4 ms·

Thief: Hi, I'd like to withdraw $100 from Joe's account. Bank: Here is $100 from your account, Joe. Joe: Hi bank, where's my $100? Bank: Already gave it to y

Thief: Hi, I'd like to withdraw $100 from Joe's account. Bank: Here is $100 from your account, Joe. Joe: Hi bank, where's my $100? Bank: Already gave it to you. Joe: Wasn't me. Bank: Well, Joe, you screwed up big time. You let someone steal your identity. Sucks to be (the real) you!

quickthrower2 9y ago
Bank: Here is $100 from your account, Joe. ... Joe: Hi bank, where's my $100? FTFY Bank: Here is $100 from thin air, Joe. .. Joe: Hi bank, why is there an IOU for $100?
EGreg 9y ago
On the other side though, if Joe is protected againstany fraud (as he is with credit cards) what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? I would think that each new account or transcation should generate a notification to Joe and he should be able to reverse them within a certain amount of time. Joe could make it so that his device ignores notifications about transactions made by his own device, and only hear about other ones.
- k_sh 9y ago
  > what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? That would be the same crime as someone using Joe's stolen credit card info - fraud.
  - wojt_eu 9y ago
    Then the bank has incentive to shift responsibility back to you, e.g. by requiring withdrawal request to be signed with your private encryption key. And you have an incentive to care about security of this key.
    - talmand 9y ago
      Well, until the bank offers such a feature on my account then it should be on them.
- pas 9y ago
  There's no shared secret between just the bank and you. Therefore the bank can't establish that it was you, who leaked the secret. (Because it's easy to leak SSN, it could have been any random company you did business with. Or the SocSecAdmin.) And even if your shared secret was used to withdraw, there's still a chance of the bank leaking it. So usually the shared secret's hash is stored. This works pretty well. Around here banks ask you to give your PIN for identification, or you have to present your ID, and they compare it with what they have on file. (So trust on first use is still important.) Sure, it's probably not hard to fake these plastic cards, but that's a rather serious crime, and then the bank can pull the security cam footage, etc... Of course, requiring confirmation on an SMS even when you do in person banking might make sense.
  - r3bl 9y ago
    And that's why the rest of the world's governments issue their own national IDs to their citizens. Heck, I have two! I have one given to me at birth, which is a sequence of 13 numbers that gets calculated with a formula and has a control number at the end (kind of like credit card). This one is random enough for nobody be able to guess anyone else's (for example, how many babies were born before you on your birth day in that region is a relevant factor in the formula) and is used with government entities and government entities only (it is illegal for the businesses to require from you to provide that number to them to give you a service). And I have the second one, which is the national ID number. This one was given to me when I was 18, and it serves as a proof of identity with the businesses. And there you have it. Two distinct numbers. One for your government, and the second one for you dealing with businesses. Someone can't fake anything important (as in, government-related) with your ID, and businesses have a second number that is usually proven on the spot with the photo of you in your national ID. Problem is solved.
    - aardshark 9y ago
      Sounds like you live in a country with a compulsory national ID card. Not all countries have or want that.
      - 9y ago
- VLM 9y ago
  Scalability. Transactions are usually pretty small compared to annual incomes so the people doing this are doing it a lot, and you will be under some scrutiny after the 75th fraud on your account this year. This is only an issue because of tracked non-anonymous accounts. The key for money laundering in high profit / service retail businesses is using dirty anonymous cash. Often the customers literally do not exist, imaginary entries are made at the register and cash is stuffed in. The last suggestion is easily worked around, merely trade device IDs along with account IDs. In fact the easiest way to steal money would be simply to clone your device outright complete with saved passwords etc. Joe certainly doesn't control his own device, not the firmware, OS, or apps, not to mention MITM attacks.

quickthrower2 9y ago

Bank: Here is $100 from your account, Joe. ... Joe: Hi bank, where's my $100? FTFY Bank: Here is $100 from thin air, Joe. .. Joe: Hi bank, why is there an IOU for $100?

EGreg 9y ago

On the other side though, if Joe is protected againstany fraud (as he is with credit cards) what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? I would think that each new account or transcation should generate a notification to Joe and he should be able to reverse them within a certain amount of time. Joe could make it so that his device ignores notifications about transactions made by his own device, and only hear about other ones.

k_sh 9y ago
> what's to prevent Joe from GIVING his identifying info to someone and then claiming identity theft? Or just buying stuff and claiming identity theft? That would be the same crime as someone using Joe's stolen credit card info - fraud.
- wojt_eu 9y ago
  Then the bank has incentive to shift responsibility back to you, e.g. by requiring withdrawal request to be signed with your private encryption key. And you have an incentive to care about security of this key.
  - talmand 9y ago
    Well, until the bank offers such a feature on my account then it should be on them.
pas 9y ago
There's no shared secret between just the bank and you. Therefore the bank can't establish that it was you, who leaked the secret. (Because it's easy to leak SSN, it could have been any random company you did business with. Or the SocSecAdmin.) And even if your shared secret was used to withdraw, there's still a chance of the bank leaking it. So usually the shared secret's hash is stored. This works pretty well. Around here banks ask you to give your PIN for identification, or you have to present your ID, and they compare it with what they have on file. (So trust on first use is still important.) Sure, it's probably not hard to fake these plastic cards, but that's a rather serious crime, and then the bank can pull the security cam footage, etc... Of course, requiring confirmation on an SMS even when you do in person banking might make sense.
- r3bl 9y ago
  And that's why the rest of the world's governments issue their own national IDs to their citizens. Heck, I have two! I have one given to me at birth, which is a sequence of 13 numbers that gets calculated with a formula and has a control number at the end (kind of like credit card). This one is random enough for nobody be able to guess anyone else's (for example, how many babies were born before you on your birth day in that region is a relevant factor in the formula) and is used with government entities and government entities only (it is illegal for the businesses to require from you to provide that number to them to give you a service). And I have the second one, which is the national ID number. This one was given to me when I was 18, and it serves as a proof of identity with the businesses. And there you have it. Two distinct numbers. One for your government, and the second one for you dealing with businesses. Someone can't fake anything important (as in, government-related) with your ID, and businesses have a second number that is usually proven on the spot with the photo of you in your national ID. Problem is solved.
  - aardshark 9y ago
    Sounds like you live in a country with a compulsory national ID card. Not all countries have or want that.
    - 9y ago
VLM 9y ago
Scalability. Transactions are usually pretty small compared to annual incomes so the people doing this are doing it a lot, and you will be under some scrutiny after the 75th fraud on your account this year. This is only an issue because of tracked non-anonymous accounts. The key for money laundering in high profit / service retail businesses is using dirty anonymous cash. Often the customers literally do not exist, imaginary entries are made at the register and cash is stuffed in. The last suggestion is easily worked around, merely trade device IDs along with account IDs. In fact the easiest way to steal money would be simply to clone your device outright complete with saved passwords etc. Joe certainly doesn't control his own device, not the firmware, OS, or apps, not to mention MITM attacks.