5 ms·

> should someone become a victim of identity theft The only reason identity theft is a thing is because federal law[1] doesn't allow consumers to sue creditors

by u801e 5y ago

> should someone become a victim of identity theft The only reason identity theft is a thing is because federal law[1] doesn't allow consumers to sue creditors or credit bureaus for inaccurate information about the consumer unless they were doing it out of malice. If the law was changed to allow consumers to sue them for damages, you can bet that they will be far more diligent in verifying the identity of the person they're entering into a contract with. [1] https://www.law.cornell.edu/uscode/text/15/1681h https://www.law.cornell.edu/uscode/text/15/1681h (e)

judge2020 5y ago
Sure, but the problem stems from a malicious actor fraudulently saying they're someone else and having the same info to back that up as the person themselves would, kind of like credential stuffing attacks on websites. Short of doing some sort of facial recognition (like id.me's selfies[0] perhaps), if someone knows your SSN and where you lived as a child, how do credit bureaus verify identity? 0: https://help.id.me/hc/en-us/articles/360061369314-How-do-I-take-and-submit-a-selfie- https://help.id.me/hc/en-us/articles/360061369314-How-do-I-t...
- toomuchtodo 5y ago
  This is the point of national IDs, trust anchors, identity proofing, etc. Credit reporting agencies and financial service providers should be required to use a government provided identity provider (Login.gov is getting there; it’s currently only offering identity services to federal agencies and select state and local governments) or in person proofing with government IDs to verify identity. If they don’t, they are entirely liable for the transaction(s) and related losses, instead of rolling the dice with security question voodoo and foisting the liability on consumers. Solve digital identity and you solve identity fraud.
  - zo1 5y ago
    It's hard and there is a lot of weird pushback against national ID cards. E.g. In the UK they had it and then abolished it after public backlash. To me it's utterly backwards to not have one and then point the finger at banks as if they can have a magical investigation and "due diligence" department that can solve fraud and figure out who is who.
    - u801e 5y ago
      Retail stores in the US are required to verify the age of those purchasing tobacco products and alcoholic beverages. They typically limit the types of identification they accept and they could lose their license to sell those products if they sell to those who are under age. There's absolutely no reason why banks can't do something similar (actually more stringent) when extending a line of credit. The PATRIOT act in the US requires banks to verify the identity of those trying to open an account or secure a mortgage loan, so requiring something similar for lines of credit shouldn't be out of the question. The root cause of the issue is the law I referenced in the comment[1] that started this subthread. If consumers were able to sue banks and credit bureaus for false information, then banks would have much more incentive to be more diligent. Right now, they can offer "identify theft protection" service where the consumer has to pay them instead. That doesn't give them incentive to be more diligent, and, quite possibly, has the opposite effect. [1] https://news.ycombinator.com/item?id=28194787 https://news.ycombinator.com/item?id=28194787
      - 542354234235 5y ago
        >Right now, they can offer "identify theft protection" service where the consumer has to pay them instead. That doesn't give them incentive to be more diligent, and, quite possibly, has the opposite effect. That's just good vertical integration.
- u801e 5y ago
  Just knowing the SSN and their address shouldn't be considered sufficient to verify someone's identity. Banks could easily require one to show multiple forms of identification in person at one of their branches in order to apply for credit.
  - zo1 5y ago
    And then the identity thieves will just have to fake those. What's next, calling your landlord for a reference and asking them to send a photo of you to check that it matches the photo you submitted? The goal posts are guaranteed to move.
    - u801e 5y ago
      With passports and real id standard driver's licenses along with other photo ID, I imagine it would be a lot more difficult for a fraudster to open a line of credit in someone else's name in person as easily as they could do now.
    - 542354234235 5y ago
      >And then the identity thieves will just have to fake those. Are you really just handwaving being able to make fake passports or fake government issued identification cards, as if that is basically the same as just knowing someone’s SSN and a couple other pieces of information about them? What a ridiculous argument. ID cards are required to have multiple security features to prevent reproduction without highly specialized equipment, to prevent altering or tampering with existing cards, and to have multiple ways of detecting counterfeiting or altering of cards. There is no “what’s next” because identification cards are already incredibly secure.
      - zo1 5y ago
        No, I am a big advocate of offloading the security/verification to the government. I.e. National ID Cards, which are definitely hard to fake and I agree with you fully. The person I was responding to mentioned "multiple forms of identification". At the moment (and I could be wrong) some of these valid forms of identification are things that can be bootstrapped, faked or social-engineered into getting relatively easily. E.g. municipal bills, driver's licenses, birth certificates issued from hospitals, etc. (e.g. look at here for UK https://www.hsbc.co.uk/help/banking-made-easy/help-us-identify-you/ https://www.hsbc.co.uk/help/banking-made-easy/help-us-identi... ). Once you get one of those, you can with effort start acquiring more and more of those other ones. And they would all be 100% legitimate and not fake, which is the crux of the "identity theft" problem, as you can't prove who you are even with real documents as the other person has real ones too! I guess I used the term "fake" in my original response a bit loosely. Point is, we're skirting around the real issue. We have no "chain of proof" or "evidence" from the time you were born to the point in time that you have to start using your identity for formal things. It's all based on layers and layers of multiple people, possibly incorrectly, "vouching" for you by saying you are who you say you are. Even with secure identification cards, there is still a huge potential for fraud which happens a lot even in countries that have national ID cards. E.g. https://www.timeslive.co.za/news/south-africa/2020-08-28-home-affairs-official-arrested-for-selling-birth-certificates/ https://www.timeslive.co.za/news/south-africa/2020-08-28-hom...

by u801e 5y ago

judge2020 5y ago

Sure, but the problem stems from a malicious actor fraudulently saying they're someone else and having the same info to back that up as the person themselves would, kind of like credential stuffing attacks on websites. Short of doing some sort of facial recognition (like id.me's selfies[0] perhaps), if someone knows your SSN and where you lived as a child, how do credit bureaus verify identity? 0: https://help.id.me/hc/en-us/articles/360061369314-How-do-I-take-and-submit-a-selfie- https://help.id.me/hc/en-us/articles/360061369314-How-do-I-t...

toomuchtodo 5y ago
This is the point of national IDs, trust anchors, identity proofing, etc. Credit reporting agencies and financial service providers should be required to use a government provided identity provider (Login.gov is getting there; it’s currently only offering identity services to federal agencies and select state and local governments) or in person proofing with government IDs to verify identity. If they don’t, they are entirely liable for the transaction(s) and related losses, instead of rolling the dice with security question voodoo and foisting the liability on consumers. Solve digital identity and you solve identity fraud.
- zo1 5y ago
  It's hard and there is a lot of weird pushback against national ID cards. E.g. In the UK they had it and then abolished it after public backlash. To me it's utterly backwards to not have one and then point the finger at banks as if they can have a magical investigation and "due diligence" department that can solve fraud and figure out who is who.
  - u801e 5y ago
    Retail stores in the US are required to verify the age of those purchasing tobacco products and alcoholic beverages. They typically limit the types of identification they accept and they could lose their license to sell those products if they sell to those who are under age. There's absolutely no reason why banks can't do something similar (actually more stringent) when extending a line of credit. The PATRIOT act in the US requires banks to verify the identity of those trying to open an account or secure a mortgage loan, so requiring something similar for lines of credit shouldn't be out of the question. The root cause of the issue is the law I referenced in the comment[1] that started this subthread. If consumers were able to sue banks and credit bureaus for false information, then banks would have much more incentive to be more diligent. Right now, they can offer "identify theft protection" service where the consumer has to pay them instead. That doesn't give them incentive to be more diligent, and, quite possibly, has the opposite effect. [1] https://news.ycombinator.com/item?id=28194787 https://news.ycombinator.com/item?id=28194787
    - 542354234235 5y ago
      >Right now, they can offer "identify theft protection" service where the consumer has to pay them instead. That doesn't give them incentive to be more diligent, and, quite possibly, has the opposite effect. That's just good vertical integration.
u801e 5y ago
Just knowing the SSN and their address shouldn't be considered sufficient to verify someone's identity. Banks could easily require one to show multiple forms of identification in person at one of their branches in order to apply for credit.
- zo1 5y ago
  And then the identity thieves will just have to fake those. What's next, calling your landlord for a reference and asking them to send a photo of you to check that it matches the photo you submitted? The goal posts are guaranteed to move.
  - u801e 5y ago
    With passports and real id standard driver's licenses along with other photo ID, I imagine it would be a lot more difficult for a fraudster to open a line of credit in someone else's name in person as easily as they could do now.
  - 542354234235 5y ago
    >And then the identity thieves will just have to fake those. Are you really just handwaving being able to make fake passports or fake government issued identification cards, as if that is basically the same as just knowing someone’s SSN and a couple other pieces of information about them? What a ridiculous argument. ID cards are required to have multiple security features to prevent reproduction without highly specialized equipment, to prevent altering or tampering with existing cards, and to have multiple ways of detecting counterfeiting or altering of cards. There is no “what’s next” because identification cards are already incredibly secure.
    - zo1 5y ago
      No, I am a big advocate of offloading the security/verification to the government. I.e. National ID Cards, which are definitely hard to fake and I agree with you fully. The person I was responding to mentioned "multiple forms of identification". At the moment (and I could be wrong) some of these valid forms of identification are things that can be bootstrapped, faked or social-engineered into getting relatively easily. E.g. municipal bills, driver's licenses, birth certificates issued from hospitals, etc. (e.g. look at here for UK https://www.hsbc.co.uk/help/banking-made-easy/help-us-identify-you/ https://www.hsbc.co.uk/help/banking-made-easy/help-us-identi... ). Once you get one of those, you can with effort start acquiring more and more of those other ones. And they would all be 100% legitimate and not fake, which is the crux of the "identity theft" problem, as you can't prove who you are even with real documents as the other person has real ones too! I guess I used the term "fake" in my original response a bit loosely. Point is, we're skirting around the real issue. We have no "chain of proof" or "evidence" from the time you were born to the point in time that you have to start using your identity for formal things. It's all based on layers and layers of multiple people, possibly incorrectly, "vouching" for you by saying you are who you say you are. Even with secure identification cards, there is still a huge potential for fraud which happens a lot even in countries that have national ID cards. E.g. https://www.timeslive.co.za/news/south-africa/2020-08-28-home-affairs-official-arrested-for-selling-birth-certificates/ https://www.timeslive.co.za/news/south-africa/2020-08-28-hom...