6 ms·

> Mr. Lyles secured credit cards often using fictional names and numbers the Social Security Administration hadn’t yet assigned. So, the credit reporting compa

> Mr. Lyles secured credit cards often using fictional names and numbers the Social Security Administration hadn’t yet assigned. So, the credit reporting companies cannot verify if the SSN is real or not? That sounds like the worst identity verification system.

paulsutter 9y ago
No it’s actually really Simple to test if an SSN (a) has been issued and (b) is not deceased (had to do it in s project about 20 years ago, there is a file of highest issued numbers and a file of deceased SSNs) So they can verify it. Apparently they don’t which somehow doesn’t surprise me at all
- FireBeyond 9y ago
  Yeah, it's always a lot of fun for me actually convincing banks they're allowed to open accounts for me, when I was born 40 years ago but my SSN was "issued 12 years ago"...
avs733 9y ago
There job seems to mostly be to grab information so they can centralize it and make it easy to steal/sell/put at risk. Unless someone can demonstrate that their data is bad at scale, which would likely be very difficult when all of the risk calculations are probablistic anyways, I don't think they have a huge actual incentive to verify shit do they? Their customers already trust them, the trust is basically implicit, does anyone actually check what they do?
TehCorwiz 9y ago
SSNs aren't supposed to be used for identification. That said the Social Security Administration does have a site that allows for validating SSNs. It appears to be geared toward employers verifying SSNs for employment (and therefor tax purposes), the terms may preclude using it for credit reporting purposes. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm The root problem here is that they're using a public number which was never designed for identification purposes and has no security. The solution would be a national ID, or expansion of the US Passport with in-built security measures. Although that goes over like a lead balloon whenever it's brought up.
- conanbatt 9y ago
  > Although that goes over like a lead balloon whenever it's brought up. Coming with a country that has a national ID, the US issue with it always caused me laughter. But on the other hand, identification by the state is one of the highest forms of privacy. Its pretty incredible the US has managed to be without that.
  - reaperducer 9y ago
    Do you also laugh at the EU's "right to be forgotten" legislation?
    - conanbatt 9y ago
      I think its trying to stop sunlight with your hands.
      - toomuchtodo 9y ago
        Technology is the servant of society, not the other way around. The sky is not falling because the tech industry is finally being reined in. [+] https://news.ycombinator.com/item?id=16531817 https://news.ycombinator.com/item?id=16531817 | [+] http://locusmag.com/2018/03/cory-doctorow-lets-get-better-at-demanding-better-from-tech/ http://locusmag.com/2018/03/cory-doctorow-lets-get-better-at...
        conanbatt 9y ago
        Wouldn't the analogy be that we are the servants to the state, as the state tells you what you can or can't do?
        toomuchtodo 9y ago
        No, because we have the right to vote, making the state the servant to us. Whether we have properly executed that responsibility is clearly a discussion for a different thread.
tialaramex 9y ago
I work for a Credit Reference Agency (but I am not speaking for them here). Just because the CRA says "We have no record of this person" doesn't (and shouldn't) mean they don't exist. It's up to the card issuer whether "the customer might not even exist" is a risk they are up for taking.
jstarfish 9y ago
You're overstating the role of the CRA. They don't provide facts, they provide intelligence and let the recipient draw their own conclusions. FWIW there is a boolean "deceased" flag on credit reports (internally). I don't know by what means or how often it gets updated. They get a lot of denormalized data. Just because an SSN:name pair presented to them isn't legit doesn't mean there isn't a real person associated with it. There's a limit to the accuracy of credit reporting given the nature of their inputs. 123-45-6789 for Janice Smith, 123-45-6789 for Jane Smith and 123-46-6789 for Janice Deer are all the same person, but there's value in maintaining even the inconsistencies-- when an inquiry comes in at 123-46-6789 for Tran Nguyen, it's obvious something is up with one of the two parties, but without further investigation we don't know if it's a typo or fraud. Then the manual review process starts. Entity resolution is a very complex problem to do correctly at scale. Phone numbers and addresses are shared across entities over time and can be typoed. Social security numbers can be typed incorrectly, or the name (and nowadays, gender!) associated with them changes freely. For all we know Tran and Jane are the same person; there are circumstances that have led to such oddness. Foreign passports or IDs may not match up to anything seen before, and they can't exactly hit a Romanian government API to validate numbers presented, yet they can't deny the existence of an applicant based on metrics they don't know about-- they can only share what they know.

paulsutter 9y ago

No it’s actually really Simple to test if an SSN (a) has been issued and (b) is not deceased (had to do it in s project about 20 years ago, there is a file of highest issued numbers and a file of deceased SSNs) So they can verify it. Apparently they don’t which somehow doesn’t surprise me at all

FireBeyond 9y ago
Yeah, it's always a lot of fun for me actually convincing banks they're allowed to open accounts for me, when I was born 40 years ago but my SSN was "issued 12 years ago"...

avs733 9y ago

There job seems to mostly be to grab information so they can centralize it and make it easy to steal/sell/put at risk. Unless someone can demonstrate that their data is bad at scale, which would likely be very difficult when all of the risk calculations are probablistic anyways, I don't think they have a huge actual incentive to verify shit do they? Their customers already trust them, the trust is basically implicit, does anyone actually check what they do?

TehCorwiz 9y ago

SSNs aren't supposed to be used for identification. That said the Social Security Administration does have a site that allows for validating SSNs. It appears to be geared toward employers verifying SSNs for employment (and therefor tax purposes), the terms may preclude using it for credit reporting purposes. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm The root problem here is that they're using a public number which was never designed for identification purposes and has no security. The solution would be a national ID, or expansion of the US Passport with in-built security measures. Although that goes over like a lead balloon whenever it's brought up.

conanbatt 9y ago
> Although that goes over like a lead balloon whenever it's brought up. Coming with a country that has a national ID, the US issue with it always caused me laughter. But on the other hand, identification by the state is one of the highest forms of privacy. Its pretty incredible the US has managed to be without that.
- reaperducer 9y ago
  Do you also laugh at the EU's "right to be forgotten" legislation?
  - conanbatt 9y ago
    I think its trying to stop sunlight with your hands.
    - toomuchtodo 9y ago
      Technology is the servant of society, not the other way around. The sky is not falling because the tech industry is finally being reined in. [+] https://news.ycombinator.com/item?id=16531817 https://news.ycombinator.com/item?id=16531817 | [+] http://locusmag.com/2018/03/cory-doctorow-lets-get-better-at-demanding-better-from-tech/ http://locusmag.com/2018/03/cory-doctorow-lets-get-better-at...
      - conanbatt 9y ago
        Wouldn't the analogy be that we are the servants to the state, as the state tells you what you can or can't do?
        toomuchtodo 9y ago
        No, because we have the right to vote, making the state the servant to us. Whether we have properly executed that responsibility is clearly a discussion for a different thread.

tialaramex 9y ago

I work for a Credit Reference Agency (but I am not speaking for them here). Just because the CRA says "We have no record of this person" doesn't (and shouldn't) mean they don't exist. It's up to the card issuer whether "the customer might not even exist" is a risk they are up for taking.

jstarfish 9y ago

You're overstating the role of the CRA. They don't provide facts, they provide intelligence and let the recipient draw their own conclusions. FWIW there is a boolean "deceased" flag on credit reports (internally). I don't know by what means or how often it gets updated. They get a lot of denormalized data. Just because an SSN:name pair presented to them isn't legit doesn't mean there isn't a real person associated with it. There's a limit to the accuracy of credit reporting given the nature of their inputs. 123-45-6789 for Janice Smith, 123-45-6789 for Jane Smith and 123-46-6789 for Janice Deer are all the same person, but there's value in maintaining even the inconsistencies-- when an inquiry comes in at 123-46-6789 for Tran Nguyen, it's obvious something is up with one of the two parties, but without further investigation we don't know if it's a typo or fraud. Then the manual review process starts. Entity resolution is a very complex problem to do correctly at scale. Phone numbers and addresses are shared across entities over time and can be typoed. Social security numbers can be typed incorrectly, or the name (and nowadays, gender!) associated with them changes freely. For all we know Tran and Jane are the same person; there are circumstances that have led to such oddness. Foreign passports or IDs may not match up to anything seen before, and they can't exactly hit a Romanian government API to validate numbers presented, yet they can't deny the existence of an applicant based on metrics they don't know about-- they can only share what they know.