Beware Your CIBIL Score May Not Be Safe

Mumbai, June 23, 2020

A credit score demonstrates one’s credit history. For lenders, a credit score details how likely a prospective client is to pay their debt in a timely fashion. In India, the Reserve Bank of India (RBI) has licensed four credit information companies (CICs) to calibrate an individual’s credit history into a “credit score.” These CICs are considered ‘credit bureaus’ that are different from third party CICs that are less regulated and more unsafe than the ‘RBI licensed’ CICs. Since January of 2001, one such company licensed by the RBI is ‘CIBIL’ or the ‘Credit Information Bureau (India) Limited.’

It is important for customers to approach any CIC with caution. Once you give any party consent to learn about your credit history and personal information, you may not be responsible for that party being able to misuse (accidentally or not) your personal information. For instance, data leaks are always a possibility. In 2010, Equifax, Experian, and CRIF High Mark were also given licenses by the RBI to officially operate as credit information companies in India. However, CIBIL continues to remain the most popular choice when it comes to one’s credit history.

Even when the CIC responsible is government regulated and checks for data leaks, there can be violations of privacy. Such was the case with Sudipto Sen. While CIBIL claims that they have security measures in place so that your information is private, in 2013, the CIBIL score of Sudipto Sen was publicly commented on in a news article. This has some glaring consequences. Here’s why.

What is a CIBIL score?

A CIBIL score or CIBIL credit score is a three-digit number ascribed by CIBIL that is representative of a person's credit rating based on their purchase history. The CIBIL score ranges from anywhere between 300 to 900 with the latter being the best possible score one could be ascribed. 700+ is generally considered a good credit score. A credit score by CIBIL usually takes anywhere between 1.5 years to 3 years to become ‘truly representative’ of one’s credit history.

The CIBIL score is a part of a ‘Credit Information Report’ (CIR) that is generated by CIBIL on their website. The CIR summarises a person’s credit payment history across different loans and different financial institutions over time. You can request this report to learn about your CIBIL score and then share it with any financial institutions for the purpose of receiving loans. While CIR does not detail your savings, fixed deposits, and investments, it contains important personal information about you.

Who is allowed to access a CIBIL score?

A CIR contains important personal information like your name, date of birth, PAN number, passport number, and voter number. Additionally, your addresses and contact information are also provided on your CIR. Finally, your income earned across time from your employers is also made available on your CIR. For these reasons, only a lender, prospective lender, CIBIL and you are eligible to access your CIBIL score. If your CIBIL score is made public without your consent, this is a serious violation of your privacy.

Your CIBIL score may not be safe

According to Harsh Rongta, the CEO of Apnapaisa, there do not seem to be any internal mechanisms in place that ensure that third parties will not be able to access your score.

This was highlighted by the news report on Sudipto Sen which showed just how easy it is for a popular media outlet to access credit scores and publicly comment on them. The public has yet to learn if the news outlet that accessed Sen’s score had complete access to his CIR which has incredibly private information like his income, address, phone numbers, employment history, voter number, and much more.

The consequences of third parties accessing one’s CIBIL score are vast. Firstly, any business competitors, associates, current and prospective employers, and more can see them. What’s more, one’s CIBIL score can be easily available to any dangerous fraudulent parties like phishing companies and financial scammers. One could become a victim of identity theft, fraud, and other fiscal crimes. The article also reveals a glaring issue about institutions like CIBIL. If a news outlet was able to talk to the right people and circulate a person’s CIBIL score, then there are other third parties that could possess the power to do so as well.

Additionally, the commentary reported by the news article for Sudipto Sen is not accurate and CIBIL has not taken responsibility for it. Wrongful reporting of one’s credit score does not appear to have officially been punished by law.The violation of one’s privacy is further amplified by such incorrect reporting. It is crucial for individuals to be mindful of the potential violation of privacy and their consequences. However, it is of utmost priority that the RBI lay down a regulatory framework for its credit information companies to ensure that customer’s credit information is protected.

(Disclaimer: This is branded content. Readers are advised to exercise due discretion before entering into any correspondence or business dealings on the basis of this content.)

Related Stories