Credit scoring: are you in the dark?

From how much you spend on your credit card to the amount of debt you carry, your finances are no one's business but your own - except for the credit reference agencies carefully tracking your every financial move. These companies collect data that can influence the outcome of some of the biggest decisions in your life, from getting a new mobile phone to renting or buying a house. Yet often the first time yourealise there's an issue is when you've just been rejected.

In the UK, three credit reference agencies - Experian, Equifax and TransUnion (formerly Callcredit) - collect, store and rate personal and financial information about you.

This data is used by lenders as part of their decision-making process, which can open up the best deals on loans, credit cards and mortgages or lock you out in the cold. But in addition, this valuable information is often sold on to other companies for a profit - and presents a tempting target to identity thieves and hackers.

For a system that can make or break our lives, we have little control over the information gathered and Which? research shows we are only dimly aware of the everyday actions that impact our scores.

Here, we take a closer look at how much we know about credit scoring, how credit reference agencies plan to delve deeper into our lives and explore ways to better work within a system we can't opt out of.

'An unfair CCJ stopped me renting'

It may seem that only people struggling to make ends meet should worry about their credit history. But unexpected circumstances could drag down your credit score without you necessarily being aware.

Charlotte Brennan, 32, from Hertfordshire, had to put her life on hold when she failed a credit check to rent a flat thanks to a loan she took out over a decade earlier.

At 22 years old, Charlotte had applied for a £2,000 loan with Welcome Finance.

She says: 'I got a car, monthly payments were being made regularly and on time and if I had some spare money that month I would pay a bit extra.'

But things took a bad turn when Charlotte's payments started being rejected, and she couldn't get through to the firm.

She told Which?: 'I started to panic as I didn't want there to be a mark against me for not making any payments.'

With some digging Charlotte found out through Citizens Advice that the firm had closed. However, she says no-one got in touch with her about how this would impact her loan repayments and how she could continue to repay her debt.

'As time went on I gave up on trying to reach them. Until a few months ago, when trying to rent a property I got declined through a credit check which showed a county court judgment.'

Charlotte found out that her debt had been sold to another company which expected the remaining repayments to be made. When these weren't received the firm she had never heard of,filed the judgment against her, causing her credit score to plummet.

You can have a county court judgement (CCJ) recorded against your name, even if you don't appear in court if the company filing the action can prove you owe the money. It will generally stay on your record for six years, even after you've paid the debt and can seriously impact your credit score.

Charlotte says: 'Nearly 11 years [after taking out the loan], with nothing from any company and now I have this hanging over me.'

Welcome Finance couldn't comment on the details of Charlotte's case but said it carried out a restructuring in 2011 and at all times has continued to trade normally and accept repayments of loans from its customers.

However, the information provided for customers paints a slightly more chaotic picture. A notice on its website states:

'If Welcome has sold your account this could be to a number of different finance companies, if you do not have the details, please contactus on0333 999 9505and wewill provide you with the relevant finance company details.'

The power of credit scores

Credit reference agencies collect information on every adult in the UK to form our credit reports. Each credit reference agency gathers a range of data, so our reports can differ from one agency to the next.

However the personal data they aggregate come from three main sources:

• the industry - such as lenders and fraud agencies like Cifas;
• publicly available data - including sources like the courts and the electoral roll; and
• derived data, which an agency can deduce from the information available to them, like a shared financial connection with someone you have opened a credit account with.

Your whole life is open to scrutiny - these companies know your name, address, date of birth, whether you're registered to vote, how much you currently owe lenders, whether you've made late payments, how many times you've applied for credit, if you've passed credit checks in the past, had any county court judgments and if you have a joint account with any other people.

Credit scoring is a way of objectively assessing the information held in your credit reports, distilling it into a number that banks, insurers, lenders and even employers rely on to make all manner of decisions.

Financial companies, as well as other interested firms, pay credit reference agencies to access this treasure trove of data, which they use along with other information such as what you put in your application to score and help make judgements on how creditworthy you will be as a borrower, whether you can rent a flat or even pay for your insurance monthly.

However, to give you a better idea of how lenders and other interested parties will view you, credit reference agencies produce their own version of your credit score that you can use to check where you stand before you apply.

Are we in the dark on credit scoring?

Half of people in the UK (47%) haven't checked their credit report and of those that have just 26% say they know their credit score, according to research from Experian -despite the availability of free credit report and score services.

That said, it's not enough to just know your score. It's also important to understand what's pushing it up or down, so you can take action to improve it.

Most of us know the basic ways toboost our score, likeregistering on the electoral roll or ending old financial relationships.

But what's the impact, for example, of paying your insurance annually rather than monthly? Does it matter if you max out your credit card if you pay it back in full? How bad, really, is paying your electricity bill one day late?

This information can be hard to come by, so many of us are in the dark. Of the three agencies operating in the UK, only Experian was willing to share this level of detail, shedding light on the decisions that can boost or drag down your score.

How much do you know about credit scoring?

Using the information from Experian, we asked Which? readers in March earlier this year to test how much they know about how their everyday actions affect their Experian credit scores and 507 took on the challenge.

You can take the same test below.

Over half of the readers that took part in our quiz (54%) got two out of five or less and just 5% got full marks.

Three-quarters didn't realise that using up to or over 90% of a credit limit on a credit card each month can have a negative impact - while almost four in ten (39%) were surprised to find that reducing their credit card limit to under £250 would push their score lower.

So what impacts your score and by how much? You can see the full list of scenarios and the impact on an Experian credit score (which operates on a 0-999 scale) in the table below.

Source: Experian

Why credit scoring can feel like a dark art

While the above information is helpful, it sheds only a dim light on how your actions influence your score.

Experian told Which? its figures are only indicative, designed togive a flavour of how individual actions can affect scores, as a number of other factors work in combination.

We asked TransUnion and Equifax to supply the same information but they declined.

TransUnion said it felt the scenarios oversimplify the process of credit scoring and could cause confusion. The firm told Which? often multiple factors are at play including but not limited to the status of the individual, amount of overall borrowing, repayment history and total credit limits.

Equifax gave a similar response. It said an individual's Equifaxcreditscore is complex, and exactly how it will rise or fall is also based on theircredithistory.For example, someone who misses a repayment may not see the same change in their score if theircredithistory is good compared to someone with a track record for missing payments.

Ultimately, it's up to lenders to decide who they are comfortable to lend to and, for the most part, this process is shrouded in mystery. There's no universal credit score - each lender has its own system in place to decide whether or not to accept you, meaning you could be turned down by one, but successful with another.

But it's this complex modelling that means credit scoring can feel like a dark art and leave many feeling powerless or unwilling to engage with their credit reports.

Each credit reference agency and each lender will have its own criteria for how to calculate a credit score, but the three credit reference agencies have come up with a list of factors that will usually have an effect. These include:

• How long the person has lived at their address;
• The number and type of credit agreements and how they use those credit products;
• Whether the person has been late making payments;
• Whether the person has had any court judgments made against them;
• Whether the person has been bankrupt or had an IVA or other forms of debt-related arrangement.

But do credit reference agencies always get it right? Sadly not, and the erroneous errors can have a devastating impact that can take months or years to undo.

'I couldn't work out why I was rejected'

For Sally Richards (not her real name), a financial journalist living in Warwickshire, an error on her credit profile meant a spiral of rejection and worry.

Her credit scoring nightmare began when she moved house and cancelled her broadband contract with BT after the provider left her without service for two weeks.

She says: 'BT started chasing me for cash they thought I owed - and, long story short, put a mark on my credit file.'

It's only when Sally applied for a credit card with her bank and failed a credit check that she knew anything about the mark on her record. When she checked her record with ClearScore (which is powered with data provided by Equifax), she found the default recorded by BT.

'The more rejections I got the worse it got. My credit score took more of a tumble and I started to look like a bad borrower.

'Eventually, BT removed the mark and my credit score has recovered to some extent but my bank won't remove the rejected credit even though that was based on an error.'

'The only way I could get out of the spiral of rejection was to wait but this wasn't ideal. It probably took around two or three months for my score to recover.'

What's the cost of being in the dark?

Like Sally, many people only realise they have a poor credit score once they've been rejected for credit - and this can trigger a wave of rejections that can drag your score ever further down.

Even if you are able to correct an error on your record, you may find it harder to convince other providers to remove rejections based on this mistaken entry.

A low score can mean you don't get access to finance or are given a worse deal at a sky-high rate - andit's not just your finances that are impacted. In some cases, landlords use credit reference agency information to make decisions about letting a property, something Charlotte found out when it was too late.

Avoid the credit rejection spiral: check which lenders use which agency

If you're refused credit, it's tempting to try again with another lender. But this can get you caught in a rejection spiral. The best thing to do if you're in need of credit is to go for lenders or comparison sites that offer a 'soft search' before you apply.

A soft search is a type of credit check that allows lenders to access your credit report and see some key information about you without leaving a footprint or impacting your credit score. These types of checks are recorded but only you can see them so they're not are not visible to other prospective lenders and it won't have any effect on their lending decision.

Typically the majority of lenders will ask one, two or all three credit reference agencies for information when making a decision about lending.

As different agencies hold different information, it might be possible to increase your chances of being accepted by picking a lender that uses an agency you know you have a better or more accurate credit profile with.

We asked credit card, loan, mortgage and current account providers to reveal which agency they use. Scroll through the table below to see which lenders use which agency to see if it could help you.

This isn't a hard and fast rule, especially as lenders use their own criteria as well as credit reference agency information, but we've seen it work.

Sally had a mark on her file with Equifax so found it hard to get credit from her bank and other lenders that used this agency. She told Which? she has since successfully applied through Virgin Money, which doesn't use Equifax in its decision-making process.

GDPR: change is here for credit scoring blunders

When credit reference agencies receive personal data, they perform checks to detect any mistakes - but errors can slip through, as Sally's story illustrates.

Now, the balance has shifted to give consumers more power to set the record straight. The general data protection regulations (GDPR) that came into force on 25May 2018 give us new rights over our information and how it's handled.

Under the EU rules, individuals have an enhanced 'right to rectification', which gives them the power to apply to any organisation tohave inaccurate personal data amended and requires organisations to act without undue delay, a spokesperson from Information Commissioner's Office (ICO) told Which?.

Both credit reference agencies and data suppliers have a legal obligation to provide accurate data.So, if you find your credit report has got something wrong, you can contact the credit reference agency, and the lender that reported it, and have it removed more swiftly - or the organisations risk having to pay compensation.

The ICO told Which?: 'The GDPR also provides individuals with a right to seek compensation from organisations where material or non-material damage is suffered as a result of an infringement of the regulations.

'This could include scenarios where an organisation has failed to ensure the accuracy of personal data, resulting in damage to the individual.'

However, this all rests on you taking action through the courts, as the ICO will be unable to force companies to pay compensation - and since GDPR came into force just over four months ago, it's yet to be tested.

Your rights over your credit report

Firms don't have to issue a customer with a default notice before applying a mark, so checking all three of your credit reports regularly is the key to spotting changes.

You now have the right to access your full credit report for free from all three credit reference agencies (it used to cost £2 but this charge can longer be levied under GDPR) using a subject access request (SAR).

If you spot mistakes or incomplete information, you can alert the credit reference agency which has the error, which will then go back to the lender to verify the data.

Credit reference agencies have 28 days to deal with queries but it can be quicker (Experian told Which? it takes 12 days on average) and should mark the data as disputed on your report while it investigates.

It's worth knowing that the credit reference agency won't have the right to change the data without permission from the organisation that supplied it. So if a company digs their heels in or the firm is hard to contact because they have gone into administration, things could get tricky.

If the data does turn out to be wrong, the credit reference agency will update its records accordingly. If the credit reference agency still believes the data is correct, they'll continue to hold and keep it - although you can ask them to add a notice of correction to your file.

A notice of correction is a small statement (up to 200 words) that you can ask a credit reference agency to add to your credit report to explain something that prospective lenders might call into question. You can normally add this by sending a letter or email with the statement you want to add to the credit reference agency with the problematic information.

However, credit files with a notice of correction cannot be assessed using automated credit scoring methods, Instead, they are manually assessed - so this could slow down future applications and rule out providers which only use automated systems for approving applications.

If you have an unresolved complaint about your credit report, you can refer it to the Financial Ombudsman Services (FOS) and report any concerns about the handling of personal data by a credit reference agency to the ICO.

You can find out more information about your rights to access, rectification and restriction in the cross-industry Credit Reference Agency Information Notice (CRAIN).

Can we just opt out of credit scoring?

It may seem we have little control over how our information is collected, which can make us feel powerless when things are wrong. Unfortunately, you can't really just opt out, even under new GDPR rules.

The ICO says credit reference agencies are not required to obtain your consent before they are allowed to process your personal data as long as they have alegitimate reasonfor doing so and you have been told what is going to happen to it.

Credit reference agencies have several 'legitimate interest' grounds for collecting data, like promoting responsible lending, helping prevent over-indebtedness, detecting crime, fraud and money laundering, verifying identities as well as supporting debt recovery and reconnecting people with lost accounts - which they would be able to argue outweigh an individual's interest, fundamental rights or freedoms.

So while you could attempt to opt out you'd have a difficult time trying to prove your interests supersede the legitimate reasons of credit reference agencies and the firms supplying the information. Put simply if you don't agree to a credit check,lenders are entitled to refuse your application and are likely to do so.

Do credit reference agencies wield all the power?

Credit reference agencies don't tell a lender if it should offer you credit - that's for the lender to decide.

Yet when you're rejected for a loan, credit reference agencies often get the blame, when there are a variety of other reasons you might get turned down.

The Financial Ombudsman Service (FOS) received 910 complaints about credit reference agencies in 2017, up 87% compared to 2016. It says a growing issue is lenders not being clear on why customers get turned down and why they haven't met the criteria.

In Sally's case, this rings true.

She says: 'My bank couldn't explain to me why they rejected me; they just said I had been rejected this time. They said I'd have to follow up with the credit agency.'

Lenders have to give you a reason for refusing your credit application if you ask. It might be necessary to speak to someone more senior or someone in the underwriting department to get an answer. If they refuse, you can make a formal complaint.

Experian has developed a credit refusal tool to help you understand why you might have been rejected for credit and the action you can take.

It's also worth highlight the role credit reference agencies play in helping us fight back again fraud.

They use data like your phone number, date of birth and address to verify your identity, which can help lenders confirm the person they're dealing with is actually you and not someone attempting to commit identity theft or any kind of fraud in your name.

But what happens when a firm that knows so much about you gets hacked?

How secure is our information?

Credit reference agencies are self-appointed data custodians for the information aggregated about millions of UK adults, which makes them prime targets for hackers.

In September 2017, Equifax Ltd's US parent company hit the headlines when it announced its data had been accessed by hackers in a cyber-attack and information relating to 143 million US citizens (just under half the US population) had been stolen.

Although UK systems weren't breached, a file containing sensitive information concerning 15.2 million UK individuals dating between 2011 and 2016 was taken from its servers. This includedemail addresses, passwords, driving licence numbers, phone numbers and partial credit card details.

In total, 860,000 of the most badly affected UK victims were contacted by Equifax, but just a fraction of these people were direct customers who may have purchased a credit report or identity monitoring service - so many of the victims may not have even heard of Equifax before.

Equifax revealed it was a combination of human error and a technical failure that led to the breach. Hackers had accessed its system through a security vulnerability on its dispute resolution portal that wasn't fixed on 13 May 2017, but the firm didn't notice the breach until 29 July 2017.

The ICO and Financial Conduct Authority (FCA) decided to fine Equifax £500,000, following a year-long investigation, for failing to protect people's data under the Data Protection Act. It's the largest fine the authority can issue as the event happened before GDPR was implemented.

Is your information still safe with credit agencies?

Trust in the sector has been dealt a blow, with the incident highlighting how much of a target big data firms have become. The security agencies use when data is stored and when it is transferred is now firmly in the spotlight.

Experian and TransUnion told Which? they have never suffered a UK security breach. But given they make for an attractive target, how are they keeping our information safe?

Experian told Which?: 'We are constantly reviewing our security measures and invest heavily to make sure we maintain the very highest levels of protection to secure the information we hold. This includes having tight controls on who can access information, logging every access and conducting regular staff training across all levels of our organisation.'

TransUnion told Which?: 'We have a robust and vigilant information security programme that operates as a global function across all our business units and geographies, monitoring 24 hours a day, 7 days a week across our services.

'We employ dedicated security architects to ensure strong controls and constantly update our systems against known vulnerabilities and changes in hacker behaviour. We constantly evaluate the controls in place against recognised international standards, to determine how to most effectively maintain and evolve our approach. Data encryption is an important part of this activity.'

Equifax meanwhile has a way to go to restore trust in how it stores and processes data.

In its annual report, the firm admitted: 'Our revenue growth in 2017 as compared to 2016 was negatively impacted by the cybersecurity incident. Certain of our customers have determined to defer or cancel new contracts or projects and others could consider such actions unless and until we can provide assurances regarding our ability to prevent unauthorized access to our systems and the data we maintain.'

How much is our data worth?

Credit reporting is a lucrative business. You might think of yourself as a customer of one of the big credit agencies - but in fact, your data is one of the products they're selling.

Experian made $4.66bn (£3.65bn) in 2017/18 - and of this, 10% or roughly $457m (£355m) came from its 'marketing services', which provide consumer data to companies looking to target specific demographics.

Equifax earned $3.36bn (£2.63bn) in the 12 months to December 2017. Its UK business includes marketing services, which help businesses target and segment markets, as well as cross- and up-sell, but as it is an American company it wasn't able to provide Which? with an exact figure of how much this side of its business generates in the UK.

But you can get an idea for how much Equifax is making onpage 40 of its annual report, which shows the revenue breakdown by segment for US Information Solutions, including financialmarketing services.

Callcredit (before being taken over by TransUnion) reported total revenue of £201m in the 12 months to December 2016, and it told Which? £15.7m (or 8%) of this annual turnover accounted for marketing services. TransUnion, one of the three largest credit reference bureaus in America, acquired Callcredit for £1bn earlier this year to form the catchy new TransUnion (formerly Callcredit) brand.

Credit reference agencies can use the data they have on you to directly market products like credit cards and loans to you themselves or build marketing tools using aggregated and anonymised data (which means it can't be used to identify individuals) to sell to clients that might benefit from it.

TransUnion told Which? it has business relationships with more than 3,000 clients across a variety of sectors. Experian Marketing Services boasts it has more than 10,000 clients in more than 30 countries. While Equifax says it has a 'large and diversified' group of clients.

Businesses have good reason to pay for the marketing tools provided by credit reference agencies to help improve the accuracy and relevancy of the marketing you receive as well as to help make tactical plans.

An independent coffee shop, for example, might have gathered its own data about you such as your name, email address and date of birth by asking, but with the data provided by firms like Experian through its Mosaic marketing tool, it could understand how to better serve customers like you. For example, the data might reveal people aged 50-60 have the most disposable income and where most of these people live in a certain area, which could help the firm send out targeted promotions and choose the best place to open their next shop.

Can you stop your data being used for marketing?

Experian, Equifax and TransUnion's marketing services policies all say that they conduct marketing activity under 'legitimate interests', a GDPR term referred to earlier.

In the context of marketing, it means that they use your data in the ways described in their privacy policy without asking for explicit consent, on the assumption that you will 'reasonably expect' your data to be used in this way.

Regardless of the legal grounds given for using your data for marketing (and unlike the 'legitimate interest' of preventing over-indebtedness etc mentioned earlier in regards to credit scoring), GDPR rules also give you the right to object to your personal data being used for marketing purposes.

To understand how each of the UK's three main credit reference agencies uses your data for marketing, and how you can prevent it, visit the Experian, Equifax and TransUnion websites.

It's easy to see how the value of our data has crept up over recent years, and GDPR rules now now seek to address the imbalance in control between consumers and major companies.

But while GDPR is giving firms stricter rules for handling our data and our rights over it, the second payment services directive or PSD2 is pulling in the opposite direction, with open banking unlocking new ways for firms to delve deeper into our finances.

Open banking and credit reporting

Open banking gives people the right to share their current account information with trusted third parties, through application programme interfaces (APIs). So as long as you give them permission, credit reference agencies and financial technology companies will be able to delve deeper into our finances than ever before.

With open banking (and our explicit permission), these credit-monitoring firms will be able to see the amount of money held in our accounts and what we spend it on as well as our attitudes to saving, risk and planning for the future - for the first time.

Experian has been busy investing heavily in firms that can unlock the power of open banking. In 2017 it bought Runpath, a UK-based fintech company that will be able to enhance its ability to aggregate Experian's wealth of information with external sources of data. (Which? also has a relationship with Runpath. The firm supplies data that powers our Which? Money Compare comparison site.)

Experian also wants to buy ClearScore, which is another fintech company that has pioneered the integration of open banking and credit reporting with a new service called OneScore. The service will provide real-time updates of a user's financial position, with current, savings, investment and credit card account information fed in through APIs.

But the Competition and Markets Authority (CMA) is currently investigating if Experian's merger with ClearScore will reduce competition in the market and ultimately lead to consumers paying more for credit card and loans.

What will open banking unlock?

We asked the three credit reference agencies how they will be using open banking to enhance their credit reporting.

Providing a fuller financial picture

Experian told usopen banking can help people prove they can afford products even if they have a limited credit history, as, with richer insight, lenders might be more comfortable to take a risk.

Of course, it's worth keeping in mind that this richer insight might also highlight risks that lenders would otherwise not be aware of and open up more of our financial behaviour to scrutiny.

The firm also envisions open banking helping people select more suitable products and providing a powerful tool in making sure lenders only lend people and businesses what they can afford to repay.

Making mortgage or credit applications digital

Experian believes open banking will help replace 'archaic' methods of proof like printing off bank statements to share with a mortgage provider- with open banking people will be able to share information instantly and securely to meet anti-money laundering and 'know your customer' checks.

TransUnion also told Which? it plans to utilise open banking to simplify and speed up processes like applying for credit by moving more of the interaction with lenders online.

Enabling instant decisions

Equifax said it is working with banking clients like HSBC and fintech partners to come up with solutions to help people unlock the power of their data and make the most of their money.

For example, Equifax data combined with bank transaction data (handed over with consent) will help achieve quicker outcomes on lending decisions like loans, mortgages and credit cards, it said.

What's the future of credit scoring?

The three credit reference agencies perform an important part in a world that revolves around credit and risk.

While credit reference agencies wield a lot of power, they are also a force for good, helping in the fight against fraud, preventing indebtedness and stopping money laundering.

Credit scoring allows lenders to make more responsible borrowing decisions, speed up the process of identity checks and gives us more access to our history than if each lender kept their own records.

However, we need to be as watchful of the credit reference agencies as they are of us.

Open banking may allow the bureaus to unlock the power of our data further than ever before - but it remains to be seen whether this will be positive for consumers.

More information could help people who have struggled to get credit before, gain access to more deals. But it could also open the door to increased scrutiny and further disadvantage those with a less than perfect financial history. While firms may increasingly personalise products based on our spending behaviours, are these products going to enhance our lives or be used to make more money from us?

With GDPR we now have more rights and control over the information that is held about us and more rights to redress when things go wrong with our credit reports.

However, it's ultimately up to us to keep up with how credit scoring works and changes to ensure we aren't in the dark on how companies are dealing with the information they can collect.

If you're unsure about credit scoring it's easy to feel overwhelmed by it all, but don't give up.

In our quiz, user Wavechange came back and reported: 'I tried again this morning and managed to get all the answers right. I may not understand credit scores but at least I can learn.