8 ms·

> It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow. Preventing this

by rlpb 5y ago

> It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow. Preventing this kind of fraud is a solved problem. The reason it still happens is that banks are forced, through competition, to minimise "identity proving" burden for consumers, in a "get credit now with instant approval!" kind of way. At the moment we're stuck in a "marketing armageddon" of banks competing with each other by not properly verifying identity before granting credit or transferring away money. This seems to me like a Tragedy of the Commons. If, across the board, people were required to prove their identity properly before banks rely on them, then the problem would go away overnight. It'd be a bit more tedious for consumers, but I don't see how that would cause banks to fail. The cost would merely move from fraud to identity verification. Perhaps some people wouldn't be sold credit that they can't afford, but I don't buy that such people are keeping the banks afloat. Before banks stop operating retail banking services, I'm sure they'll just start actually verifying identity properly to keep that market.

hn_throwaway_99 5y ago
As someone in the banking industry, this is the "right" answer. When I got started in banking I was pretty shocked about how easy it was to "authenticate" yourself to open a bank account. For example, this breach has pretty much all the things needed to open an account in someone else's name: Name, SSN, DoB, Address. That's pretty much all the KYC services use for validating an account application. There are, of course, easily added forms of additional verification - for example, Stripe just added their Identity service which lets you take a picture of your driver's license and then match the image against a selfie. But that puts "friction" in front of the application process, so most banks don't do something like this unless other signals make them think the application has a high fraud risk. If basically everyone's Name, SSN, DoB and Address is easily viewable public info, this will all change.
- MichaelZuo 5y ago
  Security doesn’t appear on a balance sheet, but security expenditures and related depreciating assets certainly do appear. A classic example of measuring the wrong thing.
- madamelic 5y ago
  On the other side of that, there is such thing as too much friction. Shortly before BBVA closed them, I was in a back-and-forth to open an account with Simple. First, my ID was too shiny, then it wasn't black and white, then it wasn't color, then they wanted a picture of my apartment building, then ... it was just on and on and on for three weeks. It got to the point where I asked what exactly they wanted and they literally told me that they cannot tell me because it would allow me to commit fraud. I asked if I could talk directly to their fraud team to figure out what exactly: nope. Can't do that, they can't talk to you. So I was expected to either read their minds or play infinite whack-a-mole with them where they say one thing in one email then say the opposite in the next.
  - pas 5y ago
    Yes, no problem with that. Eventually a long standing established digital identity is needed. Provided by anyone, state, bank, etc. Opening a new one should be easy though, but risk assessment should be done at every step (as the account gains new trust in whatever system).
    - specialist 5y ago
      Correct. This achievement then unlocks Privacy technology. Currently, PII must be stored as plaintext. Required for matching records across systems. Once UUIDs are used, all data at rest, at the field level, can be encrypted. cite: Book Translucent Databases 2nd ed.
- mlindner 5y ago
  T-Mobile doesn't have anyone's SSNs... They're not required to get a cell phone number.
  - claytongulick 5y ago
    That hasn't been my experience with any major cell provider. They have refused to provide me service if I don't give my SSN. To get around it, I've had to open business accounts with my EIN.
    - mixmastamyk 5y ago
      It is to provide you with credit. A deposit may work as well. Prepaid doesn't have the issue.
      - eitland 5y ago
        > It is to provide you with credit. Many places it is to prevent abuse. I don't think I have been able yo legally get a phone number in Norway without identifykng myself for years. Maybe if you go to a lawyer they can sort something, but that will be another league for most of us.
      - yebyen 5y ago
        If you can explain to me how a monthly service where payment is required in full every month requires a credit agreement, I'll (don't know, do something crazy like eating my hat) - this is the standard service provider contract, for some reason it is considered a credit instrument and can land on your credit report. That being said, you are right, there are prepaid options and postpaid with a deposit ($50) that can put you outside of this SSN requirement on T-Mobile. I guess you have to know to ask for them. It is for credit, that's the only reason they can ask for your SSN. Everything is credit based now, and for some people their phone bill might even be their first positive (or negative) mark on a credit score rating.
        hn_throwaway_99 5y ago
8ytecoder 5y ago
Doing that has “economic costs” too. I have seen both the models. In the US, you can walk in to a dealer and walk out with a car. Elsewhere, you usually get your preapproval before you start car shopping. Then usually you have to go to the bank to close the paperwork and get the car in a few days to a week. It’s for the best in general. But it’ll make people make more informed decisions and that’ll reduce the spending. And proper identify verification - like looking at the document in person - also has downsides. It still can be forged. Just a little harder than what we have. (Other countries with mandatory physical KYC and a wet signature still have fraud issues) Overall I think it’s a lot of added cost and inconvenience for a slightly better benefit.
ipython 5y ago
As a counterpoint, I recently tried to sign up for a store card to take advantage of promotions on a large purchase. I was not approved- apparently because “my phone number could not be validated”. This even though I had my drivers license, ssn, and spoke personally with a bank representative. Weird.
- HomeDeLaPot 5y ago
  Can't comment on why the other things weren't enough, but do you have a "real" phone number or is it VoIP? I was unable to verify my Twitter account until I contacted support, nor could I get the IRS website to take my number when doing taxes, and I think the reason is that my (small) carrier uses VoIP: https://help.republicwireless.com/hc/en-us/articles/360025097894-Why-Can-t-I-Receive-a-Verification-Code-From-Some-Companies- https://help.republicwireless.com/hc/en-us/articles/36002509...
mschuster91 5y ago
> The reason it still happens is that banks are forced, through competition, to minimise "identity proving" burden for consumers, in a "get credit now with instant approval!" kind of way. The best solution would be if the US introduced mandatory passports or other forms of ID cards with smartcard capability, similar to the German Personalausweis. It has a secure cryptoprocessor with key vault, meaning it can be used to sign documents (if the bureaucracy to get a signature CA wouldn't be completely stuck for years now, SIGH), but especially companies willing to use authenticated data can fetch them securely over any NFC enabled terminal. Quite ingenuous. This would entirely kill ID fraud at the source. The problem only seems to be an aversion in some parts of the US population against ID documents.
- TedDoesntTalk 5y ago
  That same ID would also kill the conversation around voting fraud, whether it actually happens or not.
  - d0gsg0w00f 5y ago
    Agreed, but requiring stricter identity verification is now considered racism.
    - eropple 5y ago
      No. Doing so in a way that is intentionally designed to be more difficult for disadvantaged groups to fulfill so that they do not participate in the democratic process--that is not "considered" racism, it is racism. But you know that. It must be hard to be so aggrieved.
      - TedDoesntTalk 5y ago
        > intentionally designed to be more difficult for disadvantaged groups Why is obtaining an ID "intentionally designed" this way. Don't you need to get a driving license to drive? A passport to re-enter the country? Do disadvantaged groups not get driving licenses?
_huayra_ 5y ago
I'm still kinda shocked that it took so long to get chipped credit / debit cards in the US, and the fact that credit cards still don't have pins... Most of the online transactions I do with my credit card in Europe require me to verify them via some approval app (often the bank's own app) before they're submitted. But I guess it's more profitable to just let US folks spend spend spend and rack up huge debt burdens. The interest is probably higher than whatever anti-fraud efforts cost them at the moment.
avianlyric 5y ago
I think you would be surprised how much fraud still happens with strong identity protections. Here in the UK strong customer authentication and strong proof of identity is a requirement in law, breaching it lands you in significant amounts of hot water. So at the bank I used to work at, identity theft was pretty rare and only made up a tiny fraction of the fraud we saw. A much bigger share of the pie, and the area that we really struggled with, is customer authorised payments. The customer gets socially engineered into parting with their cash, and as a bank we're expected to reimburse them if we can't prove that we didn't take steps to detect the scam in progress and prevent the customer making the transaction.

by rlpb 5y ago

hn_throwaway_99 5y ago

As someone in the banking industry, this is the "right" answer. When I got started in banking I was pretty shocked about how easy it was to "authenticate" yourself to open a bank account. For example, this breach has pretty much all the things needed to open an account in someone else's name: Name, SSN, DoB, Address. That's pretty much all the KYC services use for validating an account application. There are, of course, easily added forms of additional verification - for example, Stripe just added their Identity service which lets you take a picture of your driver's license and then match the image against a selfie. But that puts "friction" in front of the application process, so most banks don't do something like this unless other signals make them think the application has a high fraud risk. If basically everyone's Name, SSN, DoB and Address is easily viewable public info, this will all change.

MichaelZuo 5y ago
Security doesn’t appear on a balance sheet, but security expenditures and related depreciating assets certainly do appear. A classic example of measuring the wrong thing.
madamelic 5y ago
On the other side of that, there is such thing as too much friction. Shortly before BBVA closed them, I was in a back-and-forth to open an account with Simple. First, my ID was too shiny, then it wasn't black and white, then it wasn't color, then they wanted a picture of my apartment building, then ... it was just on and on and on for three weeks. It got to the point where I asked what exactly they wanted and they literally told me that they cannot tell me because it would allow me to commit fraud. I asked if I could talk directly to their fraud team to figure out what exactly: nope. Can't do that, they can't talk to you. So I was expected to either read their minds or play infinite whack-a-mole with them where they say one thing in one email then say the opposite in the next.
- pas 5y ago
  Yes, no problem with that. Eventually a long standing established digital identity is needed. Provided by anyone, state, bank, etc. Opening a new one should be easy though, but risk assessment should be done at every step (as the account gains new trust in whatever system).
  - specialist 5y ago
    Correct. This achievement then unlocks Privacy technology. Currently, PII must be stored as plaintext. Required for matching records across systems. Once UUIDs are used, all data at rest, at the field level, can be encrypted. cite: Book Translucent Databases 2nd ed.
mlindner 5y ago
T-Mobile doesn't have anyone's SSNs... They're not required to get a cell phone number.
- claytongulick 5y ago
  That hasn't been my experience with any major cell provider. They have refused to provide me service if I don't give my SSN. To get around it, I've had to open business accounts with my EIN.
  - mixmastamyk 5y ago
    It is to provide you with credit. A deposit may work as well. Prepaid doesn't have the issue.
    - eitland 5y ago
      > It is to provide you with credit. Many places it is to prevent abuse. I don't think I have been able yo legally get a phone number in Norway without identifykng myself for years. Maybe if you go to a lawyer they can sort something, but that will be another league for most of us.
    - yebyen 5y ago
      If you can explain to me how a monthly service where payment is required in full every month requires a credit agreement, I'll (don't know, do something crazy like eating my hat) - this is the standard service provider contract, for some reason it is considered a credit instrument and can land on your credit report. That being said, you are right, there are prepaid options and postpaid with a deposit ($50) that can put you outside of this SSN requirement on T-Mobile. I guess you have to know to ask for them. It is for credit, that's the only reason they can ask for your SSN. Everything is credit based now, and for some people their phone bill might even be their first positive (or negative) mark on a credit score rating.
      - hn_throwaway_99 5y ago

8ytecoder 5y ago

Doing that has “economic costs” too. I have seen both the models. In the US, you can walk in to a dealer and walk out with a car. Elsewhere, you usually get your preapproval before you start car shopping. Then usually you have to go to the bank to close the paperwork and get the car in a few days to a week. It’s for the best in general. But it’ll make people make more informed decisions and that’ll reduce the spending. And proper identify verification - like looking at the document in person - also has downsides. It still can be forged. Just a little harder than what we have. (Other countries with mandatory physical KYC and a wet signature still have fraud issues) Overall I think it’s a lot of added cost and inconvenience for a slightly better benefit.

ipython 5y ago

As a counterpoint, I recently tried to sign up for a store card to take advantage of promotions on a large purchase. I was not approved- apparently because “my phone number could not be validated”. This even though I had my drivers license, ssn, and spoke personally with a bank representative. Weird.

HomeDeLaPot 5y ago
Can't comment on why the other things weren't enough, but do you have a "real" phone number or is it VoIP? I was unable to verify my Twitter account until I contacted support, nor could I get the IRS website to take my number when doing taxes, and I think the reason is that my (small) carrier uses VoIP: https://help.republicwireless.com/hc/en-us/articles/360025097894-Why-Can-t-I-Receive-a-Verification-Code-From-Some-Companies- https://help.republicwireless.com/hc/en-us/articles/36002509...

mschuster91 5y ago

> The reason it still happens is that banks are forced, through competition, to minimise "identity proving" burden for consumers, in a "get credit now with instant approval!" kind of way. The best solution would be if the US introduced mandatory passports or other forms of ID cards with smartcard capability, similar to the German Personalausweis. It has a secure cryptoprocessor with key vault, meaning it can be used to sign documents (if the bureaucracy to get a signature CA wouldn't be completely stuck for years now, SIGH), but especially companies willing to use authenticated data can fetch them securely over any NFC enabled terminal. Quite ingenuous. This would entirely kill ID fraud at the source. The problem only seems to be an aversion in some parts of the US population against ID documents.

TedDoesntTalk 5y ago
That same ID would also kill the conversation around voting fraud, whether it actually happens or not.
- d0gsg0w00f 5y ago
  Agreed, but requiring stricter identity verification is now considered racism.
  - eropple 5y ago
    No. Doing so in a way that is intentionally designed to be more difficult for disadvantaged groups to fulfill so that they do not participate in the democratic process--that is not "considered" racism, it is racism. But you know that. It must be hard to be so aggrieved.
    - TedDoesntTalk 5y ago
      > intentionally designed to be more difficult for disadvantaged groups Why is obtaining an ID "intentionally designed" this way. Don't you need to get a driving license to drive? A passport to re-enter the country? Do disadvantaged groups not get driving licenses?

_huayra_ 5y ago

I'm still kinda shocked that it took so long to get chipped credit / debit cards in the US, and the fact that credit cards still don't have pins... Most of the online transactions I do with my credit card in Europe require me to verify them via some approval app (often the bank's own app) before they're submitted. But I guess it's more profitable to just let US folks spend spend spend and rack up huge debt burdens. The interest is probably higher than whatever anti-fraud efforts cost them at the moment.

avianlyric 5y ago

I think you would be surprised how much fraud still happens with strong identity protections. Here in the UK strong customer authentication and strong proof of identity is a requirement in law, breaching it lands you in significant amounts of hot water. So at the bank I used to work at, identity theft was pretty rare and only made up a tiny fraction of the fraud we saw. A much bigger share of the pie, and the area that we really struggled with, is customer authorised payments. The customer gets socially engineered into parting with their cash, and as a bank we're expected to reimburse them if we can't prove that we didn't take steps to detect the scam in progress and prevent the customer making the transaction.