Federal regulators and other privacy watchdogs are increasingly worried about privacy and security risks as consumers are gaining on-line access to their credit information files.
Even the credit bureaus, the repositories of that information, are treading cautiously, fearful of the potential for fiasco.
Experian Inc. is selling personal credit reports over the Internet, and its two major competitors, Trans Union Corp. and Equifax Inc., are about to follow suit. But the sensitivity of the data and the history of security breaches on the Internet are causing much hand-wringing.
On the Internet, "10,000 credit reports could go out in a nanosecond before Equifax discovers that the wrong people are getting a report," said Jeffrey L. Dodge, senior vice president in charge of the Atlanta company's Internet activities.
The credit bureaus say they are responding to consumer desires for electronic access to credit reports. The Internet is less expensive for the bureaus than using the postal system.
But any on-line foul-up could prove disastrous to the bureaus, which even under normal circumstances face knocks from privacy advocates.
When Experian began selling credit reports on the Internet last year, it was forced to stop after four hours when 14 people received the wrong credit reports.
Experian, a subsidiary of Great Universal Stores of the United Kingdom, is trying a different approach this time. Instead of selling the reports directly, it is doing so through two on-line companies that specialize in consumer financial services: QSpace Inc. of Oakland, Calif., and Consumerinfo.com of Orange, Calif.
In the year they have been offering this service, there has been no problem, but the Federal Trade Commission is among those keeping watch.
The agency, which oversees the credit bureau industry, has said it believes consumers could benefit from the ability to do a quick credit check before applying for a loan. Such access could streamline the time- consuming resolution of errors.
David Medine, the FTC's associate director of financial practices, said Internet access to credit information is a "powerful tool" but any further snafu would be extremely troublesome.
"We are supporting the idea of easy access, but we are concerned about protecting privacy," Mr. Medine said.
QSpace markets the credit reports at a Web site called icreditreport.com and uses them to induce people to sign up for other loan-related services. It also sells the reports to a handful of other companies.
Todd Meagher, president of Credit.com of San Francisco, a QSpace customer until recently, would like to sell reports from Equifax and Trans Union as well. He said the credit bureaus are "paranoid about the Internet."
Janis Lamar, a spokeswoman for Experian, said the Orange, Calif., company plans to resume offering its data directly to consumers and its agreements with QSpace and Consumerinfo.com do not preclude this.
Combined, Experian's distribution partners sell 8,000 to 12,000 credit reports a month, Ms. Lamar said. By contrast, Experian each month sells 30,000 credit reports and gives away 320,000 to consumers who, for example, are denied credit or are unemployed.
Ms. Lamar said the Internet companies are not selling more Experian reports because they are not as well known.
Consumers also may not know that when they acquire a credit report from a company other than Experian, they are not getting a complete file. Experian does not give its resellers certain information in the reports, such as employment inquiries.
"It is not our policy" to supply such information to vendors, said Daniel Haggerty, director of specialized sales channels for Experian. But when Experian begins selling its $8 credit reports on the Internet, it will have to include such disclosures.
A spokeswoman for Chicago-based Trans Union said the company is interested in selling credit reports on-line but has not found a "secure" method. QSpace said it is in discussions with Trans Union and expects to be selling its reports soon.
Only Equifax has rejected the third-party sales route. It plans to market its reports directly over the Internet in the next few weeks.
Mr. Dodge of Equifax said the outside vendors are not offering the most secure means of transmission. Some Internet companies are sacrificing safety for efficiency, he said, which is dangerous when a consumer must be identified in an instant.
Mr. Dodge said e-mail addresses can be manipulated to look as if they are distinct when, in fact, they are directed in a batch to one computer. The speed of the transaction impedes the technology's effort to verify the customer.
"This will be a competitive issue for the credit bureaus," Mr. Dodge said. "Whoever is lax about controls" will pay the price.
Telephone requests are less risky but take more time to process, Mr. Dodge said.
Equifax is not concerned about how the information travels over the Internet-only to whom it is going. "There is a secure way to transmit data over the Internet," Mr. Dodge said.
Because of identification concerns, Consumerinfo.com does not fulfill requests for several days-after it has assigned the consumer a password and delivered it through the post office. This company also assigns a membership number to each customer, which it describes as "the first of two security codes" needed to get a credit report.
Credit.com, which until last week bought its credit reports from QSpace and offered immediate on-line access, has begun delivering reports by mail, offering a merged report that combines information from all three credit bureaus. Consumers can order on-line, but the documentation arrives on paper.
Mr. Meagher of Credit.com said he was concerned that his company had no control over how QSpace protected the information it provides.
"We can't check their firewall configurations, how they are storing their data, and who has access to their information," Mr. Meagher said. "I have a problem with the fact that I don't oversee the security."
He also said QSpace became a competitor when it started to sell credit reports directly through its own Web site.
QSpace, which gives immediate access to credit reports, said its system is safe. Experian, it said, has endorsed its technology.
The vendors defend their systems by saying consumers are their primary focus. "The credit bureaus are not in the business of selling their credit reports to consumers but to businesses," Mr. Meagher said.
