22 ms·

The main problem trying to be fixed here is "identity theft". What that crime is, I think, is not clearly understood. This is when a criminal defrauds a bank or

The main problem trying to be fixed here is "identity theft". What that crime is, I think, is not clearly understood. This is when a criminal defrauds a bank or other company by getting credit using your identifying information and then defaults. The bank then misinforms the credit bureaus that you defaulted on your loan and this lie by the bank hurts you when you want to get any type of loan. This crime would be better called "bank slander" and the banks that do it should be fined heavily with some money going to the person slandered. Banks should have to know who they are loaning money to and if they make a mistake, that needs to be solely their problem. Then banks will figure out ways to confirm your identity better and people won't get into the hell that is trying to get the "bank slander" removed from their credit report.

unabst 9y ago
The banks should definitely be made responsible and made to pay for all the fraud they sign off on at all of their desks. We already know what happens when the banks run out of money. They get bailed out. That means they will NEVER be the victim. That means we can make them pay for bailing out fraud victims and taking the hit on their behalf. It should be a service, a duty, and an honor. But that will never happen, because this is America.
Terr_ 9y ago
Exactly, "identify theft" is usually just weasel-wording for "someone broke our lazy authentication system". Followed by "and we compounded our failure by falsely telling lots of other institutions that it was your fault." https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY There won't be any improvement until the legal system creates a stronger incentive for institutions to be more secure.
- psyc 9y ago
  The term itself is almost ambiguous. Popular interpretation: "Theft of an identity" Better interpretation: "Theft, by forging an identity"
djsumdog 9y ago
You said it in your comment and I've seen it in other posts here on HN. It shouldn't be called identity theft. It should be called fraud. That's what it is. The idea of an identity, especially a permanent one that travels with you throughout your life, is a relative recent one. 200 years ago, you could escape your past sins, so long as you didn't have an identifiable face and could speak the language at your destination. (If you couldn't you ran the very real risk of becoming a slave, which is caused by removing a person from their context; e.g. family, language and community). There is a deeper question of "What is an identity?" and we also have to realize that the digital identities have never existed throughout history. Not in the way they do today. It's hard for us to imagine a world before passports, before real borders and before permanent numbers and documents that follow citizens throughout their lives. And the principal reason we have digital identities today? Debt. It is solely to trace debt. It has nothing to do with proving you went to x university or worked at y job. There are other ways to track that, which are terribly inaccurate when you really start to look at them. The principal reason for your SSN, your digital identity, is to track credit and debt. I highly recommend the book _Debt: The First 5,000 Years_. It really goes into depth on this concept.
- danans 9y ago
  And related to your prior point about slavery, the function of personal bankruptcy is to prevent debt slavery: https://en.m.wikipedia.org/wiki/History_of_bankruptcy_law https://en.m.wikipedia.org/wiki/History_of_bankruptcy_law
  - moonka 9y ago
    Which makes the changes to the rules surrounding personal bankruptcy in 2005 even more ominous, especially when it comes to big ticket items such as student loans. https://en.wikipedia.org/wiki/Bankruptcy_Abuse_Prevention_and_Consumer_Protection_Act https://en.wikipedia.org/wiki/Bankruptcy_Abuse_Prevention_an...
    - coupdetaco 9y ago
      The primary changes were to do with credit card debt. If you make >40k then you are not able to do Chapter 11. Instead, you need to do Chapter 7.
godzilla82 9y ago
Sorry you are wrong. SSNs and other identity mechanisms are an infrastructure provided by the government to facilitate business. It Should never be the responsibility of individuals/ business to validate identity. If there are flaws in the existing system that lends itself to be manipulated, then the solution should be that the government should fix it. Edit: In my country we didn't have a unique id till a couple of years back. So everywhere you had to submit photocopies of your id proof and a nother of your address proof. Imagine giving copies of your id to the lowest ranking person of the business you are dealing with. You have extra challenges if you have moved recently.
- testvox 9y ago
  SSN are NOT an identity mechanism or infrastructure to facilitate business. They are to facilitate tracking your contributions to social security. Businesses have abused them for their own ends because at one time social security numbers were the only globally unique identifier in common use.
  - Gaelan 9y ago
    “At one time” What alternative would you propose now?
    - ryandrake 9y ago
      Having a personal relationship with the person you're loaning tons of money to so you know they are who they say they are? I know it sounds ridiculous. And if your excuse is "well, we're too big to know our customers!" maybe you shouldn't be in the business of loaning money.
      - peoplewindow 9y ago
        It's actually hard to understand how America has this problem because it was the USA that basically invented the concept of "know your customer" and the modern anti money laundering system in the 60s and 70s. Failing to do KYC is supposed to be a serious offence that can lead to jail time. So how is it possible that banks routinely don't know their customer sufficiently well that identity theft is a real problem?
hoosieree 9y ago
Thief: Hi, I'd like to withdraw $100 from Joe's account. Bank: Here is $100 from your account, Joe. Joe: Hi bank, where's my $100? Bank: Already gave it to you. Joe: Wasn't me. Bank: Well, Joe, you screwed up big time. You let someone steal your identity. Sucks to be (the real) you!
- quickthrower2 9y ago
  Bank: Here is $100 from your account, Joe. ... Joe: Hi bank, where's my $100? FTFY Bank: Here is $100 from thin air, Joe. .. Joe: Hi bank, why is there an IOU for $100?
- EGreg 9y ago
  On the other side though, if Joe is protected againstany fraud (as he is with credit cards) what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? I would think that each new account or transcation should generate a notification to Joe and he should be able to reverse them within a certain amount of time. Joe could make it so that his device ignores notifications about transactions made by his own device, and only hear about other ones.
  - k_sh 9y ago
    > what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? That would be the same crime as someone using Joe's stolen credit card info - fraud.
    - wojt_eu 9y ago
      Then the bank has incentive to shift responsibility back to you, e.g. by requiring withdrawal request to be signed with your private encryption key. And you have an incentive to care about security of this key.
      - talmand 9y ago
StavrosK 9y ago
This reminds me of the recurring Onion title: ‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens. I don't understand why the US has identity theft. Is it because there's no national ID? Here in Europe we don't have any "secret" number that someone can just use to open a bank account in your name.
- yxhuvud 9y ago
  We still have identity theft in Europe, though the procedure to accomplish it effectively is usually more involved.
  - StavrosK 9y ago
    Hmm, really? I've never heard of any cases, what does it look like?
    - ryanlol 9y ago
      You get phished, someone sells your info, the buyer empties your bank account over the phone. This and variations are very common in Europe.
      - icebraining 9y ago
        Your posts in this thread would be more helpful with some source. Is it personal experience? Are you an European LEO?
        ryanlol 9y ago
        Personal experience. I used to frequent several private forums related to this sort of activity and had many friends who did this for a living. I am fascinated by the inner workings of these things, so naturally I asked lots of questions. There used to be some public discussions on the alphabay forums, which was filled with small time bank fraudsters from both the US and the EU. The EU ones actually seemed much more prevalent. I couldn't find many interesting scrapes quickly, but this one might be worth a look: https://evidencebasedsecurity.org/forums/data/dk/darkode_scrape.zip https://evidencebasedsecurity.org/forums/data/dk/darkode_scr... I'm sure there's an AB forum scrape floating around somewhere too... But not here https://www.gwern.net/DNM-archives https://www.gwern.net/DNM-archives
harryh 9y ago
It already is a crime if you tell the bank that they have made a mistake and they don't correct it. It's not hell to fix it. You just have to send a few letters. It also already is almost all the bank's problem. After all, they are the ones that lose the money in the scenario you describe.
Lazare 9y ago
Yes. It's easy to understand why the victim of this type of fraud (the banks) would like to shift the damages onto an unrelated third party (the person whom the original perpetrator is purporting to be); it makes life much easier for them. What's not clear is why anyone else would would go along with it. If someone breaks into my home and steals my microwave, I cannot then break into my neighbor's home, steal their microwave, and then claim that my neighbor was the true victim of the burglar. I am the victim of theft, and now that I've stolen my neighbor's microwave, he is also the victim of theft. It doesn't cancel out! I think it's important to be clear about what's going on here, who the victims are, and who they are being victimized by.
- jabl 9y ago
  > What's not clear is why anyone else would would go along with it. Anyone else (i.e. us plebs) don't need to go along with it. The banking industry has enough $$$ to pass laws favorable to them with or without our blessing.
mightybyte 9y ago
I agree with your assessment here. But the first thing I thought of when I saw this headline was fixing the fact that SSNs are massively bad as authentication. Instead of giving people a number to authenticate, we should be using public key crypto and digital signatures. If the Equifax hack is the catalyst that pushes us to public key crypto instead of SSNs, then I'm all for it.
- Carhughes 9y ago
  I totally agree. We need to throw our reliance on SSN out the window since the hackers are selling all of ours on the dark web as I speak. I like the idea floated out here or some other strong ID route such as SSH keys between 2 parties. All adult American SSN have been compromised so we have to move on to something else that offers stronger deterrents against hackers or ahole credit bureau agencies like Equifax who steal consumers financial data and make it broadly available for hacking.
cratermoon 9y ago
Notice how the solutions proposed to solve "identity theft" tend to be things that make it harder for the individual to engage in financial activity. Not make the credit agencies or financial institutions get their act together, but force the individuals to engage jump through more hoops to manage their own money.
undersuit 9y ago
Why can't I upvote this comment?
tomasien 9y ago
"this should be solely their problem" - from a legal standpoint, it is. The only reason it "isn't" is because the credit bureaus suck and don't move fast enough. I'm generally not in favor of using regulation as a blunt hammer, but I think a regulation that makes total sense is to strongly punish anything resembling a credit reporting agency (credit bureau or otherwise) that can't demonstrate RESULTS (not effort) in remediating errors related to ID theft. The FCRA put a lot of measures in place to RESPOND to consumer complaints, but they don't work well and only matter when the consumer decides to complain and is willing to put the time in to do so. That's not enough - if a CRA can't demonstrate success, they should either not be allowed to exist or they should be de-certified. CRA's that can't meet that standard could still exist as businesses, but the shouldn't get the government protected oligopolistic designation they get now.
paulsutter 9y ago
You’re onto something with “bank slander”: https://bootheglobalperspectives.com/article/1398476643WBG205127155/bank-officers-can-be-liable-for-defamation-invasion-of-privacy https://bootheglobalperspectives.com/article/1398476643WBG20... “Bank Presidents and Officers must exercise great care in protecting the privacy of information they gather on people, because there are legal liabilities if a bank intentionally defames a person or invades the privacy of an individual”
vostok 9y ago
If you want to live in such a "free market" world then if I'm a bank and someone fraudulently used your information to obtain a loan then I don't want to issue any more loans to anyone who uses your information. If one person used it fraudulently then there's a much higher probability that any subsequent loan application with the same information is also fraudulent.
- reacweb 9y ago
  Which mean that if a bank has failed to correctly check the identity of a client, the client will be punished his whole life by banks refusing him.
  - Filligree 9y ago
    Yes. If you consider this a poor outcome, then you should consider regulating the banks.
- Eridrus 9y ago
  I think this is even broader. If it becomes harder to verify identities any products that involve post-paid billing will become rarer.
- Retric 9y ago
  Banks need to make loans, if they reject people based on such things they will quickly go out of business as there is an ever smaller slice of the population left over. Instead, all that's going to happen is banks will simply require someone to show up in person and present sufficient identification.
Shivetya 9y ago
Just like any retailer who makes and delivers a sale over the internet without physical verification the issuers of credit should be held liable. this will mean getting instant credit for purchases and such will be very difficult but that is the price the lenders need to pay for the risk of having, not the consumer. perhaps they will need to partner with local banks and such. I don't care. by default they should not be able to issue credit where the liability is on the consumer until physical verification is complete
tlrobinson 9y ago
I wonder if anyone has tried to sue a bank for this?
dalbasal 9y ago
I think there are underlying issues beyond slander or misinformation. In many ways, credit scores are an early example of data related problems that will become more common. Some will become serious issues in the next few years. Credit scores are basically an estimate of credit-worthiness. The system is designed to solve the banks' problems, not consumers'. For banks, some number of false positives (creditworthy person with a bad score) is acceptable. It may narrow the market slightly, but it improves the quality of the remaining majority of customers. This is true of a lot of statistical/algorithmic decision making. Paypal flagged me as "high risk" when I moved countries, so I can't use paypal now. For paypal, losing 1 of me to avoid 2 malicious users is an acceptable trade-off. For me, it's annoying but not a big deal because paypal is rarely the only option. If paypal's "danger" flag were shared across the financial system, this would become a serious problem for me. It could freeze me out of online transactions entirely, maybe other things. If landlords had access to paypal's "high risk" filter, would it be worth using to filter out bad tenants? Seems possible. The false positive problem goes from an annoyance to a fundamental rights vioation quickly, if data is shared. Insurance is acquiring similar issues, though with very different mechanisms. As statistical inference improves, insurance ceases to be insurance... Risk gets pooled across ever smaller groups. The whole purpose of insurance is to pool risk widely. IMO, this is the problem the US' health policy architects underestimated. Insurance companies know too much to be insurance companies. More such issues are coming soon. China seems to want a credit score system, with alarmingly ambituous and and political breadth... The Social Credit System. Adtech companies and conglomerates (especially FB) are really hitting their stride. I wouldn't be surprised if they can score credit worthiness, insurance risk and other things using their web browser and app datasets. Should adtech be allowed to service banks, insurance companies, real estate agencies and employers? If not, we should probably decide this now. I don't know what the answers are, but credit score may be the place to start. I think approaching the problemfrom and identity/data protection perspective is fundamentaly flawed.
- ihaveahadron 9y ago
  "China seems to want a credit score system, with alarmingly ambituous and and political breadth..." What is alarming about that? Are we at war with China (we being the US.) This is not a politics or even an education problem. This, is a retarded problem. Nobody could write that without having serious gaps in their brain functioning.
ACuriousSomeon 9y ago
Agreed, a previous discussion on HN illustrated this very nicely: https://securitybytes.io/quick-one-stop-calling-it-identity-theft-10a5ab9e1b60 https://securitybytes.io/quick-one-stop-calling-it-identity-...
markdavis33 9y ago
https://twitter.com/DigitizeMyLife/status/928632371733258241 https://twitter.com/DigitizeMyLife/status/928632371733258241
npsimons 9y ago
> The main problem trying to be fixed here is "identity theft". It wasn't a problem, at least it wasn't up until the point that creditors reframed it as "identity theft." It's fraud, plain and simple, and if it were treated as such, the burden would be on entities that have the resources to handle it (and who are also responsible for enabling it) instead of ruining the lives of normal people just going about their business. Oh, you loaned money to someone claiming to be me? I don't see how that's my problem. Sucks to be you. Maybe rethink mailing out pre-approved credit cards in the future. > Banks should have to know who they are loaning money to and if they make a mistake, that needs to be solely their problem. Agreed.
rs999gti 9y ago
> This is when a criminal defrauds a bank or other company by getting credit using your identifying information and then defaults. ID Theft isn't just this. Illegal aliens use ID purchased on the black market to get jobs and pass ID verification. While they have those jobs, they have payroll taxes withheld, but don't file taxes leading to some Americans being hounded by the IRS. https://www.ice.gov/news/releases/15-illegal-aliens-arrested-east-texas-identity-theft https://www.ice.gov/news/releases/15-illegal-aliens-arrested... https://www.usatoday.com/story/opinion/columnists/2017/07/03/identity-theft-overlooked-wrinkle-illegal-immigration/444863001/ https://www.usatoday.com/story/opinion/columnists/2017/07/03... Additionally, some American babies are assigned SSN's already associated with illegal aliens: > Illegal aliens generally prefer SSNs that have not yet been legally issued or, failing that, the SSNs that belong to American children since these numbers can be used for years without anyone knowing it – except the IRS and the Social Security Administration. > However, the Social Security Administration does not remove unassigned SSNs used by illegal immigrants from its database. That means the numbers are eventually assigned to newborn, American infants. Neither the Social Security Administration nor the IRS notifies American citizens when their or their children’s SSNs are used by others. In other words, the federal government has facilitated identity theft and protected the identity thieves. http://thehill.com/blogs/pundits-blog/immigration/327049-president-trump-tell-the-feds-to-stop-helping-illegal-aliens http://thehill.com/blogs/pundits-blog/immigration/327049-pre...
Chinjut 9y ago
Mitchell and Webb had a great bit on this point: https://m.youtube.com/watch?v=CS9ptA3Ya9E https://m.youtube.com/watch?v=CS9ptA3Ya9E
manishsharan 9y ago
This. I once applied to my bank to take out a loan for my business and the questioning I faced was very vigorous and the process took almost a month. Contrast this with getting a Visa/Mastercard for almost equivalent amount-- the sales rep fills out the information in a minute in a big box store and the card is mailed to you within a few weeks.

unabst 9y ago

The banks should definitely be made responsible and made to pay for all the fraud they sign off on at all of their desks. We already know what happens when the banks run out of money. They get bailed out. That means they will NEVER be the victim. That means we can make them pay for bailing out fraud victims and taking the hit on their behalf. It should be a service, a duty, and an honor. But that will never happen, because this is America.

Terr_ 9y ago

Exactly, "identify theft" is usually just weasel-wording for "someone broke our lazy authentication system". Followed by "and we compounded our failure by falsely telling lots of other institutions that it was your fault." https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY There won't be any improvement until the legal system creates a stronger incentive for institutions to be more secure.

psyc 9y ago
The term itself is almost ambiguous. Popular interpretation: "Theft of an identity" Better interpretation: "Theft, by forging an identity"

djsumdog 9y ago

You said it in your comment and I've seen it in other posts here on HN. It shouldn't be called identity theft. It should be called fraud. That's what it is. The idea of an identity, especially a permanent one that travels with you throughout your life, is a relative recent one. 200 years ago, you could escape your past sins, so long as you didn't have an identifiable face and could speak the language at your destination. (If you couldn't you ran the very real risk of becoming a slave, which is caused by removing a person from their context; e.g. family, language and community). There is a deeper question of "What is an identity?" and we also have to realize that the digital identities have never existed throughout history. Not in the way they do today. It's hard for us to imagine a world before passports, before real borders and before permanent numbers and documents that follow citizens throughout their lives. And the principal reason we have digital identities today? Debt. It is solely to trace debt. It has nothing to do with proving you went to x university or worked at y job. There are other ways to track that, which are terribly inaccurate when you really start to look at them. The principal reason for your SSN, your digital identity, is to track credit and debt. I highly recommend the book _Debt: The First 5,000 Years_. It really goes into depth on this concept.

danans 9y ago
And related to your prior point about slavery, the function of personal bankruptcy is to prevent debt slavery: https://en.m.wikipedia.org/wiki/History_of_bankruptcy_law https://en.m.wikipedia.org/wiki/History_of_bankruptcy_law
- moonka 9y ago
  Which makes the changes to the rules surrounding personal bankruptcy in 2005 even more ominous, especially when it comes to big ticket items such as student loans. https://en.wikipedia.org/wiki/Bankruptcy_Abuse_Prevention_and_Consumer_Protection_Act https://en.wikipedia.org/wiki/Bankruptcy_Abuse_Prevention_an...
  - coupdetaco 9y ago
    The primary changes were to do with credit card debt. If you make >40k then you are not able to do Chapter 11. Instead, you need to do Chapter 7.

godzilla82 9y ago

Sorry you are wrong. SSNs and other identity mechanisms are an infrastructure provided by the government to facilitate business. It Should never be the responsibility of individuals/ business to validate identity. If there are flaws in the existing system that lends itself to be manipulated, then the solution should be that the government should fix it. Edit: In my country we didn't have a unique id till a couple of years back. So everywhere you had to submit photocopies of your id proof and a nother of your address proof. Imagine giving copies of your id to the lowest ranking person of the business you are dealing with. You have extra challenges if you have moved recently.

testvox 9y ago
SSN are NOT an identity mechanism or infrastructure to facilitate business. They are to facilitate tracking your contributions to social security. Businesses have abused them for their own ends because at one time social security numbers were the only globally unique identifier in common use.
- Gaelan 9y ago
  “At one time” What alternative would you propose now?
  - ryandrake 9y ago
    Having a personal relationship with the person you're loaning tons of money to so you know they are who they say they are? I know it sounds ridiculous. And if your excuse is "well, we're too big to know our customers!" maybe you shouldn't be in the business of loaning money.
    - peoplewindow 9y ago
      It's actually hard to understand how America has this problem because it was the USA that basically invented the concept of "know your customer" and the modern anti money laundering system in the 60s and 70s. Failing to do KYC is supposed to be a serious offence that can lead to jail time. So how is it possible that banks routinely don't know their customer sufficiently well that identity theft is a real problem?

hoosieree 9y ago

Thief: Hi, I'd like to withdraw $100 from Joe's account. Bank: Here is $100 from your account, Joe. Joe: Hi bank, where's my $100? Bank: Already gave it to you. Joe: Wasn't me. Bank: Well, Joe, you screwed up big time. You let someone steal your identity. Sucks to be (the real) you!

quickthrower2 9y ago
Bank: Here is $100 from your account, Joe. ... Joe: Hi bank, where's my $100? FTFY Bank: Here is $100 from thin air, Joe. .. Joe: Hi bank, why is there an IOU for $100?
EGreg 9y ago
On the other side though, if Joe is protected againstany fraud (as he is with credit cards) what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? I would think that each new account or transcation should generate a notification to Joe and he should be able to reverse them within a certain amount of time. Joe could make it so that his device ignores notifications about transactions made by his own device, and only hear about other ones.
- k_sh 9y ago
  > what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? That would be the same crime as someone using Joe's stolen credit card info - fraud.
  - wojt_eu 9y ago
    Then the bank has incentive to shift responsibility back to you, e.g. by requiring withdrawal request to be signed with your private encryption key. And you have an incentive to care about security of this key.
    - talmand 9y ago

StavrosK 9y ago

This reminds me of the recurring Onion title: ‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens. I don't understand why the US has identity theft. Is it because there's no national ID? Here in Europe we don't have any "secret" number that someone can just use to open a bank account in your name.

yxhuvud 9y ago
We still have identity theft in Europe, though the procedure to accomplish it effectively is usually more involved.
- StavrosK 9y ago
  Hmm, really? I've never heard of any cases, what does it look like?
  - ryanlol 9y ago
    You get phished, someone sells your info, the buyer empties your bank account over the phone. This and variations are very common in Europe.
    - icebraining 9y ago
      Your posts in this thread would be more helpful with some source. Is it personal experience? Are you an European LEO?
      - ryanlol 9y ago
        Personal experience. I used to frequent several private forums related to this sort of activity and had many friends who did this for a living. I am fascinated by the inner workings of these things, so naturally I asked lots of questions. There used to be some public discussions on the alphabay forums, which was filled with small time bank fraudsters from both the US and the EU. The EU ones actually seemed much more prevalent. I couldn't find many interesting scrapes quickly, but this one might be worth a look: https://evidencebasedsecurity.org/forums/data/dk/darkode_scrape.zip https://evidencebasedsecurity.org/forums/data/dk/darkode_scr... I'm sure there's an AB forum scrape floating around somewhere too... But not here https://www.gwern.net/DNM-archives https://www.gwern.net/DNM-archives

harryh 9y ago

It already is a crime if you tell the bank that they have made a mistake and they don't correct it. It's not hell to fix it. You just have to send a few letters. It also already is almost all the bank's problem. After all, they are the ones that lose the money in the scenario you describe.

Lazare 9y ago

Yes. It's easy to understand why the victim of this type of fraud (the banks) would like to shift the damages onto an unrelated third party (the person whom the original perpetrator is purporting to be); it makes life much easier for them. What's not clear is why anyone else would would go along with it. If someone breaks into my home and steals my microwave, I cannot then break into my neighbor's home, steal their microwave, and then claim that my neighbor was the true victim of the burglar. I am the victim of theft, and now that I've stolen my neighbor's microwave, he is also the victim of theft. It doesn't cancel out! I think it's important to be clear about what's going on here, who the victims are, and who they are being victimized by.

jabl 9y ago
> What's not clear is why anyone else would would go along with it. Anyone else (i.e. us plebs) don't need to go along with it. The banking industry has enough $$$ to pass laws favorable to them with or without our blessing.

mightybyte 9y ago

I agree with your assessment here. But the first thing I thought of when I saw this headline was fixing the fact that SSNs are massively bad as authentication. Instead of giving people a number to authenticate, we should be using public key crypto and digital signatures. If the Equifax hack is the catalyst that pushes us to public key crypto instead of SSNs, then I'm all for it.

Carhughes 9y ago
I totally agree. We need to throw our reliance on SSN out the window since the hackers are selling all of ours on the dark web as I speak. I like the idea floated out here or some other strong ID route such as SSH keys between 2 parties. All adult American SSN have been compromised so we have to move on to something else that offers stronger deterrents against hackers or ahole credit bureau agencies like Equifax who steal consumers financial data and make it broadly available for hacking.

cratermoon 9y ago

Notice how the solutions proposed to solve "identity theft" tend to be things that make it harder for the individual to engage in financial activity. Not make the credit agencies or financial institutions get their act together, but force the individuals to engage jump through more hoops to manage their own money.

undersuit 9y ago

Why can't I upvote this comment?

tomasien 9y ago

"this should be solely their problem" - from a legal standpoint, it is. The only reason it "isn't" is because the credit bureaus suck and don't move fast enough. I'm generally not in favor of using regulation as a blunt hammer, but I think a regulation that makes total sense is to strongly punish anything resembling a credit reporting agency (credit bureau or otherwise) that can't demonstrate RESULTS (not effort) in remediating errors related to ID theft. The FCRA put a lot of measures in place to RESPOND to consumer complaints, but they don't work well and only matter when the consumer decides to complain and is willing to put the time in to do so. That's not enough - if a CRA can't demonstrate success, they should either not be allowed to exist or they should be de-certified. CRA's that can't meet that standard could still exist as businesses, but the shouldn't get the government protected oligopolistic designation they get now.

paulsutter 9y ago

You’re onto something with “bank slander”: https://bootheglobalperspectives.com/article/1398476643WBG205127155/bank-officers-can-be-liable-for-defamation-invasion-of-privacy https://bootheglobalperspectives.com/article/1398476643WBG20... “Bank Presidents and Officers must exercise great care in protecting the privacy of information they gather on people, because there are legal liabilities if a bank intentionally defames a person or invades the privacy of an individual”

vostok 9y ago

If you want to live in such a "free market" world then if I'm a bank and someone fraudulently used your information to obtain a loan then I don't want to issue any more loans to anyone who uses your information. If one person used it fraudulently then there's a much higher probability that any subsequent loan application with the same information is also fraudulent.

reacweb 9y ago
Which mean that if a bank has failed to correctly check the identity of a client, the client will be punished his whole life by banks refusing him.
- Filligree 9y ago
  Yes. If you consider this a poor outcome, then you should consider regulating the banks.
Eridrus 9y ago
I think this is even broader. If it becomes harder to verify identities any products that involve post-paid billing will become rarer.
Retric 9y ago
Banks need to make loans, if they reject people based on such things they will quickly go out of business as there is an ever smaller slice of the population left over. Instead, all that's going to happen is banks will simply require someone to show up in person and present sufficient identification.

Shivetya 9y ago

Just like any retailer who makes and delivers a sale over the internet without physical verification the issuers of credit should be held liable. this will mean getting instant credit for purchases and such will be very difficult but that is the price the lenders need to pay for the risk of having, not the consumer. perhaps they will need to partner with local banks and such. I don't care. by default they should not be able to issue credit where the liability is on the consumer until physical verification is complete

tlrobinson 9y ago

I wonder if anyone has tried to sue a bank for this?

dalbasal 9y ago

I think there are underlying issues beyond slander or misinformation. In many ways, credit scores are an early example of data related problems that will become more common. Some will become serious issues in the next few years. Credit scores are basically an estimate of credit-worthiness. The system is designed to solve the banks' problems, not consumers'. For banks, some number of false positives (creditworthy person with a bad score) is acceptable. It may narrow the market slightly, but it improves the quality of the remaining majority of customers. This is true of a lot of statistical/algorithmic decision making. Paypal flagged me as "high risk" when I moved countries, so I can't use paypal now. For paypal, losing 1 of me to avoid 2 malicious users is an acceptable trade-off. For me, it's annoying but not a big deal because paypal is rarely the only option. If paypal's "danger" flag were shared across the financial system, this would become a serious problem for me. It could freeze me out of online transactions entirely, maybe other things. If landlords had access to paypal's "high risk" filter, would it be worth using to filter out bad tenants? Seems possible. The false positive problem goes from an annoyance to a fundamental rights vioation quickly, if data is shared. Insurance is acquiring similar issues, though with very different mechanisms. As statistical inference improves, insurance ceases to be insurance... Risk gets pooled across ever smaller groups. The whole purpose of insurance is to pool risk widely. IMO, this is the problem the US' health policy architects underestimated. Insurance companies know too much to be insurance companies. More such issues are coming soon. China seems to want a credit score system, with alarmingly ambituous and and political breadth... The Social Credit System. Adtech companies and conglomerates (especially FB) are really hitting their stride. I wouldn't be surprised if they can score credit worthiness, insurance risk and other things using their web browser and app datasets. Should adtech be allowed to service banks, insurance companies, real estate agencies and employers? If not, we should probably decide this now. I don't know what the answers are, but credit score may be the place to start. I think approaching the problemfrom and identity/data protection perspective is fundamentaly flawed.

ihaveahadron 9y ago
"China seems to want a credit score system, with alarmingly ambituous and and political breadth..." What is alarming about that? Are we at war with China (we being the US.) This is not a politics or even an education problem. This, is a retarded problem. Nobody could write that without having serious gaps in their brain functioning.

ACuriousSomeon 9y ago

Agreed, a previous discussion on HN illustrated this very nicely: https://securitybytes.io/quick-one-stop-calling-it-identity-theft-10a5ab9e1b60 https://securitybytes.io/quick-one-stop-calling-it-identity-...

markdavis33 9y ago

https://twitter.com/DigitizeMyLife/status/928632371733258241 https://twitter.com/DigitizeMyLife/status/928632371733258241

npsimons 9y ago

> The main problem trying to be fixed here is "identity theft". It wasn't a problem, at least it wasn't up until the point that creditors reframed it as "identity theft." It's fraud, plain and simple, and if it were treated as such, the burden would be on entities that have the resources to handle it (and who are also responsible for enabling it) instead of ruining the lives of normal people just going about their business. Oh, you loaned money to someone claiming to be me? I don't see how that's my problem. Sucks to be you. Maybe rethink mailing out pre-approved credit cards in the future. > Banks should have to know who they are loaning money to and if they make a mistake, that needs to be solely their problem. Agreed.

rs999gti 9y ago

> This is when a criminal defrauds a bank or other company by getting credit using your identifying information and then defaults. ID Theft isn't just this. Illegal aliens use ID purchased on the black market to get jobs and pass ID verification. While they have those jobs, they have payroll taxes withheld, but don't file taxes leading to some Americans being hounded by the IRS. https://www.ice.gov/news/releases/15-illegal-aliens-arrested-east-texas-identity-theft https://www.ice.gov/news/releases/15-illegal-aliens-arrested... https://www.usatoday.com/story/opinion/columnists/2017/07/03/identity-theft-overlooked-wrinkle-illegal-immigration/444863001/ https://www.usatoday.com/story/opinion/columnists/2017/07/03... Additionally, some American babies are assigned SSN's already associated with illegal aliens: > Illegal aliens generally prefer SSNs that have not yet been legally issued or, failing that, the SSNs that belong to American children since these numbers can be used for years without anyone knowing it – except the IRS and the Social Security Administration. > However, the Social Security Administration does not remove unassigned SSNs used by illegal immigrants from its database. That means the numbers are eventually assigned to newborn, American infants. Neither the Social Security Administration nor the IRS notifies American citizens when their or their children’s SSNs are used by others. In other words, the federal government has facilitated identity theft and protected the identity thieves. http://thehill.com/blogs/pundits-blog/immigration/327049-president-trump-tell-the-feds-to-stop-helping-illegal-aliens http://thehill.com/blogs/pundits-blog/immigration/327049-pre...

Chinjut 9y ago

Mitchell and Webb had a great bit on this point: https://m.youtube.com/watch?v=CS9ptA3Ya9E https://m.youtube.com/watch?v=CS9ptA3Ya9E

manishsharan 9y ago

This. I once applied to my bank to take out a loan for my business and the questioning I faced was very vigorous and the process took almost a month. Contrast this with getting a Visa/Mastercard for almost equivalent amount-- the sales rep fills out the information in a minute in a big box store and the card is mailed to you within a few weeks.