5 ms·

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (persona

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order items from web stores to automated pick-up lockers with someone's else's SSN for payment info. The victim usually only becomes aware about this activity when they start getting debt collection notices for unpaid invoices from multiple stores for thousands and thousands of euros. The debt collection process in Finland is famously unfair and harsh towards the supposed "debtor" (here: victim of fraud). Unless the "debtor" (victim) actively opposes each and every individual collection, the cases will eventually end up in court with summary judgement. This will ruin the victim's credit rating, which has devastating results for just about all aspects of life. People are known to have collapsed under the burden of all this and ended up taking their own life. Klarna's response to all this is that they want convenient checkout experience and some fraud is unavoidable. Although there are excellent technical means available to strongly identify users in Finland, they add a minor layer of inconvenience compared to just typing in your SSN. This is OK for Klarna since they give exactly zero fucks about security as long as they can make a little buck from it.

2rsf 5y ago
In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.
- simon1573 5y ago
  Qliro has that too, which I know since somebody bought shoes with my SSN. I don't know if it's a general feature or if you have to contact them, but the functionality is implemented at least.
  - 2rsf 5y ago
    I contacted them and they said no, but they have other "smart" ways to prevent fraud
- tapland 5y ago
  Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases. That makes them double bastard.
  - 2rsf 5y ago
    they do what? how is that even possible? even if I never coupled my account to them?
    - tappio 5y ago
      It is called open banking. Banks are 'anti-competitive' so some people managed to lobby in a directive that forces banks to provide apis for companies like Klarna to access their bank accounts. All you have to do is accept tos.
  - mlonkibjuyhv 5y ago
    They what now? That has to be illegal.
- vesinisa 5y ago
  Wait, so you have to explicitly ask Klarna to not sell stuff under your payment info to random internet strangers? That's not too good either - I think ordering without BankID should be opt-in rather than opt-out.
  - carlhjerpe 5y ago
    I can't remember ever opting in to the Klarna BankID requirement, but when i checked it was enabled on my account.
sly010 5y ago
I am not sure this makes sense. Shouldn't Klarna provide proof of the transaction to the court? Won't the court look at it and throw it out as baseless? If Klarna were actually on the hook for their own money, it wold only have to happen a few times before they realize it's not worth it. edit: definitely not a finnish lawyer
- AdamJacobMuller 5y ago
  > If Klarna were actually on the hook for their own money Aren't they? > it wold only have to happen a few times before they realize it's not worth it That's an assumption. Someone did some A/B testing and said this payment flow results in X% increased sales, resulting in Y% more revenue for Klarna, it results in Z% more fraud. I don't even object to this per-se. If Y is greater than Z, they will do it. If they are especially awful they will consider that of the Z% of fraud it will result in A% still being paid for and B% being recovered in debt collection. That is awful.
  - heavenlyblue 5y ago
    > results in Z% more fraud They would probably not measure fraud but just losses directly.
- vesinisa 5y ago
  Problem is the invoice itself is real. You have to contest it actively to the debt collector and give at least some evidence as to why the debt is invalid. If you do not actively contest the collection, it will soon end up in court. This is a very routine case for a district judge where they will give a default judgement in favor of the plaintiff. The problem is that the law in Finland is written so that even if the collection is baseless the supposed debtor needs to actively manage it or end up in legal jeopardy. Which is rather unfair if you are a victim of identity theft.
  - beagle3 5y ago
    This was probably already common fraud in Finland before Klarna if that’s what the law says - but Klarna would be a crazy force multiplier for the fraudsters and no help for the defrauded, so it becomes a much more pressing issue. (No knowledge of the details, just speculation based on the discussion here)
sneak 5y ago
The actual victim of the fraud is the creditor who was defrauded by the criminal; they are just leveraging the unfair legal system to push the liability onto someone who was not party to the fraud in any way (the person whose name was used in the fraud by the criminal against Klarna). This is the lie of "identity theft". It's not identity theft, it's money/goods fraud, from a bank that didn't do proper authentication.
- tapland 5y ago
  And guess who's their own bank? Klarna \o/
dpatterson2008 5y ago
This reminds me of this BBC article I came across: https://www.bbc.co.uk/news/business-55829879 https://www.bbc.co.uk/news/business-55829879 > To use Klarna's pay later service, which defers payments for up to 30 days, shoppers only have to provide a name, email, date of birth, mobile number and billing address. It’s mind blowing that’s all the information you need to process a payment via Klarna.
- sneak 5y ago
  The benefits of reduced friction in high-trust societies are incredible sometimes. The failure modes are predictable.
avereveard 5y ago
Good to hear, I failed an interview with them at the sixth step or so because I make a point not to remember easily googleable trivia, bet their engineers are traversing rb trees on paper off memory like crazy right now trying to find a solution
pylon 5y ago
This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.
- rjzzleep 5y ago
  The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and yet normal citizen services can't be done with it.
  - ChuckNorris89 5y ago
    >The German version is a clusterfuck ... These gigantic government IT projects are also a good way to funnel taxpayer money to the right pockets, that's why they're always behind schedule and over budget (just like all government physical infrastructure projects) and if you look closely it's always the same 2-3 companies getting all the contracts.
    - rorykoehler 5y ago
      In Singapore they have world class public IT infrastructure and they do it all in house.
    - anoncake 5y ago
      Bullshit. The German electronic ID card wasn't a huge project and it was developed in-house. By all accounts, it works pretty well if you actually have the opportunity to use it. The problem is that nobody supports it. In part because of federalism: You rarely interact with the federal bureaucracy directly and the states for some reason aren't interested in supporting it.
  - deleted 5y ago
    [deleted]

2rsf 5y ago

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

simon1573 5y ago
Qliro has that too, which I know since somebody bought shoes with my SSN. I don't know if it's a general feature or if you have to contact them, but the functionality is implemented at least.
- 2rsf 5y ago
  I contacted them and they said no, but they have other "smart" ways to prevent fraud
tapland 5y ago
Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases. That makes them double bastard.
- 2rsf 5y ago
  they do what? how is that even possible? even if I never coupled my account to them?
  - tappio 5y ago
    It is called open banking. Banks are 'anti-competitive' so some people managed to lobby in a directive that forces banks to provide apis for companies like Klarna to access their bank accounts. All you have to do is accept tos.
- mlonkibjuyhv 5y ago
  They what now? That has to be illegal.
vesinisa 5y ago
Wait, so you have to explicitly ask Klarna to not sell stuff under your payment info to random internet strangers? That's not too good either - I think ordering without BankID should be opt-in rather than opt-out.
- carlhjerpe 5y ago
  I can't remember ever opting in to the Klarna BankID requirement, but when i checked it was enabled on my account.

sly010 5y ago

I am not sure this makes sense. Shouldn't Klarna provide proof of the transaction to the court? Won't the court look at it and throw it out as baseless? If Klarna were actually on the hook for their own money, it wold only have to happen a few times before they realize it's not worth it. edit: definitely not a finnish lawyer

AdamJacobMuller 5y ago
> If Klarna were actually on the hook for their own money Aren't they? > it wold only have to happen a few times before they realize it's not worth it That's an assumption. Someone did some A/B testing and said this payment flow results in X% increased sales, resulting in Y% more revenue for Klarna, it results in Z% more fraud. I don't even object to this per-se. If Y is greater than Z, they will do it. If they are especially awful they will consider that of the Z% of fraud it will result in A% still being paid for and B% being recovered in debt collection. That is awful.
- heavenlyblue 5y ago
  > results in Z% more fraud They would probably not measure fraud but just losses directly.
vesinisa 5y ago
Problem is the invoice itself is real. You have to contest it actively to the debt collector and give at least some evidence as to why the debt is invalid. If you do not actively contest the collection, it will soon end up in court. This is a very routine case for a district judge where they will give a default judgement in favor of the plaintiff. The problem is that the law in Finland is written so that even if the collection is baseless the supposed debtor needs to actively manage it or end up in legal jeopardy. Which is rather unfair if you are a victim of identity theft.
- beagle3 5y ago
  This was probably already common fraud in Finland before Klarna if that’s what the law says - but Klarna would be a crazy force multiplier for the fraudsters and no help for the defrauded, so it becomes a much more pressing issue. (No knowledge of the details, just speculation based on the discussion here)

sneak 5y ago

The actual victim of the fraud is the creditor who was defrauded by the criminal; they are just leveraging the unfair legal system to push the liability onto someone who was not party to the fraud in any way (the person whose name was used in the fraud by the criminal against Klarna). This is the lie of "identity theft". It's not identity theft, it's money/goods fraud, from a bank that didn't do proper authentication.

tapland 5y ago
And guess who's their own bank? Klarna \o/

dpatterson2008 5y ago

This reminds me of this BBC article I came across: https://www.bbc.co.uk/news/business-55829879 https://www.bbc.co.uk/news/business-55829879 > To use Klarna's pay later service, which defers payments for up to 30 days, shoppers only have to provide a name, email, date of birth, mobile number and billing address. It’s mind blowing that’s all the information you need to process a payment via Klarna.

sneak 5y ago
The benefits of reduced friction in high-trust societies are incredible sometimes. The failure modes are predictable.

avereveard 5y ago

Good to hear, I failed an interview with them at the sixth step or so because I make a point not to remember easily googleable trivia, bet their engineers are traversing rb trees on paper off memory like crazy right now trying to find a solution

pylon 5y ago

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.

rjzzleep 5y ago
The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and yet normal citizen services can't be done with it.
- ChuckNorris89 5y ago
  >The German version is a clusterfuck ... These gigantic government IT projects are also a good way to funnel taxpayer money to the right pockets, that's why they're always behind schedule and over budget (just like all government physical infrastructure projects) and if you look closely it's always the same 2-3 companies getting all the contracts.
  - rorykoehler 5y ago
    In Singapore they have world class public IT infrastructure and they do it all in house.
  - anoncake 5y ago
    Bullshit. The German electronic ID card wasn't a huge project and it was developed in-house. By all accounts, it works pretty well if you actually have the opportunity to use it. The problem is that nobody supports it. In part because of federalism: You rarely interact with the federal bureaucracy directly and the states for some reason aren't interested in supporting it.
- deleted 5y ago
  [deleted]