I have an account set up with CreditKarma, and have for about 1 year. On XXXX XXXX 2016 at XXXX XXXX I received an email from XXXX Karma to my gmail that there had been a request to reroute my account to a new email address. It instructed me to respond if I had not made this request. I responded immediately that I had not. I received an automated reply stating that I would hear a response in 1-3 days. I attempted to log in to my account, but my password had been altered. When I attempted to retrieve the password by having the reset sent to my actual email address, the emails did not arrive. When I finally was able to access a part of their site to let me verify additional information for the password, the link was broken and would not submit. According to their forums, this is a common problem that many people have encountered. Later that day, I received a call from XXXX XXXX XXXX credit card online services asking if I had made an attempt to open a card. I had not, and told them that it was fraudulent. I then contacted the bureaus, froze my credit, and again attempted to contact CreditKarma. It was n't until nearly two days later that they sent me a basic email asking if XXXX was my email. It was not, it was the fraudulent email. They offered to freeze my account, however, offered no explanation as to how someone was able to gain access to my account, and reroute my emails, change my password, and collect my info. I was locked out of my own account, and they have no option to contact someone via phone or instant chat. The phone number listed for their site is for a line that has a recording. Their service is very slow, and even though it is a " free '' service, they are sitting on a lot of people 's very valuable personal information and owe consumers the ability to reach someone in an emergency situation. To be made aware of an attempt to change my email information, and be powerless to stop it makes no sense. I received the notification and was told to respond if I had not requested this, but in the 2 days it took them to respond, they already granted the criminal access and the ability to change my info. If I had been able to call a number or have an instant chat, I could verify my info. Their security is very lacking for a site with as much personal information as they gather. It is concerning that they offer no way to escalate or triage issues that are very urgent, and can lock the user from their own information while allowing thieves to collect it and use at their will. They need some mechanism to correct this, and their very slow emails are not adequate to protect the amount of information that they have in their database. 
