BIG BROTHER, WITH BENEFITS
A third of American adults have given credit Karma access to their credit bureau files. Why? if privacy is dead anyway, you might as well get freebies, including credit monitoring, for sharing your secrets.
A third of American adults have given Credit Karma access to their credit bureau files. If privacy is dead anyway, you might as well get freebies for sharing your secrets.
After the consumer credit bureau Equifax revealed last September that personal data from 145 million Americans had been exposed in a breach of its computers, a well-worn corporate scandal playbook kicked in. Nervous investors beat its stock down by a third. The CEO and other top execs felt a sudden urge to “retire.” Congress held hearings. Lawsuits were filed. One response, however, was more surprising: Sign-ups at Credit Karma—which requires consumers to trust yet another financial company with their credit records—spiked 50%. Apparently some hack-weary folks concluded that the only way to protect themselves from a bad guy with their financial data was to arm a good guy with it too. And Credit Karma has built a reputation, particularly among Millennials, as a good guy.
More than 80 million Americans (one in three adults) are now Credit Karma “members” and eligible to use its growing menu of free services, including anytime access to their credit files and scores; advice on raising those scores; alerts of credit applications and new accounts opened in their names; help fixing errors in reports; and even tax preparation. When they log in, they also get personalized recommendations for new credit cards and loans they’re likely to both find attractive and be approved for—a targeting process that employs Credit Karma’s extensive data on users so effectively that last year it booked $680 million in referral fees from lenders, up from $500 million in 2016. In March, the still-private company was valued at $4 billion.
But Kenneth Lin, Credit Karma’s 42-yearold CEO and largest shareholder (with a stake worth more than $500 million), doesn’t want anyone to think his San Francisco-based company has led a charmed life. “The first five years were stay in business, stay in business, stay in business,” he says. “The hockey stick happened in the last five.”
Indeed, Lin’s story is classic: the persevering immigrant who still hasn’t told his parents just how much he’s worth. (“I want to make sure it’s really real,’’ he explains.) At the age of 4, Lin moved with his family from China to Las Vegas, where his mother toiled six days a week as a casino dealer and his father worked as a cook. Lin parked cars at a ritzy nightclub while double-majoring in eco-
nomics and math at Boston University.
After graduation in 1998, he went to work for an unsexy federal credit union; jumped to an internet startup, which crashed; worked for UPromise; and in 2004 took a data analytics job at the online lending pioneer E-Loan in San Francisco. It was a fateful move. Back in 2000, Lin learned, E-Loan had tried to give would-be borrowers a look at their FICO credit scores—the three-digit numbers sold to lenders that are derived by applying FICO’s proprietary algorithms to the info in a consumer’s credit bureau record, including credit usage, ontime payments, defaults and bankruptcies. FICO and the credit bureaus didn’t want consumers to see their scores, and E-Loan was forced to back off.
In 2006, Lin left E-Loan and started building the business that would finally set the credit score free. Via Gchat, he invited Nichole Mustard, a Los Angeles consultant he’d worked with at E-Loan, to be a cofounder. He signed up Ryan Graciano, an engineer working for IBM in Knoxville, as the third cofounder, without meeting him in person.
For two years the trio worked from three different cities. They lacked a Silicon Valley locus and cred but prided themselves on being able to relate to typical Americans’ financial concerns. Mustard had landed herself $36,000 in debt after moving to Los Angeles from the tiny Ohio town where she grew up. (“My wife likes to call it corn, corn and soybeans,’’ she says.) Graciano’s family runs assisted-living facilities in Pittsburgh. The team stuck together. Today Mustard, 45, is Credit Karma’s chief revenue officer and Graciano, 36, supervises 400 engineers as chief technology officer.
At first, Graciano says, the trio got “no love and no interest” from the credit bureaus. But they had a wedge that E-Loan didn’t have back in 2000: The credit bureaus had created their own scores to compete with FICO’s and had started selling them, along with credit monitoring, to consumers. TransUnion—a laggard in that business—finally broke ranks and agreed to sell its scores to Credit Karma, which began giving them to individuals free in a February 2008 beta launch. The founders had been working on a shoestring budget and planned to cover TransUnion’s charges by selling banner ads on the Credit Karma site to lenders.
Then came the September 2008 financial crisis. Within two weeks, all but one of the site’s two dozen advertisers had fled. With no revenue coming in, Credit Karma, by then up to seven employees, almost folded. It was rescued by $500,000 of angel capital in October. In the fall of 2009, a series A fundraising led by QED Investors brought in another $2.5 million. Lin was determined to make that cash last. For four years, the company operated from a fourth-floor walk-up above an Irish pub in San Francisco’s financial district.
Ironically, the same Great Recession that almost sank Credit Karma was now fueling its growth, as consumers sought to rebuild damaged credit records. Moreover, in the crisis-induced regulatory fervor of 2009, Congress made it harder for those under 21 to get credit cards. That meant Millennials were coming of age with thin credit histo-
ries and more challenges (including student debt) if they wanted to get a credit card, a car loan or a mortgage. Credit Karma was there to help with a suite of tools, including simulators that let a member see what the estimated impact of some action might be on his or her score.
By 2013, Credit Karma had 8 million members, and credit card companies were again aggressively hunting for customers. That April, Credit Karma raised $30 million in a series B round led by Ribbit Capital and Susquehanna Growth Equity. By mid2015 it had raised a total of $368.5 million from an A-list of investors. (This past March, the private equity firm Silver Lake put up $500 million to buy out some early investors and employees; the cofounders didn’t sell any of their stock.)
Faced with Credit Karma’s disruptive success, in 2013 FICO finally began encouraging banks to share credit scores with their customers for free. Micky Malka, managing partner at Ribbit Capital, isn’t bothered by that competition. “The banks doing this is checking a box. That is not their business,” he says. “What we’re building is much larger than that. Credit scores are just a means to an end,’’ Lin adds. The end: to get good deals for consumers and to make money doing it.
Lenders pay Credit Karma an estimated $100 to $300 each time a member clicks on a recommendation and is approved. Thanks to all the data it has on members (including, for some, the income they’ve reported to the IRS), more than 80% of credit card applications suggested by Credit Karma are approved, double the industry rate.
With concern about hacks and ID theft only growing, Credit Karma is expanding its offerings in that area, too. Members will soon be able to sign up for free alerts if their identities have appeared for sale on the dark web. (You get dark web protection and more from LifeLock, but it costs at least $9.99 a month.) If you’re ready to give Credit Karma access to your bank and credit card accounts, you can get alerts of unusual activity in those, too.
All this aggregation of financial data raises the stakes should Credit Karma be hacked. “The risk people should consider is the possibility of a mishap and information being obtained,’’ says Liad Wagman, a professor at Illinois Institute of Technology who studies the economics of privacy. “At least with Credit Karma you get a very tangible benefit,’’ he adds. Lin says data security is Credit Karma’s number one priority. While there’s no known case of its customer information getting into the wrong hands, Credit Karma’s record isn’t unblemished: In 2014, to settle a Federal Trade Commission complaint that its mobile app left consumer information vulnerable to interception on public Wi-Fi, it agreed to hire independent security experts to review its procedures for 20 years.
Worried? Even if you delete your Credit Karma account, your data will be stored on its servers for another two years before it’s anonymized.
Beyond the possibility of a catastrophic hack, Credit Karma’s biggest business risk may be plain old competition. Just as free credit scores have become common, so will the model of free services coupled with individualized financial pitches. Intuit, which owns TurboTax and Mint, with a combined 48 million users, recently introduced a platform called Turbo; the new service will provide free credit scores as well as personalized recommendations by leveraging the extensive financial information it has on users. Says Lin: “It’s always great validation that you’re on to something when you can get a $40 billion company to kind of move their model to look a lot more like our model.”