7 ms·

The New ID Theft: Millions of Credit Applicants Who Don’t Exist

30 points by jkuria 9y ago

syntaticSugar 9y ago
Paywall uhhhhhg
- wand3r 9y ago
  non-paywall link http://www.paywallnews.com/life/The-New-ID-Theft--Millions-of-Credit-Applicants-Who-Don’t-Exist.SyCsKEndz.html http://www.paywallnews.com/life/The-New-ID-Theft--Millions-o...
- dang 9y ago
  Please see https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html and https://news.ycombinator.com/item?id=10178989 https://news.ycombinator.com/item?id=10178989 and don't do this here.
neonate 9y ago
http://archive.is/LdEX8 http://archive.is/LdEX8
- amenod 9y ago
  I wish I had an option to blacklist all paywalled sites (from my list only, of course).
deleted 9y ago
[deleted]
thisisit 9y ago
> Mr. Lyles secured credit cards often using fictional names and numbers the Social Security Administration hadn’t yet assigned. So, the credit reporting companies cannot verify if the SSN is real or not? That sounds like the worst identity verification system.
- paulsutter 9y ago
  No it’s actually really Simple to test if an SSN (a) has been issued and (b) is not deceased (had to do it in s project about 20 years ago, there is a file of highest issued numbers and a file of deceased SSNs) So they can verify it. Apparently they don’t which somehow doesn’t surprise me at all
  - FireBeyond 9y ago
    Yeah, it's always a lot of fun for me actually convincing banks they're allowed to open accounts for me, when I was born 40 years ago but my SSN was "issued 12 years ago"...
- avs733 9y ago
  There job seems to mostly be to grab information so they can centralize it and make it easy to steal/sell/put at risk. Unless someone can demonstrate that their data is bad at scale, which would likely be very difficult when all of the risk calculations are probablistic anyways, I don't think they have a huge actual incentive to verify shit do they? Their customers already trust them, the trust is basically implicit, does anyone actually check what they do?
- TehCorwiz 9y ago
  SSNs aren't supposed to be used for identification. That said the Social Security Administration does have a site that allows for validating SSNs. It appears to be geared toward employers verifying SSNs for employment (and therefor tax purposes), the terms may preclude using it for credit reporting purposes. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm The root problem here is that they're using a public number which was never designed for identification purposes and has no security. The solution would be a national ID, or expansion of the US Passport with in-built security measures. Although that goes over like a lead balloon whenever it's brought up.
  - conanbatt 9y ago
    > Although that goes over like a lead balloon whenever it's brought up. Coming with a country that has a national ID, the US issue with it always caused me laughter. But on the other hand, identification by the state is one of the highest forms of privacy. Its pretty incredible the US has managed to be without that.
zellyn 9y ago
Open question for hacker news denizens: why don't the three main credit bureaus let you register your SSN, and get alerts in an app whenever someone tries to take out a loan? I'd sign up for that in a heartbeat. Hit me up with the unintended downsides :-)
- toomuchtodo 9y ago
  Credit Karma does this for free. https://www.creditkarma.com/credit-monitoring https://www.creditkarma.com/credit-monitoring
  - s73v3r_ 9y ago
    They sell your data so they can sell you loans and credit cards, though.
    - toomuchtodo 9y ago
      My understanding is they don’t sell your data, but they do use it to recommend you financial products they make a commission from. I’m happy to be proven wrong.
      - theandrewbailey 9y ago
        That's what "selling your data" means anymore.
        deleted 9y ago
        [deleted]
        namibj 9y ago
        No, as long as they do not give it out to third parties. It is the same way Facebook does not sell your data, yet makes money from it.
        9y ago
mnm1 9y ago
I commend the people doing this. Credit card companies and banks have been pushing the burden of identity theft onto the consumer for way too long, a burden that clearly is the bank's fault in every single case. Maybe now they'll start to take fraud seriously. I hope more shadow id theft happens until the banks start doing their duty and protecting customers. The more money they lose, the better it is for everyone else. Thank you, synthetic id "thieves."
- Arubis 9y ago
  Agreed. Further, I hold onto some hope that there’s still a window to change the public discourse around the terminology. There should be no such thing as “identity theft”, as that pushes the burden of the actual crime (defrauding creditors) onto a non-acting third party. It is creditor’s responsibility to verify the safety of their investments.
- empath75 9y ago
  You should be able to sue banks if they fraudulently extend credit to someone else in your name. It's not your fault that their identity verification methods are terrible.
  - mnm1 9y ago
    How is this not already possible?
reaperducer 9y ago
I'm surprised that this is seemingly a new phenomenon. The article states that it really picked up in 2012. I remember there was a program for the Commodore 64 that would pull random information from a data array to create fake identities, complete with addresses and ZIP codes.
naftaliharris 9y ago
Two super interesting things about this kind of fraud which make it especially tricky to catch and deal with: 1. Unlike with ID theft, there's no consumer victim. With ID theft, eventually the victim will find out about it, (by getting a call from a collections agent or seeing the trade on their credit report). They'll then contact the lender or the bureau, and contest the validity of the loan. The end result is that the lender gets a stream of loans that are labeled as identity theft losses. Since there's no consumer victim with synthetic fraud, though, lenders don't get this stream of labeled data and have a hard time knowing which of their losses are synthetic fraud (and which are just ordinary credit losses). 2. Synthetic fraud cuts right through typical ID theft prevention systems. ID theft prevention is about checking whether the applicant is the same as the identity they're using to apply for credit. So you check if the email the applicant uses matches the identity, (e.g. don't want john.doe@gmail.com used as the email for Jane Smith), you check the phone number, you check if the applicant can complete KBA (knowledge based authentication, e.g. questions about previous addresses), you check the billing address, and so forth. But synthetic identities have their own aged phone numbers, emails, addresses, and credit histories, and so all of these verifications go through without any flags raised. Essentially the ID theft prevention system was checking whether the applicant is the same as the identity that they're using, but with synthetic fraud the applicant created the identity. Source: my startup focuses heavily on preventing synthetic fraud for lenders, (PM me for details).
- bb88 9y ago
  I know you're not asking for my advice, but you're pushing the dirt around here. You're not solving the problem of ID Theft, you're just making it more likely that the criminals who are going to do it are going to use it are going to use ID's of real people. Congrats and all for figuring it out how to do it, and for developing a market around it. But to me, encouraging banks to continue to make loans with just a web site or app seems like a really bad idea. Edited to add: Data is not a person. A person is a person.

30 points by jkuria 9y ago

syntaticSugar 9y ago

Paywall uhhhhhg

wand3r 9y ago
non-paywall link http://www.paywallnews.com/life/The-New-ID-Theft--Millions-of-Credit-Applicants-Who-Don’t-Exist.SyCsKEndz.html http://www.paywallnews.com/life/The-New-ID-Theft--Millions-o...
dang 9y ago
Please see https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html and https://news.ycombinator.com/item?id=10178989 https://news.ycombinator.com/item?id=10178989 and don't do this here.

neonate 9y ago

http://archive.is/LdEX8 http://archive.is/LdEX8

amenod 9y ago
I wish I had an option to blacklist all paywalled sites (from my list only, of course).

deleted 9y ago

[deleted]

thisisit 9y ago

> Mr. Lyles secured credit cards often using fictional names and numbers the Social Security Administration hadn’t yet assigned. So, the credit reporting companies cannot verify if the SSN is real or not? That sounds like the worst identity verification system.

paulsutter 9y ago
No it’s actually really Simple to test if an SSN (a) has been issued and (b) is not deceased (had to do it in s project about 20 years ago, there is a file of highest issued numbers and a file of deceased SSNs) So they can verify it. Apparently they don’t which somehow doesn’t surprise me at all
- FireBeyond 9y ago
  Yeah, it's always a lot of fun for me actually convincing banks they're allowed to open accounts for me, when I was born 40 years ago but my SSN was "issued 12 years ago"...
avs733 9y ago
There job seems to mostly be to grab information so they can centralize it and make it easy to steal/sell/put at risk. Unless someone can demonstrate that their data is bad at scale, which would likely be very difficult when all of the risk calculations are probablistic anyways, I don't think they have a huge actual incentive to verify shit do they? Their customers already trust them, the trust is basically implicit, does anyone actually check what they do?
TehCorwiz 9y ago
SSNs aren't supposed to be used for identification. That said the Social Security Administration does have a site that allows for validating SSNs. It appears to be geared toward employers verifying SSNs for employment (and therefor tax purposes), the terms may preclude using it for credit reporting purposes. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm The root problem here is that they're using a public number which was never designed for identification purposes and has no security. The solution would be a national ID, or expansion of the US Passport with in-built security measures. Although that goes over like a lead balloon whenever it's brought up.
- conanbatt 9y ago
  > Although that goes over like a lead balloon whenever it's brought up. Coming with a country that has a national ID, the US issue with it always caused me laughter. But on the other hand, identification by the state is one of the highest forms of privacy. Its pretty incredible the US has managed to be without that.

zellyn 9y ago

Open question for hacker news denizens: why don't the three main credit bureaus let you register your SSN, and get alerts in an app whenever someone tries to take out a loan? I'd sign up for that in a heartbeat. Hit me up with the unintended downsides :-)

toomuchtodo 9y ago
Credit Karma does this for free. https://www.creditkarma.com/credit-monitoring https://www.creditkarma.com/credit-monitoring
- s73v3r_ 9y ago
  They sell your data so they can sell you loans and credit cards, though.
  - toomuchtodo 9y ago
    My understanding is they don’t sell your data, but they do use it to recommend you financial products they make a commission from. I’m happy to be proven wrong.
    - theandrewbailey 9y ago
      That's what "selling your data" means anymore.
      - deleted 9y ago
        [deleted]
      - namibj 9y ago
        No, as long as they do not give it out to third parties. It is the same way Facebook does not sell your data, yet makes money from it.
        9y ago

mnm1 9y ago

I commend the people doing this. Credit card companies and banks have been pushing the burden of identity theft onto the consumer for way too long, a burden that clearly is the bank's fault in every single case. Maybe now they'll start to take fraud seriously. I hope more shadow id theft happens until the banks start doing their duty and protecting customers. The more money they lose, the better it is for everyone else. Thank you, synthetic id "thieves."

Arubis 9y ago
Agreed. Further, I hold onto some hope that there’s still a window to change the public discourse around the terminology. There should be no such thing as “identity theft”, as that pushes the burden of the actual crime (defrauding creditors) onto a non-acting third party. It is creditor’s responsibility to verify the safety of their investments.
empath75 9y ago
You should be able to sue banks if they fraudulently extend credit to someone else in your name. It's not your fault that their identity verification methods are terrible.
- mnm1 9y ago
  How is this not already possible?

reaperducer 9y ago

I'm surprised that this is seemingly a new phenomenon. The article states that it really picked up in 2012. I remember there was a program for the Commodore 64 that would pull random information from a data array to create fake identities, complete with addresses and ZIP codes.

naftaliharris 9y ago

Two super interesting things about this kind of fraud which make it especially tricky to catch and deal with: 1. Unlike with ID theft, there's no consumer victim. With ID theft, eventually the victim will find out about it, (by getting a call from a collections agent or seeing the trade on their credit report). They'll then contact the lender or the bureau, and contest the validity of the loan. The end result is that the lender gets a stream of loans that are labeled as identity theft losses. Since there's no consumer victim with synthetic fraud, though, lenders don't get this stream of labeled data and have a hard time knowing which of their losses are synthetic fraud (and which are just ordinary credit losses). 2. Synthetic fraud cuts right through typical ID theft prevention systems. ID theft prevention is about checking whether the applicant is the same as the identity they're using to apply for credit. So you check if the email the applicant uses matches the identity, (e.g. don't want john.doe@gmail.com used as the email for Jane Smith), you check the phone number, you check if the applicant can complete KBA (knowledge based authentication, e.g. questions about previous addresses), you check the billing address, and so forth. But synthetic identities have their own aged phone numbers, emails, addresses, and credit histories, and so all of these verifications go through without any flags raised. Essentially the ID theft prevention system was checking whether the applicant is the same as the identity that they're using, but with synthetic fraud the applicant created the identity. Source: my startup focuses heavily on preventing synthetic fraud for lenders, (PM me for details).

bb88 9y ago
I know you're not asking for my advice, but you're pushing the dirt around here. You're not solving the problem of ID Theft, you're just making it more likely that the criminals who are going to do it are going to use it are going to use ID's of real people. Congrats and all for figuring it out how to do it, and for developing a market around it. But to me, encouraging banks to continue to make loans with just a web site or app seems like a really bad idea. Edited to add: Data is not a person. A person is a person.