The Hidden Costs of Credit Karma, Credit Sesame, and Other Credit Score Apps

To examine the apps, CR’s experts downloaded and signed up for each of the five. For the two that charge for their services, they paid the enrollment fees of $19.95 for myFICO and $24.95 for TransUnion Score & Report.

CR’s experts then pored through the apps as well as their websites, reviewing their privacy policies and terms of service agreements. 

One goal was to understand what type of information the services collect from and about users, and how that information is shared. To that end, CR’s code experts also performed a type of digital “track and trace,” to find out whether the apps were communicating with third parties. 

They learned that for the benefit of seeing a credit score, consumers must, perhaps unwittingly, agree to give up substantial amounts and types of personal and other data that “may then be shared beyond the parties listed in the app’s privacy policy,” says Bill Fitzgerald, the researcher for Consumer Reports Digital Lab who led the privacy policy review. 

Further, by signing up, consumers make themselves subject to a steady stream of offers and advertisements for financial products and services. These are presented under the guise that they are personalized recommendations tailored to you, when in fact the products may not be in your financial best interest. 

And, in order to use any of the apps, consumers must also agree to settle any future dispute through what’s known as mandatory arbitration, not by going to court, says Syed Ejaz, a financial policy analyst at CR who worked on the investigation.

Arbitration is a company-selected private forum for dealing with complaints, in which consumers have been less likely to prevail and generally have no right of appeal. Mandatory arbitration also almost always forbids consumers from banding together with others who have similarly been harmed, jeopardizing their ability to enforce their rights, consumer advocates say. Most consumers end up deciding it’s not worth it to even bring their claim in arbitration—so mandatory arbitration also undermines an important means of corporate accountability. 

Two of the credit apps CR looked at charge monthly fees for their basic-tier services. And even those that don’t come with downsides. For example, the VantageScore 3.0 offered by several has limited value because many lenders don’t use it, and the credit reports many of the apps offer, often for a price, are available free through AnnualCreditReport.com. Moreover, all of the apps gather and share a lot of data on you, and may heavily market to you with offers of credit cards or other products you don’t need or want.

Before you can create an account on any of these apps, you have to agree to a terms of service agreement, which is lengthy and confusing. They’re written in “legalese that many consumers won’t be able to understand,” Fitzgerald says. 

And by accepting those agreements, you grant the companies a lot of power. Buried in those agreements are broad statements giving the companies permission to collect your personal data not just from your use of the app but also from other sources. 

The goal is to build a kind of “digital dossier” about you. Such digital profiles, Fitzgerald says, are not just filled with details about your credit history but also may include information about where you live, work, socialize, and shop.

For example, Credit Karma’s policy allows it to gather information about you from “local business reviews or social media posts,” which implies it could engage in some form of data scraping or collection of business reviews and social media sites, Fitzgerald says. 

The policy also states that it can receive your “employment or income data, vehicle, or driver information” from third parties. 

MyFICO’s agreement says it could dip into census data or real estate records when putting together its file on you.

TransUnion’s privacy policy takes it further. It might collect your family members’ names, and your home and billing addresses, email addresses, phone and Social Security numbers, birth date, employment information, and driver’s license and passport numbers. 

Where does all that data go? 

TransUnion says it sells your data to third-party companies. Only California residents can opt out, by selecting a “Do Not Sell My Personal Information” option. The privacy policies for the other four companies state that while they don’t sell the information, they can use it to market products or services to users. 

To track exactly where the data goes, CR staff members were able to observe calls made by the apps to various third-party services. Fitzgerald and his team noted that not all companies on the receiving end were listed in the apps’ privacy policy disclosures.  

The common practice of sharing data this way in its own right raises privacy concerns. But credit apps escalate the problem, Fitzgerald says, due to the quantity of the information they gather, the amount of time over which they gather it, and the length of time that they retain it. This data, whether sold or simply shared, could, in theory, be used for a broad range of uses, he says. 

This highlights a fundamental problem with the apps tested for this research: It is impossible for an average person to get a clear sense of where all this data is sent and how it is used.

The point of all this data collection is that it can be used to make predictions about you—information that can be used to sell you products and services, says Carrillo at Yale. 

Indeed, all of the apps CR looked at other than myFICO use this data collection to send users ads, financial offers, promotions, and marketing materials. 

CR’s experts, as well as consumers who use these apps, say they were sometimes overwhelmed by offers for credit cards, personal loans, and other financial products and services. 

Though the companies make it clear that they make money this way, the practice can still be confusing to consumers, in part because these solicitations are pitched not merely as advertisements but as advice. 

For example, a CR staffer who subscribed to Credit Sesame for this project received an email from the app “recommending” a new credit card that “could help you increase your credit score” and “decrease your credit usage.” 

While opening a new credit card account could improve your credit score because it would mean you have more available credit, that’s not true in all cases, nor would all consumers qualify for the offer regardless. 

Moreover, the act of applying for credit can hurt a person’s score, because the credit card company checks the applicant’s credit report, doing what’s called a “hard pull,” which counts against you, says Chi Chi Wu, staff attorney at the National Consumer Law Center. That damage occurs even if the credit card company grants you credit. 

“This is the real point and the real danger of these kinds of apps,” says U.S. PIRG’s Mierzwinski. “They lure the consumer into this hive by offering a credit score, something a person can’t easily find out for free, in exchange for nearly unlimited access to their information,” he says. And that information is then ”used to ping them with countless offers and promotions, some of which could even hurt their score if they applied and were denied."

Included in the terms of service of all five apps is a provision that states that you agree not to sue them over any disputes you may have, but rather to handle them through a process known as arbitration. 

That’s always a concern, because the arbitration process is so onerous that few consumers choose to pursue it, and when they do, they usually lose, says CR’s Ejaz. But it’s a particular problem with the apps from Experian and TransUnion. Those two companies are not mainly app providers, but credit bureaus; that is, they actually produce the credit reports that the scores are based on. 

As credit bureaus, these companies are subject to the federal Fair Credit Reporting Act (PDF), which gives you the right to challenge them in court if they violate that law by improperly handling your credit information. But by agreeing to arbitration in their apps, you give up that right, consumer advocates say.

That’s concerning, says NCLC’s Wu. “Just because someone is using a credit app doesn’t mean they should have to give up the right to make a court challenge if there are inaccuracies in their credit report,” she says. “It is egregious and unfair.”  

Wu isn’t alone in this view. The practice “raises many red flags,” says Edward Y. Kroub, partner at Mizrahi Kroub LLP, a consumer protection law firm based in New York City, who reviewed the companies’ arbitration policies for CR. "Consumers must understand that their right to a jury for Fair Credit Reporting Act claims against credit reporting agencies is extremely valuable. Waiving these rights is not recommended." 

Consider skipping the apps to protect your privacy and avoid being bombarded by ads. Some folks may not mind a company collecting data about them—sometimes a lot of data—for an easy way to keep track of a credit score. But keep in mind that the score you get may be of limited value and that you’ll be heavily marketed to.

Look for free credit scores elsewhere. Instead of signing up for an app, check to see whether your bank or credit card offers you access to your credit score, Ejaz says. Many do. Although these free scores are probably not the ones mortgage lenders use, knowing them could help you if you want to apply for a credit card or auto loan.

Get free credit reports. Don’t pay for credit reports that you can already get free. Instead, check your credit report weekly at no cost through AnnualCreditReport.com.

Correct errors in your credit report. Your credit score is only as accurate as the credit report it is based on. But, as an earlier CR investigation found, those reports often contain errors. So if you see any errors in your report, contact all three bureaus, in writing using certified mail, about it. Read more about how to fix mistakes in your credit reports. 

Don’t rush to sign up for credit cards or other offers based on ads from the app. Instead, take your time to compare all types of credit cards and their terms, says Bill Hardekopf, a senior industry analyst at CardRates.com, a company that evaluates credit card offers. “There are hundreds of card offers out there. Don’t assume the one offer that lands in your email has been fully vetted or screened for you and your needs,” he says. “Doing that work is really up to you.”