I’ve been trying to delete as many online accounts as possible to reduce the threat of my personal information / duplicate passwords / my cell number getting out there. I know, it’s probably not worth the effort but it does at least clean up my password manager and MFA app.
I’ve tried had trouble getting my personal information scrubbed and my account deleted at Robinhood and LendingTree. Both have policies that claim they’re unable to delete user accounts due to federal regulations.
Here’s the bit from Lending Tree: https://www.lendingclub.com/legal/privacy-policy
Data Retention: Due to the regulated nature of our industry, we are under legal requirements to retain data and are generally not able to delete consumer transactional data, credit or deposit account application data, or other financial information upon request. Certain regulations issued by state and/or federal government agencies may require us to maintain and report demographic information on the collective activities of our membership. We may also be required to maintain information about you for at least seven years to comply with applicable federal and state laws regarding recordkeeping, reporting, and audits. Criteria used to determine the period of time information about you is retained are primarily related to legal requirements and usefulness of the information for the purposes it was collected.
In both of these cases, I haven’t used the account in many years (RH: 2020, LT: 2018). It serves no purpose to maintain this account other than to exist as data for some malicious actor to acquire and act upon.
With data leaks happening practically every day, I’m really not comfortable with financial agencies with varying degrees of security keeping my information forever. I would think it would be in their own best interest to comply with a deletion request to prevent anyone from scamming them.
Also, I can’t tell you how many websites I’ve lost access to because my phone number was tied to log in. I previously had a company-issued cell phone and not longer have access to that. Any website that requires a phone number for MFA is just horrible. I’m trying to sign into another financial site now and apparently I’m not able to do so without a phone number I had eight years ago.
Wondering if anyone is familiar with this federal regulation that requires they hold on to this information and if there’s some sort of way around this either with a lawyer or federal form or something.
Your comment reminded me of the time I tried to connect my new phone number to my accounts, but had trouble with Amazon and AirBnB because the last guy with the number forgot to update his accounts.
Amazon told me it’d have to delete the old account before allowing me to connect my new number.
That’s not even the worst one though.
AirBnB gave me no other option than to log in to the other guy’s account through nothing but the SMS recovery code (which came to my phone since I have his old number now), starting the account recovery process from within his account, and then removing the phone number from his account.
After logging out (and closing the private browsing window and turning off the VPN), I was then able to link the phone number to my account. (And yes, I tried everything else – from within my account, it told me “Sorry, this number is linked to another account”)
Never had a problem with AirBnB or the new phone number since then though!
This is why you never, ever enter a phone number into any account. Many orgs treat it as a backdoor.