Credit agencies: how Schufa decides on your creditworthiness

Where does Schufa get her information from? Why is she allowed to do this?

Schufa itself does not collect financial data. Around 10,000 contractual partners, including banks, mail-order companies and energy suppliers, report current accounts, credit cards, loans and other contracts to it, for example.

The transmission of data to the credit agency is legal if customers have been informed in advance. This happens, for example, when you sign an application to open a current account or an electricity supply contract. Schufa also uses data from publicly available sources such as debtor lists and insolvency notices. It also stores personal data such as name, date of birth, address and previous residential addresses.

Criticism of financial testing. The consent to data transfer – popularly known as the Schufa clause – has no longer been expressly required since May 25, 2018. Pure information can therefore be lost at the time of concluding the contract, so that consumers often do not remember that they were informed about the data transfer.

What does Schufa do with all the data it collects?

It calculates a numerical value as a percentage from the majority of the data, the so-called score. It does not describe the payment behavior of the respective person, but rather of a group to which he or she belongs, according to Schufa. However, the score is used to assess the individual risk of someone not paying.

The higher the score, the more likely customers are to meet their contractual obligations. Upon request, consumers can find out their basic score, which expresses cross-industry creditworthiness.

Much more important, however, are the special sector scores or individual scores, which Schufa calculates daily and makes available to its contractual partners. They can deviate from the basic score. The probability of someone repaying the home loan does not have to correspond to the probability of paying a bill by correspondence.

Schufa’s contractual partners can request the score if they have a legitimate interest. This is what a bank has when a customer applies for a loan or credit card, and it is also what a retailer has when he wants to make a purchase with partial payment.

Criticism of financial testing. Consumers only get industry-specific scores if they pay. Schufa’s credit report costs 29.95 euros. The free “data copy” in accordance with Article 15 of the General Data Protection Regulation (GDPR) only contains industry scores that companies have requested in the last twelve months and that Schufa has passed on to them.

What data does Schufa use to calculate a score? What is the formula?

Schufa uses general data such as date of birth, gender and number of previous addresses to determine the score. Financial data such as current accounts, credit cards and mobile phone contracts are also included. In addition, there is credit activity in the past year, the amount of loans used, the time since loans were used and previous payment disruptions.

It doesn’t include all the data Schufa stores. For example, it doesn’t use the amount of the overdraft granted or question the terms of the loan. According to Schufa, the address only plays a role if it doesn’t contain information relevant to a person’s credit and the requesting company still wants a score. According to Schufa, only 0.3% of the score values ​​submitted contain such geodata.

More than 90% of all individuals stored with Schufa have only positive information in their data sheets. Information about non-compliant behavior can be, for example, a loan cancelled by the bank, payment defaults or information from public debtor lists.

Criticism of financial testing. Consumers have the right to know what data Schufa stores about them. The way in which creditworthiness is calculated remains confidential. This is what the Federal Court of Justice ruled (ref. VI ZR 156/13). It is sufficient for Schufa to provide information about which personal and credit-relevant data were included in the calculation of the probability values. The formula for calculating the score is a trade secret, says Schufa, and does not disclose its revenue.

Consumer advocates criticize the fact that customers have not yet had the opportunity to verify whether Schufa’s judgment is based on a false assumption.

For years we have been trying to get an overview of all possible features that Schufa stores. This time too, Schufa responded evasively: It makes no sense to publish an overview of the general features or the text of Schufa information for consumers, as this is changeable information.

Schufa also wants to examine consumers’ checking accounts. Is she allowed to do that?

At the end of 2020, Schufa tested the Check-now project. It was designed as a second risk assessment. Consumers who were not offered a mobile phone contract due to a negative Schufa entry, for example, could take a look at the transactions on their accounts and thus show that their financial situation is better than the score indicates. A current risk assessment should then be carried out on the basis of this data. If the result is positive, nothing would stand in the way of a mobile phone contract.

It must be taken into account whether the account balance is positive or negative, whether wages are received regularly and whether there are any failed direct debits. Schufa assured that confidential data such as medical bills, club or union contributions would be automatically filtered and not processed. If consumers explicitly agree, the account data should be stored for twelve months.

In March 2021, Schufa announced that the project was being discontinued.

Criticism of financial testing. Check-now is covered by European payments law. It is legal for special services – here Schufa’s subsidiary FinApi – to be able to access information that would otherwise only be available to banks. However, there are requirements that must be met: bank customers must explicitly consent to access to data, account information services must use certified technical access and be registered with the supervisory authority, the Federal Financial Supervisory Authority. You can read about whether the consent for account access was too broad in the design and whether data can be stored for a long time Details in the interview.

Are Schufa data always to blame when a credit card or overdraft is blocked?

Banks do not have to provide reasons for terminating an overdraft or credit card. Schufa’s information is at least part of a bank’s decision.

It is advisable to persistently ask about the reason or to obtain your own information from Schufa immediately. According to the General Data Protection Regulation (GDPR), everyone has the right to this. Schufa must provide information free of charge (see our advice above). Should you contain incorrect data, Schufa must correct it immediately. Until everything has been clarified, Schufa is not authorized to provide any information on this matter.

Criticism of financial testing. Some time ago we reported that a financial test colleague had her overdraft and credit card cancelled overnight due to an incorrect report from an energy supplier to Schufa (see PDF Ping-Pong with Ms. Kraft). The company corrected the error after eight days – but by then the terminations had already been issued. Our colleague was only able to clarify the matter after many weeks and only when she identified herself as a journalist.

Schufa spokesman Ingo Koch said at the time when asked by Finanztest: “We immediately follow up on consumer information.” Likewise, every company that obtains information from Schufa is obliged to “check the reports as part of its own quality assurance.” In the case described, this went very wrong.

Can a company threaten to make an entry into the Schufa?

Companies must not use the fear of a negative Schufa entry to force debtors to pay an outstanding invoice. The Federal Court of Justice has ruled that the threat is inadmissible if the demand is contradicted (ref. I ZR 157/13).

The use of arrears to calculate score values ​​is only permitted if the defaulting payers have been reminded twice in writing and four weeks have elapsed between the first reminder and the transmission of the data. The defaulters must also have been informed of the planned report and must not have any objections to the complaint. Anyone who receives a payment request with a Schufa threat without any obligation to pay must briefly contradict the request in writing and, if possible, attach supporting documents.

Criticism of financial testing. Even rules that are clear on their own do not protect against incorrect entries, as the example in the previous question shows.

How long does Schufa store my data?

The GDPR does not regulate anything specific. Credit agencies are allowed to store data as long as it is “…necessary…”. All credit agencies in Germany have agreed to uniform deletion periods.

The following applies: Current accounts, credit cards, credit lines, mobile phone and electricity contracts remain in the database for as long as the business relationship exists. Inquiries, such as those relating to loan or credit card conditions, remain stored for twelve months. Data on loans remain in the database for a further three years from the day on which they are terminated or repaid. Since the end of March 2023, data on a residual debt waiver granted has been deleted after six months. This also involves the deletion of all outstanding payments known at the time of the opening of the consumer’s insolvency proceedings.