6 ms·

Paraphrasing from a comment I can't find anymore: Identity theft is a PR con job. Think about it - the idea that a criminal can "steal your identity" is patent

Paraphrasing from a comment I can't find anymore: Identity theft is a PR con job. Think about it - the idea that a criminal can "steal your identity" is patently ridiculous. What they actually do is defraud your bank, or a vendor, or the government, by impersonating you. Instead of taking responsibility for being defrauded and paying for effective countermeasures, these institutions try to convince us that when they get defrauded it is somehow our responsibility. Then they sell us the countermeasures. It's one of the most impressive strategic manipulations of public understanding that I've ever seen.

Terr_ 9y ago
There's an (audio) comedy sketch by Mitchell and Webb that lampoons the position of stricken companies very nicely: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
dredmorbius 9y ago
I recall very similar concepts, though I can't find anything searching for phrases such as: it's not identity theft it's fraud Bruce Schneier addresses this point in numerous blog posts: https://duckduckgo.com/?kh=1&q="identity+theft"+"fraud"&sites=www.schneier.com%2Fblog&ia=web https://duckduckgo.com/?kh=1&q="identity+theft"+"fraud"&site... The Wikipedia Identity Theft article Talk page has some good discussion: https://en.m.wikipedia.org/wiki/Talk:Identity_theft https://en.m.wikipedia.org/wiki/Talk:Identity_theft I may have to Write a Thing about this....
hitekker 9y ago
You took the words right out of my mouth. I'd add that we don't formally teach the basics of our credit system (or even our financial system) partly because children would easily poke holes into the accepted explanations. "Why would a bank let someone pretend to be me? Shouldn't the bank ask for more info?" "Why does it take forever to know my credit but any business can get in a second?" "Does the government run the three companies that set your credit score? Why not?" It's a kind of unconscious, societal embarrassment that manifests as an educational taboo. We don't talk about what we don't want to think about, or more specifically, our society doesn't teach what it has accepted without critical thinking.
justadeveloper2 9y ago
Is cc theft lumped in with "identity" theft? I have had my cc stolen numerous times, but nobody has assumed my identity in order to obtain lines of credit or travel with a passport in my name. My information was in the massive US Personnel Office data breach, but as far as I know, my SSN isn't being used by anyone [yet]. Stupid .gov with their lousy data handling practices.
jstarfish 9y ago
True, it's not your problem if Capital One gets defrauded. But "identity fraud" is a generic term that comprises the entire suite of ways you and/or your bank can be defrauded, and it's not always the bank's problem. Sticking to the financial space, the monetary losses are theirs to bear-- they don't try to make you split the difference on losses, do they? You dispute it, they perform a perfunctory investigation, accept the losses and move on. Same goes for data breaches. $150M gets stolen from "the bank." They don't charge everyone 150M/(N customers) to recoup the loss; they file an insurance claim and life goes on with the same amount of money in everyone's accounts. But the corollary is that it's not Capital One's problem to unfsck your credit history/reputation after a fraudster has impersonated you to open and bust out of HELOCs, credit cards, utilities, and writing/cashing bad checks in your name. That much is between you, the other affected institutions and the credit bureaus. Credit history is maintained by third parties who aren't inherently concerned with the validity of your accounts (they get paid the same to report whatever data they have either way), and is tied to a rigid set of credentials that are very difficult to change or re-establish. (To me, this is the bigger problem with victimization-- it's easy for your "identity to be stolen" or to create fraudulent new ones with or without ties to you but very difficult to be granted a legitimate new identity. Even where successful, the ghosts from your falsified past will still haunt you thanks to the number of fourth-parties who cache and resell stale data.) If someone socially engineers your credentials out of you and reroutes your direct deposit to a disposable account after having supplied harvested username+password, divining the answers to your security questions, verifying the existing account information and somehow spoofing/bypassing 2FA, is that really the bank's problem? They did their due diligence in verifying your identity. The phishing email you responded to literally gave the fraudster the keys to your paycheck. Government should have less of an excuse. If someone fraudulently files a tax return in my name, that's a federal criminal matter between the IRS and the thief. Either investigate it or make it harder to commit. The problem is that the schemes are initiated from internet cafes in western Africa and eastern Europe and it's far easier to blame me and make it my problem than to perform international investigations and extradite from countries that we have poor relationships with. Having just left that industry I'll give you that the preventative- and counter-measures implemented and sold to consumers are both a joke, but these are the fundamental problems they exist to mitigate.
nwah1 9y ago
It is a bit like "victim blaming" but as in almost all cases of that, there is obviously good advice that people could follow to avoid being victimized. Yes, you are right that it is those companies that have been defrauded, not you. But why should those companies trust someone who doesn't follow simple measures to protect themselves and those they do business with? It cuts both ways. Should an auto insurance company never raise your rates after theft, even if you repeatedly leave the car running unattended with the doors open? Sure, the thief bears the responsibility, ultimately... but you're still being careless and the insurance company has every right to drop you or raise your rates.

Terr_ 9y ago

There's an (audio) comedy sketch by Mitchell and Webb that lampoons the position of stricken companies very nicely: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E

dredmorbius 9y ago

I recall very similar concepts, though I can't find anything searching for phrases such as: it's not identity theft it's fraud Bruce Schneier addresses this point in numerous blog posts: https://duckduckgo.com/?kh=1&q="identity+theft"+"fraud"&sites=www.schneier.com%2Fblog&ia=web https://duckduckgo.com/?kh=1&q="identity+theft"+"fraud"&site... The Wikipedia Identity Theft article Talk page has some good discussion: https://en.m.wikipedia.org/wiki/Talk:Identity_theft https://en.m.wikipedia.org/wiki/Talk:Identity_theft I may have to Write a Thing about this....

hitekker 9y ago

You took the words right out of my mouth. I'd add that we don't formally teach the basics of our credit system (or even our financial system) partly because children would easily poke holes into the accepted explanations. "Why would a bank let someone pretend to be me? Shouldn't the bank ask for more info?" "Why does it take forever to know my credit but any business can get in a second?" "Does the government run the three companies that set your credit score? Why not?" It's a kind of unconscious, societal embarrassment that manifests as an educational taboo. We don't talk about what we don't want to think about, or more specifically, our society doesn't teach what it has accepted without critical thinking.

justadeveloper2 9y ago

Is cc theft lumped in with "identity" theft? I have had my cc stolen numerous times, but nobody has assumed my identity in order to obtain lines of credit or travel with a passport in my name. My information was in the massive US Personnel Office data breach, but as far as I know, my SSN isn't being used by anyone [yet]. Stupid .gov with their lousy data handling practices.

jstarfish 9y ago

True, it's not your problem if Capital One gets defrauded. But "identity fraud" is a generic term that comprises the entire suite of ways you and/or your bank can be defrauded, and it's not always the bank's problem. Sticking to the financial space, the monetary losses are theirs to bear-- they don't try to make you split the difference on losses, do they? You dispute it, they perform a perfunctory investigation, accept the losses and move on. Same goes for data breaches. $150M gets stolen from "the bank." They don't charge everyone 150M/(N customers) to recoup the loss; they file an insurance claim and life goes on with the same amount of money in everyone's accounts. But the corollary is that it's not Capital One's problem to unfsck your credit history/reputation after a fraudster has impersonated you to open and bust out of HELOCs, credit cards, utilities, and writing/cashing bad checks in your name. That much is between you, the other affected institutions and the credit bureaus. Credit history is maintained by third parties who aren't inherently concerned with the validity of your accounts (they get paid the same to report whatever data they have either way), and is tied to a rigid set of credentials that are very difficult to change or re-establish. (To me, this is the bigger problem with victimization-- it's easy for your "identity to be stolen" or to create fraudulent new ones with or without ties to you but very difficult to be granted a legitimate new identity. Even where successful, the ghosts from your falsified past will still haunt you thanks to the number of fourth-parties who cache and resell stale data.) If someone socially engineers your credentials out of you and reroutes your direct deposit to a disposable account after having supplied harvested username+password, divining the answers to your security questions, verifying the existing account information and somehow spoofing/bypassing 2FA, is that really the bank's problem? They did their due diligence in verifying your identity. The phishing email you responded to literally gave the fraudster the keys to your paycheck. Government should have less of an excuse. If someone fraudulently files a tax return in my name, that's a federal criminal matter between the IRS and the thief. Either investigate it or make it harder to commit. The problem is that the schemes are initiated from internet cafes in western Africa and eastern Europe and it's far easier to blame me and make it my problem than to perform international investigations and extradite from countries that we have poor relationships with. Having just left that industry I'll give you that the preventative- and counter-measures implemented and sold to consumers are both a joke, but these are the fundamental problems they exist to mitigate.

nwah1 9y ago

It is a bit like "victim blaming" but as in almost all cases of that, there is obviously good advice that people could follow to avoid being victimized. Yes, you are right that it is those companies that have been defrauded, not you. But why should those companies trust someone who doesn't follow simple measures to protect themselves and those they do business with? It cuts both ways. Should an auto insurance company never raise your rates after theft, even if you repeatedly leave the car running unattended with the doors open? Sure, the thief bears the responsibility, ultimately... but you're still being careless and the insurance company has every right to drop you or raise your rates.