3 ms·

> Yes, it tangibly and demonstrably does. It means that the process of establishing/asserting your identity is much harder, since now there's someone else runni

> Yes, it tangibly and demonstrably does. It means that the process of establishing/asserting your identity is much harder, since now there's someone else running around with the credentials normally used to assert said identity. You now need to spend time and money invalidating whatever credentials you can and hoping that the ones you can't invalidate aren't actually compromised. None of that is a harm from the fraud, it's all harm from the bank's unjustified claims . > If someone manages to get your Gmail password and use it to send spam, you're still a victim of cybercrime, even though you weren't necessarily a victim of the spamming. If someone manages to get your gmail password from Google, then Google is the victim of cybercrime. If Google then reacts by closing your account, you are a victim of Google. > Same thing here. Someone is using your credentials (like SSN and other identifiers) to defraud someone else. Even though you're not the direct victim of that fraud, you're still a victim of identity theft, since your credentials were compromised and used by someone else. If you want to call the behavior of the bank (or whatever) in this situation "identity theft", well, sure. Though I would suggest that that is highly misleading. More appropriate terms would be slander or blackmail, maybe?

yellowapple 9y ago
The fact that this is identity theft - and that the person whose credentials were used is indeed a victim - has absolutely zero to do with the bank's behavior. It has everything to do with the fact that credentials were stolen and used to impersonate someone else. So: "then Google is the victim of cybercrime" Google's credentials weren't stolen. The user's credentials were stolen. The user is therefore the victim of the theft of credentials - a.k.a. "cybercrime" or - in this case - identity theft. Google is also arguably a victim of fraud (or some other related crime), sure, but that is entirely separate from the fact that credentials were stolen in the first place. "behavior of the bank" Again: the bank's actions are irrelevant to the fact that credentials were stolen in the first place. Sure, it's a pretty shitty credential system, but they are credentials nonetheless, and them being used to impersonate someone makes that someone a victim, plain and simple. I'm really not sure how else to explain this. Seems pretty cut and dry to me.
- zAy0LfpBZLC8mAC 9y ago
  There is one very important unstated assumption in all of this: Who defines what is considered credentials? Let's forget about the Google example for a moment, as it's not really that great an analogy. When someone steals your SSN, say, what they have stolen is just your SSN. There is nothing about an SSN that makes it inherently a credential, it's just a unique number signifying you. The only thing that then makes it a de-facto credential is the decision of a bank, say. The bank decides that they will take someone telling them your SSN as proof of your identity, and that is how it becomes a credential. If the bank does not decide to accept knowledge of your SSN as proof of your identity, then there is absolutely no problem with someone stealing your SSN, because then it's not a credential. This unilateral decision on the part of the bank is what the "identity theft victim" is the victim of. The bank might just as well decide that knowing your first name proves your identity, thus supposedly making your name a credential.
  - yellowapple 9y ago
    "Who defines what is considered credentials?" Whoever writes Wikipedia articles, for one: https://en.wikipedia.org/wiki/Credential https://en.wikipedia.org/wiki/Credential Examples of credentials include [...] identification documents, [...] passwords, user names, [...] and so on. A social security number would fall under either "username" or "password", depending on how it's used, and the SS card itself would fall under "identification documents". "it's just a unique number signifying you." A.k.a. a credential. "The bank decides that they will take someone telling them your SSN as proof of your identity" Yes, because this is already commonplace throughout the U.S., including by the U.S. government. We can debate the pros and cons of the current SSN-reliant system all we want, but that doesn't change the fact that an SSN is a credential establishing identity, and that therefore the acquisition of an SSN by an unauthorized party constitutes theft of that credential and - ergo - "identity theft". It also doesn't change the fact that the legitimate owner of that credential was a victim of that actual theft (in addition to whatever actions from the bank in response to other crimes enabled by that theft). "thus supposedly making your name a credential." Your name is a credential, per the above definition. It's a shitty credential, yes, and one which is easily forged (and by no means unique, unlike a SSN), but it's a credential nonetheless.

yellowapple 9y ago

The fact that this is identity theft - and that the person whose credentials were used is indeed a victim - has absolutely zero to do with the bank's behavior. It has everything to do with the fact that credentials were stolen and used to impersonate someone else. So: "then Google is the victim of cybercrime" Google's credentials weren't stolen. The user's credentials were stolen. The user is therefore the victim of the theft of credentials - a.k.a. "cybercrime" or - in this case - identity theft. Google is also arguably a victim of fraud (or some other related crime), sure, but that is entirely separate from the fact that credentials were stolen in the first place. "behavior of the bank" Again: the bank's actions are irrelevant to the fact that credentials were stolen in the first place. Sure, it's a pretty shitty credential system, but they are credentials nonetheless, and them being used to impersonate someone makes that someone a victim, plain and simple. I'm really not sure how else to explain this. Seems pretty cut and dry to me.

zAy0LfpBZLC8mAC 9y ago
There is one very important unstated assumption in all of this: Who defines what is considered credentials? Let's forget about the Google example for a moment, as it's not really that great an analogy. When someone steals your SSN, say, what they have stolen is just your SSN. There is nothing about an SSN that makes it inherently a credential, it's just a unique number signifying you. The only thing that then makes it a de-facto credential is the decision of a bank, say. The bank decides that they will take someone telling them your SSN as proof of your identity, and that is how it becomes a credential. If the bank does not decide to accept knowledge of your SSN as proof of your identity, then there is absolutely no problem with someone stealing your SSN, because then it's not a credential. This unilateral decision on the part of the bank is what the "identity theft victim" is the victim of. The bank might just as well decide that knowing your first name proves your identity, thus supposedly making your name a credential.
- yellowapple 9y ago
  "Who defines what is considered credentials?" Whoever writes Wikipedia articles, for one: https://en.wikipedia.org/wiki/Credential https://en.wikipedia.org/wiki/Credential Examples of credentials include [...] identification documents, [...] passwords, user names, [...] and so on. A social security number would fall under either "username" or "password", depending on how it's used, and the SS card itself would fall under "identification documents". "it's just a unique number signifying you." A.k.a. a credential. "The bank decides that they will take someone telling them your SSN as proof of your identity" Yes, because this is already commonplace throughout the U.S., including by the U.S. government. We can debate the pros and cons of the current SSN-reliant system all we want, but that doesn't change the fact that an SSN is a credential establishing identity, and that therefore the acquisition of an SSN by an unauthorized party constitutes theft of that credential and - ergo - "identity theft". It also doesn't change the fact that the legitimate owner of that credential was a victim of that actual theft (in addition to whatever actions from the bank in response to other crimes enabled by that theft). "thus supposedly making your name a credential." Your name is a credential, per the above definition. It's a shitty credential, yes, and one which is easily forged (and by no means unique, unlike a SSN), but it's a credential nonetheless.