3 ms·
> One challenge with phishing is that virtually all the "best practice" pieces written by the press still follow this Atlantic article's "blame the user" approa
by CM30 8y ago
> One challenge with phishing is that virtually all the "best practice" pieces written by the press still follow this Atlantic article's "blame the user" approach to phishing prevention. I.e., train your end users to not click on stuff in bad emails.
This is the same problem most pieces of advice for avoiding fraud and financial crimes have. Identity theft shouldn't be blamed on the victims' 'carelessness', because at the end of the day, it's the banks/credit card company/whoever that screwed up and let someone access their money that they shouldn't have.
The solution to most financial crimes and fraud isn't to 'train the customer to avoid the bad guys', since the bad guys are getting more sophisticated all the time and people can't be vigilante 24/7. The solution is to fix the underlying systems and procedures at the companies involved so criminals can't exploit their systems in the way they can right now.
- njarboe 8y agoExactly. What people fear is not "identity theft" but bank libel. I could care less if a fraudster borrows money from a bank using my social security number and other public information. That is the banks problem when they try and collect the money. The problem is when the bank libels me by writing to a credit bureau and tells them that I have defaulted on a loan. If this libel was a large crime and prosecuted vigorously, "identity theft" would go away.
- oh_sigh 8y agoAre banks saying that you yourself defaulted, or just that the given identity defaulted? Whether you as a person defaulted, or your identity was stolen and someone else defaulted with it, there is still increased risk from the baseline that your identity will default.
- njarboe 8y agoI would be interested in knowing if this is how the banks get around the libel problem. New laws should be enacted preventing that, if that is the case.
- oh_sigh 8y agoFor one thing, what I said above. For another, it is impossible to libel someone by one private party telling another private party information. Being published is a necessary condition of libel.
- mmt 8y agoA credit reporting agency seems very much like a publisher. They receive statements from some parties and distribute them (usually more widely) to other parties.
- njarboe 8y agoIf a credit bureau creating documents for others to use for various reasons in not publishing then Congress needs to pass a law declaring it is publishing or make a law that what the banks do to people when reporting false statements to the credit bureaus is a crime. Do you think that a creditor that reports a false statement that a person defaulted on a loan is not wrong and should not be penalized? Its great for the people that loan money but not how any reasonable person would think the world should work.
- gowld 8y agoA few bits of information about me is not my identity.
- marmot777 8y agoEnough of your identity to have a wild night out in Boise on your dime.
- marmot777 8y agoYou'd still have a hell of a hassle on your hands cleaning up the mess and protecting your credit score, etc., right?
- njarboe 8y agoIf the banks were heavily penalized for giving wrong info to the credit bureaus, the number of people having this problem of "identity theft" would plummet. If, while cleaning up your credit score you could also get a $10,000 judgment from the bank that libeled you, maybe you don't feel so shitty about the hassle the bank has put you through.
- marmot777 8y agoAre they heavily penalized for giving wrong info to credit bureaus? Or perhaps it's not a big problem as banks have the drill down with regard to identiy theft's aftermath?
- marmot777 8y agoWho pays the costs of phishing? Is it mostly individuals or do corporations feel the pinch? Your analyses gets at the root causes, the bug fix that woukd stop the trouble tickets. Are the incentives there or the political will? It’s big. You’re getting into major league ball level public policy when banking regulations are involved. The problem must not yet be painful enough to drive the politics but maybe that day will arrive sooner or later. While this could stop the most lucrative form of phishing, it woukd still leave the other forms of phishing. And as @badrabbit mentioned there are other types of phishing (e.g., Malware delivery).