Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Proposed Class Action Targets Equifax Access Controls
Mar 6, 2026 | NCFA Fintech Market Activity | Consumer Credit And Identity And Data Governance
Image: Freepik/fabrikasimf
Unauthorized Credit File Access Through Partner Platform Alleged
Per an Investment Executive article, on February 22, 2026, a proposed class action application was filed in Quebec alleging that repeated access to a consumer credit file data occurred without authorization through a third party platform account that the applicant says he never opened or approved.
The application says an unauthorized party created an account on Borrowell and used it to access the applicant’s Equifax credit file. It alleges the matching and authentication process accepted partial, inaccurate, or outdated personal information without enhanced identity verification and without effective controls to detect inconsistencies.
See: BNPL Plans Are Starting to Affect Credit in Canada
The filing describes a series of inquiries and access events through Borrowell at almost weekly frequency over roughly four months. It alleges the access did not affect the applicant’s credit score, but harmful with unauthorized disclosure of highly sensitive personal and financial information.
The application also alleges that Equifax uses a similar access model with multiple third party partner platforms in Canada, and it names examples including KOHO Financial Inc., Credit Karma Canada, Mogo Inc., and Chexy, among others.
Why This Matters
This is a market structure issue inside consumer credit. Credit file access is part of many modern onboarding and underwriting flows across lending, banking, payments, and personal finance apps. If a court accepts the argument that matching and authentication rules allowed unauthorized access through partner channels, it will raise scrutiny for how bureaus and partner platforms handle identity verification, monitoring, and anomaly detection for credit file requests.
Both the credit bureau and third party partners need tighter identity checks, clearer consent proof, and better alerts for repeat access. Canadian regulators already expect financial institutions to manage these risks. For example, OSFI’s Third Party Risk Management Guideline B-10 requires federally regulated institutions to remain accountable for services delivered through partners and to maintain strong due diligence, monitoring, and control frameworks across the full lifecycle of third party relationships.
Talking Point
If partner platforms can trigger credit file access using partial or outdated identifiers, what standard should govern consent checks, anomaly detection, and step up verification for repeat inquiries?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply