Equifax's Online Model Server

What this models

This example runs on the Bureau-class credit score delivery platform network: 12 components and 24 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 1 assumed · 8 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

• baseline

  D48-derived new org (Phase 6, lending-credit-collections). REGISTER FIRST, because it governs every value below: this is an INFRASTRUCTURE-ERROR board and not a model board. There is no machine-learning system here, no discriminatory design, and no automated decision made by the modelled operator. A deterministic attribute-computation and score-delivery pipeline computed date-relative attributes against a fixed reference date for twenty-two days, and third-party scoring models then produced arithmetically correct outputs over silently wrong inputs. The scoring algorithms behaved correctly and their supplier said so publicly. Nothing on this diagram should be read as an artificial-intelligence failure or an algorithmic-discrimination finding, and this deployment earns its place precisely because it is the counterexample to model-centric governance: no model-level audit, fairness test or explainability review would have caught it.

• baseline

  TOPOLOGY. Twelve nodes, all documented, none decorative, drawn at the coarsest granularity at which every documented mechanism of this deployment stays distinguishable. TWO models because the record carries two coding defects in the same organization in the same month and states that the pair is the content: one wrote nothing durable and left no remedy, the other wrote durable rows into 46,400 files and took seven months to unwrite. TWO input feeds because the evidence names both and the negative finding is the case: the reference date the attributes are computed against, and the third-party scoring model definitions the platform executes, which arrived intact. TWO stores because contamination localised in two places the operator treats differently: the consumer file of record, which the delivery defect never changed and which the second defect's duplicated rows did enter, and the lender decision record, which the delivery defect's values entered and which the operator does not hold. The duplicated rows are drawn inside the file of record because that is where they sat, and because it lets the two defects' writes into one store, one live and one absent, be read side by side. TWO operator classes because the class that shipped the change and the class that consumed its output are different companies with different authority. TWO reviewers because the record shows two channels acting differently on the error: a dispute channel with roughly 765,000 contacts a month that could act on one defect and not the other, and a monitoring and incident-intake channel that had an investigation open five days in, with the quarterly senior-executive committee a 2025 consent order created drawn as a layer of that channel, because both bear on the same release function and differ in cadence rather than in wiring. ONE enforcement system because the enterprises' automated underwriting engines are a documented downstream action system and the instrument through which the only mandatory correction in the record was compelled. ONE external boundary because the Bureau found incorrect attributes were sold onward into third parties' own scores and no source measures where they went.

• baseline

  ABSENCES ARE DERIVED TOO, and four of them are load-bearing. There is NO pathway by which a consumer learns anything: consumers are boundary-only on every Lab diagram, the operator never notified them, and its consumer-facing statement told anyone who thought a decision may have been affected to reach out to the lender for more information — so the absence is stated here rather than drawn as a pathway with no valid endpoint. There is NO worklist, retriever or guardrail: no queue, backlog, retrieval component or bounded automated output screen appears anywhere in this record, and the screen that would have been one is drawn at zero instead. There is NO write from the delivery pipeline into the consumer credit file, and that pathway is drawn AT ZERO rather than omitted, because it is the mechanism the case turns on. And there is NO disparate-impact finding of any kind: senators asked in August 2022 whether particular classes of borrowers were disproportionately affected, no public answer was located, and the distributional question is recorded as open rather than as a finding in either direction.

• baseline

  WHERE THE LAB SHAPE DIVERGES FROM THE PAN SHAPE, and nothing is asserted here that the PAN file does not already record. Four divergences. First, PAN carries the corrupted reference date as an ATTRIBUTE of its delivery model and the third-party scoring models as prose in its description; the Lab draws both as input feeds with their own pathways, so the two inputs can be shown reaching the same pipeline at the same width. Second, PAN has no edge kind for a check and no node kind for a downstream action system, so the enterprise underwriting engines and the reconciliation they compelled are Lab-side, derived from the two enterprise notices and the trade account of the resulting reconciliation burden. Third, a reviewer never acts directly on a model anywhere in the shipped catalogue, so PAN's two pathways from the incident-intake channel and from the senior-executive committee onto the pipeline are drawn here as one check on the release function, which is the class that holds the pipeline. Fourth, PAN keeps the duplicated collection rows as a store of their own with a path into the file of record, and keeps the committee as a separate class; the Lab draws the rows inside the file of record, where PAN's own account places them, and the committee as a layer of the monitoring channel, and every fact PAN records about either is carried on the element that absorbed it.

• baseline

  BASELINES, and exactly how far the PAN org carries them. The PAN entry for this deployment holds twenty-five edges, and every one of them is carried by a pathway here or recorded in the copy of the element that absorbed it. Sixteen of this network's twenty-four pathways carry a PAN counterpart and mirror that edge's width on one stated mapping with no exceptions. The remaining eight are derived from the cited record directly and each says so on its own line: the two input feeds, the write into the file of record that never happened, the reliability bound that never travelled with a delivered score, the one-pipeline self-loop and the comparison that does not run, the loan file entering the enterprise underwriting engine, and the onward sale of attributes. Three contrasts are load-bearing. The reference date and the scoring model definitions reach the pipeline at the SAME top rung, one of them wrong and nothing at the point of use telling them apart. The delivery pipeline's write into the lender's decision record runs at the top rung while its write into the consumer's own file runs at zero, and that pair is the missing remedy stated as a picture. And the second defect's write into that same file runs at the middle rung, so the dispute channel's middle-rung read of the file had duplicated rows to find and nothing about the delivery defect to find, which is why a channel with roughly 765,000 contacts a month carried nothing about a defect that produced no disputable entry.

• baseline

  DEMAND 3 / CAPACITY 1. Demand 3 on published operator scale: credit scores maintained on more than 200 million United States consumers and more than 2.8 billion consumer credit files delivered to United States lenders in 2021, both cited to Equifax's own material in a congressional letter; roughly 765,000 disputes a month on the one consumer-facing channel; and roughly 2.5 million credit scores pulled by mortgage lenders from the national bureaus during the three-week window, which is a channel-volume denominator rather than a count of affected people. Capacity 1 because the counterfactual floor is named in the record and is far below that: both enterprise notices instruct sellers to resubmit affected loans with corrected credit data OR to underwrite them manually, so a manual path exists, is documented and was invoked — as an exception route for affected files rather than as a substitute for the platform. The operator's own largest human channel points the same way, since roughly 765,000 disputes a month is a very large correction capacity that the record establishes had no purchase on this defect at all. What would move this value is a published count of loans manually underwritten, repriced or reversed in the window, and no source publishes one.

• baseline

  EVIDENCE TIERS, labelled where they are used, because this record's magnitude figures come in two incompatible framings and both are carried. REGULATOR TIER, reciting the operator's own score-shift analysis: more than 600,000 consumers underscored by 10 or more points and 139,000 with a score decrease of 25 or more, in a consent order the operator signed. OPERATOR TIER, and it is the framing that reads smaller: there was no shift in the majority of scores, fewer than 300,000 consumers experienced a score shift of 25 points or more in either direction, a score shift does not necessarily mean a credit decision was negatively affected, and only a small number of consumers may have received a different credit decision. These reconcile, because the Bureau counts only decreases. OPERATOR REPRESENTATION RELAYED THROUGH A LENDER NOTICE: the approximately 12 percent of scores calculated from Equifax data in the window that may have been impacted, confirmed as an Equifax representation by the 2 June 2022 Freddie Mac notice. SECOND-HAND THROUGH A CONGRESSIONAL LETTER QUOTING A PAYWALLED ARTICLE: the per-lender observations of several thousand applicants at one auto lender and 18 percent of applicants with an average 8-point swing at one bank. NOT RECORDED ANYWHERE ON THIS BOARD: the finer band breakdown attributed to an anonymous credit-resale-industry source, which is not independently confirmed. No parameter on this diagram is scaled by any of them.

• baseline

  THE TWO END DATES, carried as the record carries them. The operator's public statements say the issue took place between 17 March and 6 April 2022 and was fixed on 6 April. Both regulators found otherwise: the New York Assurance records partial resolution on 6 April and full resolution on 8 April, the Bureau's order states the error persisted until 8 April 2022, and the settlement class period runs to 8 April. This board uses 17 March to 8 April 2022 as the window and states the operator's narrower date as the operator's own account. The contamination window is therefore twenty-two days, and the interval between the operator opening an internal investigation on 22 March and full resolution on 8 April is seventeen days with the defect live throughout. No source located identifies what triggered the 22 March investigation, and nothing here asserts a detection path.

• assumed

  Served people are not in the dynamics. No applicant, no denial, no interest rate and no household outcome is computed from anything drawn here, and no score over any person is authored anywhere in this network. The consumer is the population every value on this board is about and is outside it entirely: the only consumer-facing channel drawn is dispute OPERATIONS, which is the operator's own staff. The score-shift counts, the point bands, the approximately 12 percent, the roughly four million settlement class members, the approximately 76,000 negatively shifted New York consumers and every dollar figure are recorded external observations and set no parameter. The named plaintiff's alleged 130-point understatement, denied auto loan and roughly 2,352 dollars of annual excess cost are pleading allegations that no court has found, and they are not drawn.

What this example does not show

• LITIGATION AND REGULATORY POSTURE, verbatim from the evidence dossier and load-bearing. Concluded as an operational incident (the legacy environment has since been migrated to Equifax Cloud); regulatory phase closed in January 2025 with a federal consent order and a state assurance of discontinuance; civil phase NOT final — the $100M class settlement has preliminary approval only, with the fairness hearing set for January 22, 2027.
• LIABILITY IS NEVER ASSERTED. Equifax consented to the Bureau's order without admitting its findings beyond that consent; it does not admit any negligence, wrongdoing or violation of law in the New York Assurance; it denies liability in the class settlement; and no court has adjudicated the merits. The September 2023 ruling that let a willful accuracy claim and the class allegations proceed is a decision on the sufficiency of allegations, not a finding that anyone acted willfully. The correct phrasings are 'consented to an order finding' and 'agreed to settle', and this scenario uses no others.
• THE MONEY, AND WHAT EACH FIGURE IS FOR, because this operator has several unrelated settlements that are easy to confuse. The $15,000,000 civil money penalty covers the whole five-finding Bureau order, cannot be attributed to the coding error alone, and provides no consumer redress specific to it. The $725,000 New York payment is restitution and penalties. The $100,000,000 class settlement is tied to this matter and no other by the operator's own Form 10-Q, which records the accrual in the second quarter of 2026 against a $60,000,000 insurance receivable for a $40,000,000 net charge — and it is preliminarily approved rather than paid. NOTHING from the 2017 data breach settlement appears anywhere in this bundle, and neither does the separate duplicate-tradeline class settlement.
• THE END DATE IS GENUINELY DISPUTED IN THE RECORD and this scenario carries both. Equifax's public statements say 17 March to 6 April 2022 and a fix on 6 April. The New York Assurance records partial resolution on 6 April and full resolution on 8 April; the Bureau's order states the error persisted until 8 April 2022; and the settlement class period runs to 8 April. The outer window of 17 March to 8 April is used throughout, with the operator's narrower date stated as the operator's own account.
• THE MAGNITUDE FIGURES COME IN TWO FRAMINGS AND BOTH ARE LABELLED. Operator tier, from the statement of 2 August 2022: no shift in the majority of scores; fewer than 300,000 consumers with a shift of 25 points or more in either direction; a score shift does not necessarily mean a credit decision was negatively affected; only a small number of consumers may have received a different credit decision. Regulator tier, reciting the operator's own score-shift analysis: more than 600,000 consumers underscored by 10 or more points and 139,000 with a score decrease of 25 or more. These reconcile because the Bureau counts only decreases. The approximately 12 percent figure is an operator representation to mortgage clients, independently confirmed as an operator representation by the Freddie Mac notice of 2 June 2022 rather than independently measured, and the finer band breakdown reported through trade press from an anonymous industry source is not confirmed and appears nowhere in this bundle.
• THE DETECTION PATH IS NOT ESTABLISHED and nothing here invents one. The record proves an internal investigation was open on 22 March 2022 and that the incident reached lenders in May and the public in August. No source located identifies what triggered that investigation, so this scenario never says that lenders found the defect before the operator did. What it does assert is what the remedies imply: no pre-deployment gate stopped test code reaching a production scoring server, no post-deployment output monitoring caught the result, and the story surfaced publicly through lenders and credit resellers rather than through the operator.
• NO DISPARATE IMPACT BY ANY PROTECTED CLASS IS ASSERTED OR DENIED. Senators Warren and Warner and Representative Krishnamoorthi asked in August 2022 whether particular classes of borrowers were disproportionately affected. No public answer was located. The distributional question is recorded as open, and a board that drew a disparity here in either direction would be inventing one. What would settle it is an analysis of the score-shift population by an identifiable subpopulation, which the operator's own reconstruction could support and which nobody has published.
• THIS IS NOT AN ARTIFICIAL-INTELLIGENCE CASE and describing it as one would be the single largest error available. There was no machine-learning system at fault, no discriminatory design, and no automated decision made by the modelled operator. The scoring algorithms behaved correctly and their supplier stated publicly that the problem was an Equifax issue and not a FICO issue. The input pipeline feeding them did not behave correctly. The deployment is included precisely because it is the clean counterexample to model-centric governance.
• THE PER-LENDER OBSERVATIONS ARE SECOND-HAND. That one large auto lender was told several thousand of its window applicants saw changes of 25 points or more, and that one large bank reported 18 percent of its applicants given incorrect scores with an average swing of 8 points, both reach this record through a congressional letter quoting a Wall Street Journal article that is paywalled and was not read directly. They are stated as reported and no value on this board is derived from them. The named plaintiff's account — a report delivered to a lender roughly 130 points below her actual score, a denied auto loan, and roughly $2,352 a year in alleged excess cost — is a pleading allegation that no court has found.
• SERVED PEOPLE ARE NOT MODELED. No applicant, denial, interest rate or household outcome is computed from anything on this diagram, and the consumer appears nowhere in it: the only consumer-facing channel drawn is the operator's own dispute staff. The affected-population counts are recorded external observations and are floors rather than totals — the New York Assurance records that consumers whose soft inquiries were affected were excluded from the operator's own count entirely, and the state press release says more than 77,000 New Yorkers where the Assurance it announces says approximately 76,000. The Assurance's figure is the one used.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

• Equifax's Online Model Server is the legacy on-premise platform that takes a consumer credit file, derives credit attributes from it, executes third-party scoring models over those attributes, and returns a score — and under some contracts the attributes themselves — to the requesting lender or credit reseller. Many of the attributes are date-relative: whether a consumer has ever been sixty days late on a credit card, the age of the oldest tradeline, the number of inquiries within one month. On 17 March 2022 a code change entered that production environment. The Consumer Financial Protection Bureau found, in consent order 2025-CFPB-0002, that Equifax introduced test code in a production environment in a scoring model server, and that certain scoring models thereafter computed date-based attributes against a fixed reference date rather than the then-current date. Every model downstream then produced arithmetically correct outputs over silently wrong inputs. There was no defect in the scoring models themselves: FICO stated publicly that the problem was an Equifax issue and not a FICO issue. This is therefore not an artificial-intelligence failure, not a discriminatory-design failure, and not an automated decision by Equifax at all — the scoring algorithms behaved correctly and the input pipeline feeding them did not, which is why no model-level audit, fairness test, or explainability review would have caught it. The scale is the operator's own, cited to its published material: credit scores maintained on more than 200 million United States consumers, and more than 2.8 billion consumer credit files delivered to United States lenders in 2021.

  empirical
  • Government Consumer Financial Protection Bureau (2025, January 17). Consent Order, In the Matter of Equifax Inc. and Equifax Information Services LLC, File No. 2025-CFPB-0002 https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Government Office of the New York State Attorney General (2025, January 14). Assurance of Discontinuance No. 24-102, In the Matter of the Investigation of Equifax Information Services LLC https://ag.ny.gov/sites/default/files/settlements-agreements/equifax_information_services_assurance_of_discontinuance_2025.pdf
  • Trade press National Mortgage News (2022). Equifax's credit scoring snafu ensnares lenders https://www.nationalmortgagenews.com/news/equifaxs-credit-scoring-snafu-ensnares-lenders
  • Government Warren, E., Warner, M. R., & Krishnamoorthi, R. (2022, August 4). Letter to Equifax Chief Executive Officer Mark Begor regarding inaccurate credit scores https://www.warren.senate.gov/imo/media/doc/2022.08.04%20Letter%20to%20Equifax%20re%20Inaccurate%20Credit%20Scores.pdf

• The window and the magnitude both come in two framings, and both must be carried. THE WINDOW. Equifax opened an internal investigation into the issue on 22 March 2022, five days after the code change. The New York Attorney General's Assurance of Discontinuance No. 24-102 records that the issue was partially resolved on 6 April 2022 and fully resolved on 8 April 2022; the Bureau's order states the error persisted until 8 April 2022; and the settlement class period runs from 17 March to 8 April 2022. Equifax's own public statements say the issue took place between 17 March and 6 April and that the fix was put in place on 6 April. The outer window is therefore twenty-two days, with seventeen of them running after the operator had an investigation open. No source located identifies what triggered the 22 March investigation. THE MAGNITUDE, OPERATOR TIER, from the statement of 2 August 2022: there was no shift in the majority of scores; fewer than 300,000 consumers experienced a score shift of 25 points or more; a score shift does not necessarily mean that a consumer's credit decision was negatively impacted; and, in the consumer-facing statement of 4 August 2022, only a small number of consumers may have received a different credit decision. As of 2026 Equifax still says the vast majority of scores during the three-week period did not change and a large number had a positive shift. THE MAGNITUDE, REGULATOR TIER, reciting Equifax's own score-shift analysis: more than 600,000 consumers were underscored by 10 or more points and 139,000 consumers saw a score decrease of 25 points or more. The two reconcile because the Bureau counts only decreases, and the operator's public number is the one that reads smaller. Equifax told mortgage clients that approximately 12 percent of credit scores calculated from Equifax data during the window may have been impacted — an operator representation, independently confirmed as an Equifax representation by Freddie Mac's notice of 2 June 2022 rather than independently measured.

  empirical
  • Government Office of the New York State Attorney General (2025, January 14). Assurance of Discontinuance No. 24-102, In the Matter of the Investigation of Equifax Information Services LLC https://ag.ny.gov/sites/default/files/settlements-agreements/equifax_information_services_assurance_of_discontinuance_2025.pdf
  • Government Consumer Financial Protection Bureau (2025, January 17). Consent Order, In the Matter of Equifax Inc. and Equifax Information Services LLC, File No. 2025-CFPB-0002 https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Vendor Equifax Inc. (2022, August 2). Equifax Statement on Recent Coding Issue https://www.equifax.com/newsroom/all-news/-/story/equifax-statement-on-recent-coding-issue/
  • Government Freddie Mac (2022, June 2). Notification of Equifax Coding Error (Freddie Mac news to lenders and investors) https://capitalmarkets.freddiemac.com/mbs/docs/f410news.pdf

• The corrupted values were transient computations rather than stored file contents, and both Equifax and the Bureau record that the contents of consumer credit reports were not changed. That is not a mitigating detail; it is the mechanism that removed the consumer's remedy. There was no wrong entry to dispute, nothing visible in a consumer's own copy of their report, and a dispute channel that processes approximately 765,000 disputes per month had no purchase on a score that was computed wrong at delivery and correctly thereafter. Equifax never notified affected consumers. Its consumer-facing statement of 4 August 2022 told anyone who attempted to obtain credit in the window and thought their decision may have been impacted to reach out to the lender for more information — placing discovery on the applicant, who had no way to learn that the number behind a denial had been wrong. Neither regulator's remedy imposes a duty to notify an affected consumer, and the Bureau's order provides no consumer redress specific to the coding error. The Bureau's unfairness reasoning is squarely about that unobservability: consumers could not avoid the coding and system errors or the method and speed with which the company responded to them, and there is no benefit to consumers or competition of system changes or upgrades without appropriate safeguards that resulted in inaccurate credit scores. Senators Elizabeth Warren and Mark Warner and Representative Raja Krishnamoorthi, and separately House Financial Services Chair Maxine Waters, asked Equifax how the error was detected, how long the company knew before alerting lenders, whether any protected class was disproportionately affected, and whether affected consumers had been identified, notified, and made whole. No public response by Equifax to either letter was located, and no source establishes disparate impact by race, income, or geography in either direction.

  empirical
  • Government Consumer Financial Protection Bureau (2025, January 17). Consent Order, In the Matter of Equifax Inc. and Equifax Information Services LLC, File No. 2025-CFPB-0002 https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Vendor Equifax Inc. (2022, August 4). Credit Scoring and the Equifax Coding Issue (consumer-facing statement) https://www.equifax.com/newsroom/all-news/-/story/credit-scoring-and-the-equifax-coding-issue/
  • Government Warren, E., Warner, M. R., & Krishnamoorthi, R. (2022, August 4). Letter to Equifax Chief Executive Officer Mark Begor regarding inaccurate credit scores https://www.warren.senate.gov/imo/media/doc/2022.08.04%20Letter%20to%20Equifax%20re%20Inaccurate%20Credit%20Scores.pdf
  • Government Waters, M., Chairwoman, U.S. House Committee on Financial Services (2022, August 9). Letter to Equifax Chief Executive Officer Mark Begor https://democrats-financialservices.house.gov/UploadedFiles/080922_CMW_Ltr_to_Equifax_ICS.pdf

• Correction ran operator to operator rather than to the person. Equifax reissued updated scores and data to lenders, and gave lenders updated data for their own custom scores; the Bureau found that when Equifax sold incorrect attributes, other scores generated by third parties may also have failed to reflect a consumer's credit profile, so the contamination propagated into lenders' own custom scorecards. The incident became visible outside Equifax through the customer channel: Equifax began telling lenders and credit resellers in May 2022, National Mortgage Professional published the first press account on 27 May 2022, and the Wall Street Journal published on 2 August 2022, the same day Equifax issued its first public statement. On 2 June 2022 Freddie Mac and Fannie Mae notified their sellers and investors and required affected loans in process to be resubmitted through Loan Product Advisor or Desktop Underwriter with corrected credit data, or to be manually underwritten, with already-sold loans corrected through post-purchase processes under the life-of-loan representation and warranty for data inaccuracies; the Federal Housing Finance Agency worked with both enterprises to determine impacts. That is the only place in the record where correction was mandatory rather than discretionary, and it reaches loans rather than people. Outside the enterprise channel a lender could reprice a loan or invite a denied applicant to reapply and was under no legal obligation to do either. Two per-lender observations reach this record at second hand, through a congressional letter quoting a paywalled article that was not read directly: one large auto lender was told several thousand of its applicants in the window saw changes of 25 points or more, and one large bank reported 18 percent of its applicants were given incorrect scores with an average swing of 8 points. Roughly 2.5 million credit scores were pulled by mortgage lenders from the national bureaus during the three-week window, which is a channel-volume denominator and not a count of affected consumers.

  empirical
  • Government Freddie Mac (2022, June 2). Notification of Equifax Coding Error (Freddie Mac news to lenders and investors) https://capitalmarkets.freddiemac.com/mbs/docs/f410news.pdf
  • Government Fannie Mae (2022, June 2). Selling Notice: Equifax Coding Error (URL returns HTTP 403 to automated clients; content corroborated by the Freddie Mac notice and by National Mortgage News rather than directly read) https://singlefamily.fanniemae.com/news-events/selling-notice-equifax-coding-error
  • Trade press National Mortgage News (2022). Equifax's credit scoring snafu ensnares lenders https://www.nationalmortgagenews.com/news/equifaxs-credit-scoring-snafu-ensnares-lenders
  • Government Warren, E., Warner, M. R., & Krishnamoorthi, R. (2022, August 4). Letter to Equifax Chief Executive Officer Mark Begor regarding inaccurate credit scores https://www.warren.senate.gov/imo/media/doc/2022.08.04%20Letter%20to%20Equifax%20re%20Inaccurate%20Credit%20Scores.pdf

• A separate March 2022 coding error at the same company duplicated disputed collection tradelines in 46,400 consumer files. The code was remediated on 12 April 2022, but the duplicates themselves were not fully removed until at least November 2022, and the cleanup surfaced approximately 10,000 further system-generated duplicates dating to at least 1 January 2020. American Banker independently reports the same 46,400-account defect and its roughly seven-month cleanup. The pair of defects is the structural content of this record rather than an incidental coincidence: the delivery defect wrote nothing durable and therefore left the consumer no remedy, while the duplication defect wrote durable rows into consumer files, which is exactly the kind of object the statutory dispute machinery and ordinary file-integrity checks can reach. The same dispute capacity that could do nothing about a wrong score could act on a wrong row, and it still took seven months between stopping the write and clearing what the write had already produced.

  empirical
  • Government Consumer Financial Protection Bureau (2025, January 17). Consent Order, In the Matter of Equifax Inc. and Equifax Information Services LLC, File No. 2025-CFPB-0002 https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Trade press American Banker (2025). CFPB orders Equifax to pay $15 million for credit reporting errors https://www.americanbanker.com/news/cfpb-orders-equifax-to-pay-15-million-for-credit-reporting-errors

• Two regulators acted three days apart in January 2025 on the same conduct through different instruments, and both aimed at the change-control pipeline rather than at any model. On 14 January 2025 the New York Attorney General accepted Assurance of Discontinuance No. 24-102 under Executive Law section 63(12) and General Business Law sections 349 and 350: Equifax pays $725,000 as restitution and penalties, does not admit any negligence, wrongdoing, or violation of law, and agrees to prospective relief comprising Change Advisory Board review of system changes, pre-deployment code review consistent with industry standards, a Fair Credit Reporting Act module in developer training, and at least weekly monitoring of incident reports filed by Equifax's own customers to identify issues with the potential to adversely affect scores. On 17 January 2025 the Consumer Financial Protection Bureau issued consent order 2025-CFPB-0002 against Equifax Inc. and Equifax Information Services LLC. The Online Model Server coding error is ONE of five findings in that order; it is held to violate Fair Credit Reporting Act section 607(b) and to constitute an unfair act or practice under the Consumer Financial Protection Act. Equifax pays a $15,000,000 civil money penalty into the victims relief fund, which covers the whole order rather than the coding error alone and carries no consumer redress specific to it. The order requires policies addressing potential consumer impact in the development, testing, and implementation of system changes, including Change Advisory Board review of any change reasonably anticipated to materially impact consumer files or reports once in production, systems to monitor the results of such changes, a senior-executive committee including the Chief Compliance Officer meeting at least quarterly and reporting to the Board, a compliance plan reviewed annually, and developer training on accuracy obligations. The Bureau's enforcement action record for docket 2025-CFPB-0002 reads Post Order / Post Judgment with no subsequent termination or vacatur listed. Neither instrument imposes a duty to notify an affected consumer.

  empirical
  • Government Office of the New York State Attorney General (2025, January 14). Assurance of Discontinuance No. 24-102, In the Matter of the Investigation of Equifax Information Services LLC https://ag.ny.gov/sites/default/files/settlements-agreements/equifax_information_services_assurance_of_discontinuance_2025.pdf
  • Government Consumer Financial Protection Bureau (2025, January 17). Consent Order, In the Matter of Equifax Inc. and Equifax Information Services LLC, File No. 2025-CFPB-0002 https://files.consumerfinance.gov/f/documents/cfpb_equifax-inc-consent-order_2025-01.pdf
  • Government Consumer Financial Protection Bureau (2025, January 17). CFPB Orders Equifax to Pay $15 Million for Improper Investigations of Credit Reporting Errors https://www.consumerfinance.gov/archive/newsroom/cfpb-orders-equifax-to-pay-15-million-for-improper-investigations-of-credit-reporting-errors/
  • Government Consumer Financial Protection Bureau (2025). Enforcement action record: Equifax, Inc. and Equifax Information Services LLC (2025-CFPB-0002) https://www.consumerfinance.gov/enforcement/actions/equifax-inc-and-equifax-information-services-llc/
  • Government Office of the New York State Attorney General (2025, January 14). Attorney General James Secures $725,000 from Equifax for Harming Consumers Through Inaccurate Credit Scores https://ag.ny.gov/press-release/2025/attorney-general-james-secures-725000-equifax-harming-consumers-through
  • Trade press American Banker (2025). CFPB orders Equifax to pay $15 million for credit reporting errors https://www.americanbanker.com/news/cfpb-orders-equifax-to-pay-15-million-for-credit-reporting-errors

• The private litigation is live and its posture must be stated exactly. Roughly nine suits filed in August and September 2022 were consolidated before Judge Leigh Martin May as In re: Equifax Fair Credit Reporting Act Litigation, No. 1:22-cv-03072-LMM-CCB in the Northern District of Georgia, the lead case being Jenkins v. Equifax, Inc., filed 3 August 2022. On 11 September 2023 the court largely denied Equifax's motion to dismiss: the willful section 1681e(b) claim and the class allegations proceeded, the Georgia common-law negligence claim and the demand for injunctive relief were dismissed, and the court rejected the argument that section 1681e(b) does not reach credit scores. That is a pleading-stage decision on the sufficiency of allegations and NOT a finding that Equifax acted willfully. On 21 June 2024 the court denied Equifax's motion to dismiss for lack of subject-matter jurisdiction, its request to certify a question for interlocutory appeal, and its motion to stay discovery. Equifax agreed in principle in June 2026 to settle nationwide and class-wide, and its Form 10-Q for the quarter ended 30 June 2026 records $100.0 million accrued, a $60.0 million insurance receivable and a $40.0 million net charge, tying that figure to this matter and no other. An unopposed motion for preliminary approval was filed 12 August 2026 by class representatives Sarah Hunter, Maurice Moore, and Michael Rodela; preliminary approval was granted 17 August 2026; the final fairness hearing is set for 22 January 2027; the class is approximately four million United States residents whose affected scores or attributes were reported to a third party between 17 March and 8 April 2022; the fund is non-reversionary and no proof of injury is required to claim. Equifax denies liability in the settlement and characterises it as a compromise of disputed claims. Nothing has been paid, the settlement is not final, and no court has adjudicated the merits. Class counsel describe it as the largest FCRA class settlement in history, which is advocacy rather than an established fact. The named plaintiff's account — a report delivered to a lender with a score approximately 130 points below her actual score, a denied auto loan she had been approved for at about $350 a month, and financing obtained elsewhere at an alleged cost about $2,352 a year higher — is a pleading allegation that no court has found.

  empirical
  • Government In re Equifax Fair Credit Reporting Act Litigation, No. 1:22-cv-03072-LMM-CCB (N.D. Ga.), docket (lead case Jenkins v. Equifax, Inc., filed August 3, 2022), via CourtListener and the RECAP Archive https://www.courtlistener.com/docket/64868327/jenkins-v-equifax-inc/
  • Trade press Duane Morris LLP (2023, September 13). FCRA Class Action Survives Equifax's Motion To Dismiss (Class Action Defense Blog) https://blogs.duanemorris.com/classactiondefense/2023/09/13/fcra-class-action-survives-equifaxs-motion-to-dismiss/
  • Vendor Equifax Inc. (2026, filed for the quarterly period ended June 30, 2026). Form 10-Q, commitments and contingencies note https://www.sec.gov/Archives/edgar/data/0000033185/000003318526000028/efx-20260630.htm
  • Trade press ClassAction.org (2026). $100M Equifax Settlement Resolves Lawsuit Over Inaccurate Consumer Reports Due to Coding Error https://www.classaction.org/news/100m-equifax-settlement-resolves-lawsuit-over-inaccurate-consumer-reports-due-to-coding-error
  • Investigative CBS News (2022, August 4). Equifax sued over erroneous credit scores sent for 'millions' of Americans (pleading allegations only) https://www.cbsnews.com/news/equifax-lawsuit-wrong-credit-score/

Where this connects

Institutional pressures in this domain

• Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
• Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
• Data & policy drift — The world, the intake process, and the rules change under a system trained on how things used to be — two mechanisms with different remedies: the statistical properties of what the system processes move (concept drift), or the mixture of inputs arriving in deployment differs from the mixture it was trained on (covariate shift).
• Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
• Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Lending & credit collections AI domain page.

Levers available here and the patterns behind them

• Gate record entries — Human-in-the-loop write gating
• Review the riskiest first — Risk-tiered oversight
• Escalate checks — State-feedback vigilance
• Review on schedule — Oversight cadence & retrospectives
• Check with a second model — Cross-model verification
• Check copied records — Reconcile copied records
• Mark AI-written records — Provenance labeling
• Pause AI on alarms — Deployment circuit-breaker
• Understand the system — Understand the system
• Upgrade model — Improve the model

Documented case histories

• Equifax Online Model Server coding error (2022)
• Automated underwriting with its fair-lending testing on the record
• Cleared on the numbers but faulted on the explanation
• The governance an enforcement action had to write
• M-Shwari & Kenya's Digital Credit Market
• Citi Retail Services Judgmental Review & the Armenian surname screen
• Santander Consumer USA subprime vehicle loan scoring
• Credit Acceptance Corporation's net-collections score
• Wells Fargo refinance underwriting & the bridge nobody could build
• Navy Federal mortgage underwriting & three readings of one gap
• Enova International servicing defects & the debits nobody authorised
• TransUnion's OFAC Name Screen & the people who could not sue
• Dave ExtraCash: an advertised ceiling, an automated amount, and a case that never asks how the amount is set
• Hello Digit's automated-savings algorithm
• Oportun's legal-collections filing pipeline