7 ms·

Something I would have liked to see - but perhaps this letter wasn't the right place. Let's talk about how the ubiquitous use of SSN and credit reports puts a

Something I would have liked to see - but perhaps this letter wasn't the right place. Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen. Right now, it's all on me. I need to safeguard everything related to my government-issued nine digit ID that I never asked for - yet is somehow accepted as my financial identity, well beyond its intended scope. If I fail to do so, or if I fail to aggressively identify fraudulent use of it by monitoring reports from 3-4 different agencies, it's on me. It's my credit that's screwed. It's hard to emphasize enough how unreasonable that is. This isn't a house or other peace of real property that's in my control - it's 4 bytes of data that is assigned to me, but that I fundamentally have no control over. In spite of that, I am accountable for any and all uses of that data. It's hours of my life each time a breach occurs - more if it's actually misused. The assumption of 'bad credit risk unless and until you convince the reporting agencies that fraud has happened' is a fundamentally flawed one. I can't opt out. I can only keep spending my time and money to play the game - because it's the only one in town.

jaredandrews 9y ago
Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me. My identity wasn't stolen! You gave a loan/credit card/whatever to someone and didn't verify who they were. How is your organization not doing the proper work a "theft" of my identity? I'm not involved and I don't want to be!
- greenleafjacob 9y ago
  I’ve heard “bank fraud” used here.
- jacquesm 9y ago
  > identity theft Impersonation.
  - dotancohen 9y ago
    No, this implies that the victim is the end user, not the bank.
- mrhwick 9y ago
  https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- CoolGuySteve 9y ago
  If the credit agency is harming your reputation with an incorrect credit report then the proper term for what they're doing is libel and you can sue them for it. I'd like to see a startup or non-profit that automates libel civil lawsuits against the reporting agencies. At least then maybe we'd get some responsibility from them.
  - seanp2k2 9y ago
    IANAL but banks have a lot of cash to throw at legal teams. AFAIK you’d have to show evidence of material damages. Seems very hard to automate...might be better for class-action.
    - CoolGuySteve 9y ago
      Ya I agree. It seems these firms are relying on the fact that each individual suing them would have to put up considerable time and money, and so most don't . But if some economy of scale could be provided in filing these lawsuits, like those boilerplate will in a box products, then the business of credit reporting in its current form may be made non-viable.
  - adanto6840 9y ago
    I wonder how many of the major US banks have binding arbitration clauses? I don't claim to know one way or the other, though I thought I heard that one major bank did & it had been standing up in court recently, but I may be mistaken. I also have no idea if they'd hold up in general -- but I'd be curious how many of the T&Cs that you sign have these clauses...
    - TheCoelacanth 9y ago
      Probably all of them. So you would just have to find someone who had never opened a legitimate line of credit, but for whom a fraudulent line of credit had been opened.
- hammock 9y ago
  Negligence
- LambdaComplex 9y ago
  "Identity theft" isn't real. It's a term the banks et al. use so that they can have less responsibility. Example: Someone opens a bank account using your information. That's fraud. Someone lied to the bank, and the bank believed them. That's the bank's problem. But by pointing at you and saying "Your identity was stolen" (using the term "stolen" to make it seem like this is similar to the theft of a physical object), it suddenly seems like it's your problem.
  - LeifCarrotson 9y ago
    > It's a term the banks et al. use so that they can have less responsibility. I agree that it's misleading, but have to concede that whoever first came up with that term must have been an expert in framing and spin. There are few words that so effectively distort the discussion as "identity theft".
    - romwell 9y ago
      Indeed. When one thinks of "identity theft victims", one doesn't think of a bank. But it is the bank, it should be! When a bank is robbed, its clients aren't the victims. The bank is. The clients aren't giving money to the bank for nothing in return; what they get in return is assurance of safety and availability (otherwise, that would be a loan, not a deposit). Spinning the failure to deliver on that obligation as the client's problem is indeed great PR work.
  - pdkl95 9y ago
    Fraud is only half of the "identify theft" reframing. The term also attempts to excuse libel/slander by the credit agency.
- losteric 9y ago
  Fraud is the one and only word needed. Via https://en.wiktionary.org/wiki/fraud https://en.wiktionary.org/wiki/fraud: The crime of stealing or otherwise illegally obtaining money by use of deception tactics. Legally speaking > Fraud must be proved by showing that the defendant's actions involved five separate elements: > (1) a false statement of a material fact ["I am John Doe"], > (2) knowledge on the part of the defendant that the statement is untrue [they are not John Doe], > (3) intent on the part of the defendant to deceive the alleged victim [they want money], > (4) justifiable reliance by the alleged victim on the statement [bank credit approves access based on identity], and > (5) injury to the alleged victim as a result [bank loses customer money]. (https://legal-dictionary.thefreedictionary.com/fraud https://legal-dictionary.thefreedictionary.com/fraud)
- anubisresources 9y ago
  Credit fraud. The banks were defrauded, not you.
- njarboe 9y ago
  I like the term "bank slander"[1]. The company that gave a loan to fraudster (a bank) lies to the credit bureau (slander) and now you have to spend a bunch of time trying (and usually failing) to get those lies off your credit report. [1]previous HN comment - https://news.ycombinator.com/item?id=15657887 https://news.ycombinator.com/item?id=15657887
  - overdrivetg 9y ago
    Maybe "credit slander"? Including the added bonus of expanding the set of possible perpetrators.
  - jaredandrews 9y ago
    Love this one and I am going to start using it in real life, peace!
- dotancohen 9y ago
  > Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me. I'll have a stab at coining the new word. The concept is referring to attempted or successful deceit of the bank. Let's take the Latin word for deceit, fraudem, and modernize it so it won't sound so quaint. I think that "fraud" would do.
greenhouse_gas 9y ago
Just curious, how do other countries do it? For example, can I get a loan in Canada online or over the phone (not in person)?
- PeterisP 9y ago
  The EU practice of shifting the practical risks from the impersonated person to the defrauded lender means that lenders are less eager to accept risks and more careful with verification. Usually, you get loans from your bank - and since you have a preexisting relationship and secure authentication methods, you generally can do it remotely. However, establishing your identity to a new organization usually requires a visit in person and verifying official ID; the lenders who don't require this (e.g. various companies offering small payday loans) have a much higher rate of fraud and thus charge high interest rates to cover those risks. A popular measure that I've seen used is that they require you to wire them 1 cent from the account to which they'll pay out the loan, which can remotely show that you most likely own that account.
adekok 9y ago
> Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen. In France, private credit bureaus don't exist. It's up to banks to track these things. The country seems to work fine.
- csa 9y ago
  > In France > The country seems to work fine. I hope you realize the joy you have brought to many people's day by writing this. I would pay a large sum of money to see all of the replies that will go unwritten.
  - toomanybeersies 9y ago
    I know that everyone loves to laugh at France, but France isn't a bad country. It's hardly a dysfunctional hellhole.
    - yesenadam 9y ago
      Everyone? Only estadounidenses.
- maxxxxx 9y ago
  In Germany life is also not dominated by the credit agencies like in the US but there is a thing called "Schufa" that does some credit reporting. Not sure how it works though.
  - chokma 9y ago
    The Schufa (https://en.wikipedia.org/wiki/Schufa https://en.wikipedia.org/wiki/Schufa ) provides data for their partners/customers on your credit rating and credit score. Banks will usually not give you an account and shops won't give you credit if your rating is bad. For example, you are so late to pay your bills that the creditor has involved collection agencies or the courts to get their money. Landlords will more often than not demand a document from the Schufa (supplied at your own expense) to consider you eligible for renting a flat or a house. edit: grammar
softawre 9y ago
You can freeze your credit to "opt out"
- mulmen 9y ago
  But then you're opting out of the US financial system as it is available to consumers.
  - ams6110 9y ago
    You can unfreeze if you need access to credit.
    - mulmen 9y ago
      At which point you opt back in to the risk. It's not a workable solution.
    - bradstewart 9y ago
      And it costs you $10 per credit agency every time you need it.
chiefofgxbxl 9y ago
It's frustrating enough to see private enterprises using SSN as a form of identification, e.g. getting a lease on my apartment I had to provide my SSN. What's worse is when government agencies themselves use it, knowing full well the number of recent data breaches. I recently went to the DMV in Colorado to obtain a driver's license (since I moved here from another state). They turned me away because I didn't have my physical social security card with me. I did have my U.S. Passport, which has far more security than a blue card with a number printed on the front of it. And sadly the Colorado DMVs will continue using SSN to identify people, even after hearing about the Equifax breach. Honestly, a social security card may as well be a post-it-note with the number written in crayon or finger paint.
Flenser 9y ago
That's exactly what Troy is talking about in the section on KBA (Knowledge Based Authentication) >Knowledge-based authentication (KBA) is predicated on the assumption that an individual holds certain knowledge that can be used to prove their identity. It’s assumed that this knowledge is either private or not broadly known thus if the individual can correctly relay it then, with a high degree of confidence, they can prove their identity. KBA is typically dependent on either static or dynamic “secrets” with the former being the immutable data attributes mentioned earlier (date of birth, mother’s maiden name, etc.) and the latter being mutable such as a password.

jaredandrews 9y ago

Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me. My identity wasn't stolen! You gave a loan/credit card/whatever to someone and didn't verify who they were. How is your organization not doing the proper work a "theft" of my identity? I'm not involved and I don't want to be!

greenleafjacob 9y ago
I’ve heard “bank fraud” used here.
jacquesm 9y ago
> identity theft Impersonation.
- dotancohen 9y ago
  No, this implies that the victim is the end user, not the bank.
mrhwick 9y ago
https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
CoolGuySteve 9y ago
If the credit agency is harming your reputation with an incorrect credit report then the proper term for what they're doing is libel and you can sue them for it. I'd like to see a startup or non-profit that automates libel civil lawsuits against the reporting agencies. At least then maybe we'd get some responsibility from them.
- seanp2k2 9y ago
  IANAL but banks have a lot of cash to throw at legal teams. AFAIK you’d have to show evidence of material damages. Seems very hard to automate...might be better for class-action.
  - CoolGuySteve 9y ago
    Ya I agree. It seems these firms are relying on the fact that each individual suing them would have to put up considerable time and money, and so most don't . But if some economy of scale could be provided in filing these lawsuits, like those boilerplate will in a box products, then the business of credit reporting in its current form may be made non-viable.
- adanto6840 9y ago
  I wonder how many of the major US banks have binding arbitration clauses? I don't claim to know one way or the other, though I thought I heard that one major bank did & it had been standing up in court recently, but I may be mistaken. I also have no idea if they'd hold up in general -- but I'd be curious how many of the T&Cs that you sign have these clauses...
  - TheCoelacanth 9y ago
    Probably all of them. So you would just have to find someone who had never opened a legitimate line of credit, but for whom a fraudulent line of credit had been opened.
hammock 9y ago
Negligence
LambdaComplex 9y ago
"Identity theft" isn't real. It's a term the banks et al. use so that they can have less responsibility. Example: Someone opens a bank account using your information. That's fraud. Someone lied to the bank, and the bank believed them. That's the bank's problem. But by pointing at you and saying "Your identity was stolen" (using the term "stolen" to make it seem like this is similar to the theft of a physical object), it suddenly seems like it's your problem.
- LeifCarrotson 9y ago
  > It's a term the banks et al. use so that they can have less responsibility. I agree that it's misleading, but have to concede that whoever first came up with that term must have been an expert in framing and spin. There are few words that so effectively distort the discussion as "identity theft".
  - romwell 9y ago
    Indeed. When one thinks of "identity theft victims", one doesn't think of a bank. But it is the bank, it should be! When a bank is robbed, its clients aren't the victims. The bank is. The clients aren't giving money to the bank for nothing in return; what they get in return is assurance of safety and availability (otherwise, that would be a loan, not a deposit). Spinning the failure to deliver on that obligation as the client's problem is indeed great PR work.
- pdkl95 9y ago
  Fraud is only half of the "identify theft" reframing. The term also attempts to excuse libel/slander by the credit agency.
losteric 9y ago
Fraud is the one and only word needed. Via https://en.wiktionary.org/wiki/fraud https://en.wiktionary.org/wiki/fraud: The crime of stealing or otherwise illegally obtaining money by use of deception tactics. Legally speaking > Fraud must be proved by showing that the defendant's actions involved five separate elements: > (1) a false statement of a material fact ["I am John Doe"], > (2) knowledge on the part of the defendant that the statement is untrue [they are not John Doe], > (3) intent on the part of the defendant to deceive the alleged victim [they want money], > (4) justifiable reliance by the alleged victim on the statement [bank credit approves access based on identity], and > (5) injury to the alleged victim as a result [bank loses customer money]. (https://legal-dictionary.thefreedictionary.com/fraud https://legal-dictionary.thefreedictionary.com/fraud)
anubisresources 9y ago
Credit fraud. The banks were defrauded, not you.
njarboe 9y ago
I like the term "bank slander"[1]. The company that gave a loan to fraudster (a bank) lies to the credit bureau (slander) and now you have to spend a bunch of time trying (and usually failing) to get those lies off your credit report. [1]previous HN comment - https://news.ycombinator.com/item?id=15657887 https://news.ycombinator.com/item?id=15657887
- overdrivetg 9y ago
  Maybe "credit slander"? Including the added bonus of expanding the set of possible perpetrators.
- jaredandrews 9y ago
  Love this one and I am going to start using it in real life, peace!
dotancohen 9y ago
> Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me. I'll have a stab at coining the new word. The concept is referring to attempted or successful deceit of the bank. Let's take the Latin word for deceit, fraudem, and modernize it so it won't sound so quaint. I think that "fraud" would do.

greenhouse_gas 9y ago

Just curious, how do other countries do it? For example, can I get a loan in Canada online or over the phone (not in person)?

PeterisP 9y ago
The EU practice of shifting the practical risks from the impersonated person to the defrauded lender means that lenders are less eager to accept risks and more careful with verification. Usually, you get loans from your bank - and since you have a preexisting relationship and secure authentication methods, you generally can do it remotely. However, establishing your identity to a new organization usually requires a visit in person and verifying official ID; the lenders who don't require this (e.g. various companies offering small payday loans) have a much higher rate of fraud and thus charge high interest rates to cover those risks. A popular measure that I've seen used is that they require you to wire them 1 cent from the account to which they'll pay out the loan, which can remotely show that you most likely own that account.

adekok 9y ago

> Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen. In France, private credit bureaus don't exist. It's up to banks to track these things. The country seems to work fine.

csa 9y ago
> In France > The country seems to work fine. I hope you realize the joy you have brought to many people's day by writing this. I would pay a large sum of money to see all of the replies that will go unwritten.
- toomanybeersies 9y ago
  I know that everyone loves to laugh at France, but France isn't a bad country. It's hardly a dysfunctional hellhole.
  - yesenadam 9y ago
    Everyone? Only estadounidenses.
maxxxxx 9y ago
In Germany life is also not dominated by the credit agencies like in the US but there is a thing called "Schufa" that does some credit reporting. Not sure how it works though.
- chokma 9y ago
  The Schufa (https://en.wikipedia.org/wiki/Schufa https://en.wikipedia.org/wiki/Schufa ) provides data for their partners/customers on your credit rating and credit score. Banks will usually not give you an account and shops won't give you credit if your rating is bad. For example, you are so late to pay your bills that the creditor has involved collection agencies or the courts to get their money. Landlords will more often than not demand a document from the Schufa (supplied at your own expense) to consider you eligible for renting a flat or a house. edit: grammar

softawre 9y ago

You can freeze your credit to "opt out"

mulmen 9y ago
But then you're opting out of the US financial system as it is available to consumers.
- ams6110 9y ago
  You can unfreeze if you need access to credit.
  - mulmen 9y ago
    At which point you opt back in to the risk. It's not a workable solution.
  - bradstewart 9y ago
    And it costs you $10 per credit agency every time you need it.

chiefofgxbxl 9y ago

It's frustrating enough to see private enterprises using SSN as a form of identification, e.g. getting a lease on my apartment I had to provide my SSN. What's worse is when government agencies themselves use it, knowing full well the number of recent data breaches. I recently went to the DMV in Colorado to obtain a driver's license (since I moved here from another state). They turned me away because I didn't have my physical social security card with me. I did have my U.S. Passport, which has far more security than a blue card with a number printed on the front of it. And sadly the Colorado DMVs will continue using SSN to identify people, even after hearing about the Equifax breach. Honestly, a social security card may as well be a post-it-note with the number written in crayon or finger paint.

Flenser 9y ago

That's exactly what Troy is talking about in the section on KBA (Knowledge Based Authentication) >Knowledge-based authentication (KBA) is predicated on the assumption that an individual holds certain knowledge that can be used to prove their identity. It’s assumed that this knowledge is either private or not broadly known thus if the individual can correctly relay it then, with a high degree of confidence, they can prove their identity. KBA is typically dependent on either static or dynamic “secrets” with the former being the immutable data attributes mentioned earlier (date of birth, mother’s maiden name, etc.) and the latter being mutable such as a password.