5 ms·
I bought a new iPhone with cash, signed up for a Verizon MVNO using an assumed name and used an impersonal email address (and assumed name) for my Apple ID (whi
by rsync 5y ago
I bought a new iPhone with cash, signed up for a Verizon MVNO using an assumed name and used an impersonal email address (and assumed name) for my Apple ID (which I seldom use).
Nobody in this chain has my real name or any significant PII. I don't care if any of them get "hacked".
Further, if my phone is lost I just recreate the chain and point my (twilio) number to the new SIM card. I can temporarily forward SMS to email for a day or three. Yes, of course twilio has an assumed name.
None of this was difficult nor illegal nor expensive.
The enabling factor is that Visa/MC do not actually verify cardholder name (even though everyone thinks they do).
So my bank sort of knows who all the providers are, but they'd need to collude with (MVNO or twilio or Apple) to have any real PII which could then be stolen ...
My threat model is PII theft via hacks (like this one) and wayward employees at each provider. My threat model is not state actors or LEAs.
- deleted 5y ago[deleted]
- EvanAnderson 5y agoCan you elaborate on "The enabling factor is that Visa/MC do not actually verify cardholder name"? Are you saying that you've got a credit card under an assumed name?
- rsync 5y agoNo, of course not. I am saying that merchants do not have the ability to verify card holder name. Your transaction will process properly with Mickey mouse as first last. Only amex verifies cardholder name. EDIT: relevant stackexchange is here: https://security.stackexchange.com/questions/220724/i-can-pay-by-my-credit-card-under-fake-name-whos-responsible-to-check https://security.stackexchange.com/questions/220724/i-can-pa...
- BeefySwain 5y ago> None of this was difficult nor illegal nor expensive. Is giving a false name to the CC companies not illegal in some way? At the very least I'm certain it is a breach of contract.
- brewdad 5y agoI think OP is saying that they give a fake name to the vendor, not the CC card company. Walmart (maybe?) isn't checking that the billing name you give them matches the name on the card. I don't know how true this is across all vendors.
- rsync 5y agoThis is correct. I have the same, real-name relationship with my bank and card issuers that you or anyone else has. Rando-web-merchant, on the other hand, never gets my real name. "I don't know how true this is across all vendors." Almost 100%. There is a rarely used program called "verified by visa" that takes you through an additional verification step and encourages you to create some sort of account linked to your issuing bank (or something) but I have only run into that once in the years I have adopted this practice.
- quesera 5y agoSlightly mitigating: Merchants can request Address Verification (AVS) from the network, but the result is purely advisory: the merchant can ignore a mismatch if they choose. In my experience, most do ignore it. This is also true of the CVV/CVV2/CSC/etc. Most web vendors require it, but it is not required to complete a transaction. Theoretically the provision of a correct CVV indicates that the consumer has the card in-hand. Chargeback appeals are somewhat more likely to succeed if the transaction included the CVV.
- EvanAnderson 5y agoI appreciate the response and the link to the Stack Exchange question. I wasn't "getting" what you were saying, but now it makes sense. That's probably something I'll start doing too. Thanks for the idea.
- derwiki 5y agoWhen I use a privacy.com virtual card, I can use any name/address and the transaction is approved.
- slownews45 5y agoInteresting - I've always wondered if something like this is possible. Even just if privacy.com or someone would let me signup with a fake identity to t-mobile. Then who cares if these folks get hacked?
- dellcybpwr 5y agoMy hero!