combined with the company's massive global exposure. 00:32:54.190 --> 00:32:56.210 So bringing all of these data points together, 00:32:56.349 --> 00:32:58.430 the historical scale, the aggressive acquisitions, 00:32:58.430 --> 00:33:00.829 the regulatory battles and these security mishaps, 00:33:00.890 --> 00:33:03.849 how do we synthesize the purpose of TransUnion 00:33:03.849 --> 00:33:05.650 today for the listener? What are they really? 00:33:05.849 --> 00:33:07.789 I think TransUnion today operates essentially 00:33:07.789 --> 00:33:10.250 as a dual nature entity. TrekOne is the traditional 00:33:10.250 --> 00:33:12.630 consumer facing entity we all know. They market 00:33:12.630 --> 00:33:14.670 credit reports and fraud protection products 00:33:14.670 --> 00:33:17.269 directly to consumers, fulfilling their legal 00:33:17.269 --> 00:33:19.630 mandate to provide access to credit information. 00:33:20.250 --> 00:33:22.470 But track two is where all the growth and all 00:33:22.470 --> 00:33:25.190 the complexity lie. Track two is the massive, 00:33:25.269 --> 00:33:28.109 high -growth enterprise segment. This segment 00:33:28.109 --> 00:33:30.410 sells advanced big data offerings, primarily 00:33:30.410 --> 00:33:32.990 built on the foundation of TLXP and Newstore. 00:33:33.430 --> 00:33:36.569 This means the deep AI -driven identity resolution, 00:33:36.910 --> 00:33:39.690 the TrueValidate fraud services, the targeted 00:33:39.690 --> 00:33:41.990 true audience marketing tools, and the comprehensive 00:33:41.990 --> 00:33:44.309 suite of predictive analytics used by businesses 00:33:44.309 --> 00:33:46.880 across 30 countries. So they aren't just reporting 00:33:46.880 --> 00:33:49.039 history anymore. They are actively predicting, 00:33:49.359 --> 00:33:52.000 verifying, and facilitating consumer engagement 00:33:52.000 --> 00:33:55.220 across the entire global economy. They are essentially 00:33:55.220 --> 00:33:57.819 a foundational utility layer for the digital 00:33:57.819 --> 00:34:00.680 identity of half the planet. And that's the context 00:34:00.680 --> 00:34:03.519 we have to hold on to as we conclude. The company 00:34:03.519 --> 00:34:05.539 born from the industrial scale of Standard Oil 00:34:05.539 --> 00:34:07.819 now seeks to control the industrial scale of 00:34:07.819 --> 00:34:11.059 data. The technology is advanced, but the fundamental 00:34:11.059 --> 00:34:14.579 duty... The careful, accurate and secure handling 00:34:14.579 --> 00:34:17.539 of sensitive consumer data is repeatedly shown 00:34:17.539 --> 00:34:20.280 in court and in regulatory findings to be flawed 00:34:20.280 --> 00:34:23.900 at a colossal, financially ruinous scale. So 00:34:23.900 --> 00:34:26.969 what does this all mean for us? For the consumers 00:34:26.969 --> 00:34:29.750 who rely on these systems every single day, this 00:34:29.750 --> 00:34:31.809 deep dive shows us that the traditional line 00:34:31.809 --> 00:34:33.989 between a credit reporter and a global data broker 00:34:33.989 --> 00:34:37.030 is not just blurred, it's practically erased. 00:34:37.730 --> 00:34:40.030 TransUnion is leveraging proprietary algorithms 00:34:40.030 --> 00:34:42.670 and deep AI to predict human behavior and build 00:34:42.670 --> 00:34:45.150 these hyper -connected identity profiles. And 00:34:45.150 --> 00:34:47.070 yet at the same time, they were fighting massive 00:34:47.070 --> 00:34:49.949 legal battles, including the largest FCRA verdict 00:34:49.949 --> 00:34:52.250 in history for falsely flagging consumers as 00:34:52.250 --> 00:34:54.309 security risks and paying out tens of millions 00:34:54.309 --> 00:34:56.480 in fines for deceiving consumers. consumers about 00:34:56.480 --> 00:34:59.039 the very scores they sold. The financial penalties, 00:34:59.179 --> 00:35:03.699 that $5 .5 million CFPB fine, a $17 .6 million 00:35:03.699 --> 00:35:07.159 in restitution, the $60 million verdict, these 00:35:07.159 --> 00:35:10.300 are the heavy, persistent operational costs of 00:35:10.300 --> 00:35:13.219 a business model that seems to prioritize complex 00:35:13.219 --> 00:35:16.300 technological expansion over fundamental accuracy 00:35:16.300 --> 00:35:19.300 and security. The sources really paint a picture 00:35:19.300 --> 00:35:21.079 of a company that's expanding its technological 00:35:21.079 --> 00:35:24.880 capabilities faster than it can manage its basic 00:35:24.880 --> 00:35:27.679 legally required responsibilities. And that leaves 00:35:27.679 --> 00:35:30.059 us with a critical ongoing question, something 00:35:30.059 --> 00:35:32.219 for you, the learner, to carry forward from all 00:35:32.219 --> 00:35:35.199 this. Given the repeated and costly failures 00:35:35.199 --> 00:35:37.960 in data accuracy failures that took one consumer 00:35:37.960 --> 00:35:40.280 six years to resolve and led the chief consumer 00:35:40.280 --> 00:35:43.119 regulator to call the company incapable of operating 00:35:43.119 --> 00:35:45.780 lawfully, and you combine that with their aggressive 00:35:45.780 --> 00:35:47.909 continuous expansion into high - highly sophisticated 00:35:47.909 --> 00:35:50.909 predictive data products like TLOXP and Trivalidate. 00:35:50.929 --> 00:35:53.550 How confident should a consumer be? How confident 00:35:53.550 --> 00:35:56.510 should you be that the immensely complex systems 00:35:56.510 --> 00:35:58.670 designed to manage, protect, and verify your 00:35:58.670 --> 00:36:00.849 identity are actually being managed legally, 00:36:01.030 --> 00:36:04.230 securely, and with the utmost accuracy? The tension 00:36:04.230 --> 00:36:06.329 between that incredible technological ambition 00:36:06.329 --> 00:36:09.070 and the shocking lack of operational competence 00:36:09.070 --> 00:36:11.929 is the defining feature, the secret life, of 00:36:11.929 --> 00:36:14.300 this credit reporting giant. A compelling and 00:36:14.300 --> 00:36:16.820 necessary thought to end on. The stakes couldn't 00:36:16.820 --> 00:36:18.719 be higher. Thank you for joining us on the Deep 00:36:18.719 --> 00:36:19.820 Dive. We'll see you next time.