5 ms·
But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB,
by DebtDeflation 7y ago
But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.
- ravenstine 7y ago> one time use "credit card numbers" generated at the time of the transaction PayPal used to have that feature but got rid of it for some reason.
- bifrost 7y agoAMEX did too, I think the problem is the keyspace is small enough that it would be a serious problem.
- beamatronic 7y agoDiscover had that for a while, many years ago.
- u801e 7y agoCapital One still has this feature for online transactions.
- Consultant32452 7y agoGoogle Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.
- Gibbon1 7y agoIf the healthcare industry used medical id numbers instead of SSN's that would help. Better banks should be forced to stop using SSN's completely. And forced to use 2factor. Preferably both.
- nkrisc 7y agoAnd this is a function of power asymmetry. Why is it my problem that a bank issued a credit card to some guy in Romania or Russia who said they were me? It should be their problem unless they can prove it was me who opened the account. But they make it my problem through the enormous power they wield over our ability to participate in society. If they come looking for the money I supposedly owe them on that account, I should be able to tell them to fuck off and collect from whoever they sent the card to of their own volition. If they can't figure out whose business they took, maybe they need to reconsider their practices, otherwise they're just giving away money.
- burfog 7y agoWe're not solving this unless we can teach all people, even newborns and coma patients, to do 8192-bit RSA in their heads and to generate and remember suitable private keys all in their heads. We're not solving this.