7 ms·

That's one way of looking at it, the other is that the financial system itself begins to fail under the volume and price of fraud. Ransomware ransoms have incr

That's one way of looking at it, the other is that the financial system itself begins to fail under the volume and price of fraud. Ransomware ransoms have increased massively. They were often a few thousand dollars only a few years ago, now often hear about $50m+. On the smaller scale SMS/email phishing has got absolutely enormous too in volumes. Banks and credit card providers are refunding 100s of millions (if not more) in fraud, in actually a very low margin business (retail banking). It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow.

nerdponx 5y ago
Good! Maybe then the government will actually start to care once the lobbyists start to ask for help. The downside is that the "help" will probably just consist of funneling more taxpayer money to large shareholders and execs, while banks figure out ways to dodge liability without actually solving the problem.
- vosper 5y ago
  Is the government required here [0]? Could commercial operators not improve their own security through their own investment and taking it seriously? If ransomware hits them in the chequebook where stolen customer data didn't, then they might find that quite motivating? [0] It obviously is for government departments.
  - tialaramex 5y ago
    The government is the final arbiter in a bunch of cases you care about. Whether you are (for example) a US citizen is not a decision for T-Mobile, or Amazon, or Walmart, or Delta, that's up to the US government† The government (and not private corporations) tracks births, deaths, immigration, emigration, and of course it chooses to issue identity paperwork. In general the closest commercial entities like banks can do is identity matching. So e.g. maybe Bank A asks you "Hey, do you have, like, a mortgage? Who with?" and you pick Bank X from the list of six options and OK, either that's a lucky guess or you know that "you" have a mortgage with Bank X. This is pretty poor, it's something, but it's not very much, it's up there with Facebook's "Here are some pictures of people, which of them is your friend?" which of course falls down when either: You "friend" people you don't actually know and wouldn't recognise; or your "friends" don't like Facebook having accurate photo data and intentionally mislabel random other people or things with their name... And as with the Facebook thing it breaks in surprising and hard to reproduce/ demonstrate ways. Maybe you think of this as your Big Bank mortgage, but if you check the small print it's actually a Different Bank mortgage, that Big Bank are re-branding, and so you just picked wrong. So yes, in practice government is where this would get solved, if you've any appetite for solving it.
- toomuchtodo 5y ago
  Different parts of government. Legislators, specially, need to care about digital identity. They don’t care enough (see below copy pasta, rest of the FCW piece talks about how identity legislation has been punted to fall Congressional sessions) yet. Maybe banks have to bleed more (Reg E mostly protects consumers from this fraud exposure) before they’ll come willing to regulators asking for it. If that’s the path to success, it’s a shame but not surprising. https://www.congress.gov/bill/116th-congress/house-bill/8215/text?r=20&s=1 https://www.congress.gov/bill/116th-congress/house-bill/8215... https://fcw.com/articles/2021/08/12/infrastructure-digital-id-senate.aspx?m=1 https://fcw.com/articles/2021/08/12/infrastructure-digital-i... “A draft version of the Senate infrastructure bill, which was obtained by FCW, included $500 million for the Department of Labor to institute a grant fund to supply states with digital identity proofing tools that are compliant with National Institute of Standards and Technology to combat fraud in unemployment insurance benefits. In addition to the program administered by the Labor Department, the draft legislative language called for the Office of Management and Budget to develop a plan for federal digital identity verification, including an inventory of current efforts and a study of the feasibility of establishing a governmentwide system that provides equitable access to users of government services and protects privacy. There was talk in the administration and in the Senate of adding $3 billion in funding for governmentwide identity solutions as part of the infrastructure bill. Instead, the entire section on program integrity covering the digital identity grants program and the OMB policy push was removed from the bill before it came up for a vote and was not offered in any of the amendments that came up as the bill was debated on the Senate floor. The White House and various Senate press offices by and large did not respond to emailed questions from FCW about what happened with the digital identity section of the bill.”
rlpb 5y ago
> It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow. Preventing this kind of fraud is a solved problem. The reason it still happens is that banks are forced, through competition, to minimise "identity proving" burden for consumers, in a "get credit now with instant approval!" kind of way. At the moment we're stuck in a "marketing armageddon" of banks competing with each other by not properly verifying identity before granting credit or transferring away money. This seems to me like a Tragedy of the Commons. If, across the board, people were required to prove their identity properly before banks rely on them, then the problem would go away overnight. It'd be a bit more tedious for consumers, but I don't see how that would cause banks to fail. The cost would merely move from fraud to identity verification. Perhaps some people wouldn't be sold credit that they can't afford, but I don't buy that such people are keeping the banks afloat. Before banks stop operating retail banking services, I'm sure they'll just start actually verifying identity properly to keep that market.
- hn_throwaway_99 5y ago
  As someone in the banking industry, this is the "right" answer. When I got started in banking I was pretty shocked about how easy it was to "authenticate" yourself to open a bank account. For example, this breach has pretty much all the things needed to open an account in someone else's name: Name, SSN, DoB, Address. That's pretty much all the KYC services use for validating an account application. There are, of course, easily added forms of additional verification - for example, Stripe just added their Identity service which lets you take a picture of your driver's license and then match the image against a selfie. But that puts "friction" in front of the application process, so most banks don't do something like this unless other signals make them think the application has a high fraud risk. If basically everyone's Name, SSN, DoB and Address is easily viewable public info, this will all change.
  - MichaelZuo 5y ago
    Security doesn’t appear on a balance sheet, but security expenditures and related depreciating assets certainly do appear. A classic example of measuring the wrong thing.
toast0 5y ago
The US system of credit reporting and associated ease of establishing credit is like super convenient. But it's largely based on trust. There isn't a whole lot of identity verification, and there are a lot of parties in the system that take identifying information at face value and run with it. This is nice when it's actually you, but it's a giant PITA to unravel when it's not. My spouse's name and SSN was used to rent an apartment in Oakland, as well as attempts to open credit cards at the apartment address (thankfully they tried to open an account at Amex but she already had one there and they called to confirm; at least one issuer said they were likely to approve). We were able to get all the credit applications denied/cancelled, but the rental lease is harder; the leasing office says they can't do anything without a criminal complaint and Oakland PD won't talk to us.
- BayAreaEscapee 5y ago
  I don't want to contradict your experience, I'm sure it's real as you describe it. Are you aware that California Penal Code sections 530.5-530.8 require the law enforcement agency in the area of an identify theft victim to take a police report? https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=PEN&division=&title=13.&part=1.&chapter=8.&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x...
  - toast0 5y ago
    If you call them, they ask you to fill out a report online. If you fill out a report online, they don't appear to do anything with it. Also, we're not in California. We reported to our local PD, who did call us to get additional information, but obviously isn't going to spend a lot of time on something they can't do anything about. Oakland PD could presumably visit the apartment and see who's there or something. Most of the things you're supposed to do revolve around documenting things (which allowing a police report does), so that when these accounts get reported on credit reports later, you can contest them and they'll be dropped. But in the mean time, there's nothing to be done about a fraudulent lease.

nerdponx 5y ago

Good! Maybe then the government will actually start to care once the lobbyists start to ask for help. The downside is that the "help" will probably just consist of funneling more taxpayer money to large shareholders and execs, while banks figure out ways to dodge liability without actually solving the problem.

vosper 5y ago
Is the government required here [0]? Could commercial operators not improve their own security through their own investment and taking it seriously? If ransomware hits them in the chequebook where stolen customer data didn't, then they might find that quite motivating? [0] It obviously is for government departments.
- tialaramex 5y ago
  The government is the final arbiter in a bunch of cases you care about. Whether you are (for example) a US citizen is not a decision for T-Mobile, or Amazon, or Walmart, or Delta, that's up to the US government† The government (and not private corporations) tracks births, deaths, immigration, emigration, and of course it chooses to issue identity paperwork. In general the closest commercial entities like banks can do is identity matching. So e.g. maybe Bank A asks you "Hey, do you have, like, a mortgage? Who with?" and you pick Bank X from the list of six options and OK, either that's a lucky guess or you know that "you" have a mortgage with Bank X. This is pretty poor, it's something, but it's not very much, it's up there with Facebook's "Here are some pictures of people, which of them is your friend?" which of course falls down when either: You "friend" people you don't actually know and wouldn't recognise; or your "friends" don't like Facebook having accurate photo data and intentionally mislabel random other people or things with their name... And as with the Facebook thing it breaks in surprising and hard to reproduce/ demonstrate ways. Maybe you think of this as your Big Bank mortgage, but if you check the small print it's actually a Different Bank mortgage, that Big Bank are re-branding, and so you just picked wrong. So yes, in practice government is where this would get solved, if you've any appetite for solving it.
toomuchtodo 5y ago
Different parts of government. Legislators, specially, need to care about digital identity. They don’t care enough (see below copy pasta, rest of the FCW piece talks about how identity legislation has been punted to fall Congressional sessions) yet. Maybe banks have to bleed more (Reg E mostly protects consumers from this fraud exposure) before they’ll come willing to regulators asking for it. If that’s the path to success, it’s a shame but not surprising. https://www.congress.gov/bill/116th-congress/house-bill/8215/text?r=20&s=1 https://www.congress.gov/bill/116th-congress/house-bill/8215... https://fcw.com/articles/2021/08/12/infrastructure-digital-id-senate.aspx?m=1 https://fcw.com/articles/2021/08/12/infrastructure-digital-i... “A draft version of the Senate infrastructure bill, which was obtained by FCW, included $500 million for the Department of Labor to institute a grant fund to supply states with digital identity proofing tools that are compliant with National Institute of Standards and Technology to combat fraud in unemployment insurance benefits. In addition to the program administered by the Labor Department, the draft legislative language called for the Office of Management and Budget to develop a plan for federal digital identity verification, including an inventory of current efforts and a study of the feasibility of establishing a governmentwide system that provides equitable access to users of government services and protects privacy. There was talk in the administration and in the Senate of adding $3 billion in funding for governmentwide identity solutions as part of the infrastructure bill. Instead, the entire section on program integrity covering the digital identity grants program and the OMB policy push was removed from the bill before it came up for a vote and was not offered in any of the amendments that came up as the bill was debated on the Senate floor. The White House and various Senate press offices by and large did not respond to emailed questions from FCW about what happened with the digital identity section of the bill.”

rlpb 5y ago

> It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow. Preventing this kind of fraud is a solved problem. The reason it still happens is that banks are forced, through competition, to minimise "identity proving" burden for consumers, in a "get credit now with instant approval!" kind of way. At the moment we're stuck in a "marketing armageddon" of banks competing with each other by not properly verifying identity before granting credit or transferring away money. This seems to me like a Tragedy of the Commons. If, across the board, people were required to prove their identity properly before banks rely on them, then the problem would go away overnight. It'd be a bit more tedious for consumers, but I don't see how that would cause banks to fail. The cost would merely move from fraud to identity verification. Perhaps some people wouldn't be sold credit that they can't afford, but I don't buy that such people are keeping the banks afloat. Before banks stop operating retail banking services, I'm sure they'll just start actually verifying identity properly to keep that market.

hn_throwaway_99 5y ago
As someone in the banking industry, this is the "right" answer. When I got started in banking I was pretty shocked about how easy it was to "authenticate" yourself to open a bank account. For example, this breach has pretty much all the things needed to open an account in someone else's name: Name, SSN, DoB, Address. That's pretty much all the KYC services use for validating an account application. There are, of course, easily added forms of additional verification - for example, Stripe just added their Identity service which lets you take a picture of your driver's license and then match the image against a selfie. But that puts "friction" in front of the application process, so most banks don't do something like this unless other signals make them think the application has a high fraud risk. If basically everyone's Name, SSN, DoB and Address is easily viewable public info, this will all change.
- MichaelZuo 5y ago
  Security doesn’t appear on a balance sheet, but security expenditures and related depreciating assets certainly do appear. A classic example of measuring the wrong thing.

toast0 5y ago

The US system of credit reporting and associated ease of establishing credit is like super convenient. But it's largely based on trust. There isn't a whole lot of identity verification, and there are a lot of parties in the system that take identifying information at face value and run with it. This is nice when it's actually you, but it's a giant PITA to unravel when it's not. My spouse's name and SSN was used to rent an apartment in Oakland, as well as attempts to open credit cards at the apartment address (thankfully they tried to open an account at Amex but she already had one there and they called to confirm; at least one issuer said they were likely to approve). We were able to get all the credit applications denied/cancelled, but the rental lease is harder; the leasing office says they can't do anything without a criminal complaint and Oakland PD won't talk to us.

BayAreaEscapee 5y ago
I don't want to contradict your experience, I'm sure it's real as you describe it. Are you aware that California Penal Code sections 530.5-530.8 require the law enforcement agency in the area of an identify theft victim to take a police report? https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=PEN&division=&title=13.&part=1.&chapter=8.&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x...
- toast0 5y ago
  If you call them, they ask you to fill out a report online. If you fill out a report online, they don't appear to do anything with it. Also, we're not in California. We reported to our local PD, who did call us to get additional information, but obviously isn't going to spend a lot of time on something they can't do anything about. Oakland PD could presumably visit the apartment and see who's there or something. Most of the things you're supposed to do revolve around documenting things (which allowing a police report does), so that when these accounts get reported on credit reports later, you can contest them and they'll be dropped. But in the mean time, there's nothing to be done about a fraudulent lease.