11 ms·

Scary fraud ensues when ID theft and usury collide

191 points by picture 5y ago

rectang 5y ago
In a just world, companies such as this lender would not only lose the money they loaned, but would be liable for the vast amounts of time and grief they caused a completely unrelated individual. Only then might we get a financial system which is robust against ID theft. While the costs are externalized to countless individuals, nothing will change.
- hbrav 5y ago
  There really should be an investigatory process when credit is fraudulently taken out in someone else's name. How did the company get duped into making the loan? If the answer is something like "we treated an SSN as identification", that company should lose the right to be a credit issuer.
- walrus01 5y ago
  I wonder at the likelihood of success if this person were to sue the company in his local small claims court for a claim at N hours multiplied by $80 per hour to fix the problem. At the minimum it would require them to hire local counsel to show up and answer a statement of claim.
  - throwoutway 5y ago
    Sounds like a startup opportunity. There’s enough victims out there that should be compensated for their grief.
  - arwhatever 5y ago
    I would like to sue for the mortgage interest rate increase a fraudulent bank account cost us when buying our house.
InefficientRed 5y ago
Serious question for any lawyers out there: why isn't there more serious recourse for consumers when credit agencies commit libel? If Equifax issues a report saying that I owe X, and I contact them with proof that this was a fraudulent loan, and they continue issuing that report... how is this not criminal libel?
- hbrav 5y ago
  Serious answer (I am not a lawyer): partly because the threshold for libel is really high in the US. Partly because there is also some procedure for challenging credit reports. I'm going to try and find the blog post about it...
  - hbrav 5y ago
    This: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
- mindslight 5y ago
  Regulatory capture through the "Fair" Credit Reporting Act. Go read it - they've legislatively exempted themselves from the standard time-honored tort! Similarly to how medical providers can nonsensically create post-facto arbitrary bills instead of needing to create contracts like every other industry. Curiously, political pushes for reform never advocate for getting rid of the corrupt laws, but rather creating a whole new regulatory regime whose corporate giveaways will only become apparent down the line.
  - cperciva 5y ago
    Similarly to how medical providers can nonsensically create post-facto arbitrary bills instead of sticking to contracts like every other industry. While medical providers do seem to take this to ludicrous, my understanding is that there's an underlaying common law principle concerning actions taken on behalf of someone in an emergency, and it's not just medical providers to whom this applies.
ryandrake 5y ago
It’s way past time for banks to start taking responsibility for issuing fraudulent loans. If someone else takes out a loan using my information, it shouldn’t even remotely be my problem to help clean up, and it shouldn’t involve me at all. This is between the bank and the fraudster. Even the term “identity theft” is slimy: deftly deflecting blame from the negligent bank, trying to draw an unrelated 3rd party into the mix by nominating him as the “theft victim.”
- gr1zzlybe4r 5y ago
  Completely agree, and I've worked at fintech companies that issue credit products.
- gruez 5y ago
  >It’s way past time for banks to start taking responsibility for issuing fraudulent loans. That sounds nice and all, but what would that actually look like in terms of legislation? Legally speaking you're already not responsible for fraudulent loans, and the onus is on the creditor to prove that the debt was actually yours.
  - toomuchtodo 5y ago
    Legally, yes. In practice, debt collectors (which originators of debt of all sorts will quickly dump unpaid debt onto, even medical providers who don't want to wait for patients to cough up the funds due) will take advantage of unsophisticated/financially illiterate citizens to coerce payment, even if there is no obligation to pay. The fix is straightforward: require evidence of the debt upfront, and if you're attempting to collect on debt you can't verify was agreed to by the person you're pursuing, damages are substantial (say, $1M per occurance). Make reporting of violations via the CFPB frictionless. You will see debt originators rapidly standing up robust identity proofing systems (having customers come into a branch with their IDs), and asking Congress to legislate their implementation (Login.gov and similar for private enterprise, with the end game being a usable national ID system such that Estonia has [1]). Tangentially, current risk management in this space between identity and finance sucks. I worked with someone to get liens off their Lexis Nexis Risk Solutions report (which mortgage originators use for compliance purposes with conventional mortgage underwriting guidelines as it relates to foreclosures and real estate fraud) that were on their report for almost 8 years in error. It took a CFPB complaint for Lexis Nexis to remove them with citations from an attorney to state statute, and this data isn't classified as consumer reporting, so it's almost impossible to obtain financial recourse/damages for these occurrences. [1] https://privacyinternational.org/case-study/4737/id-systems-analysed-e-estonia-x-road https://privacyinternational.org/case-study/4737/id-systems-... [1] https://news.ycombinator.com/item?id=29980189 https://news.ycombinator.com/item?id=29980189 (HN thread of the above link)
ipsin 5y ago
Why isn't the Bank of America account in his name? I was under the impression that know your customer laws would require them to match up the individual taking the loan and the individual holding the bank account. Is it really just a simple as an ACH transfer?
- warkdarrior 5y ago
  KYC laws just require that the source and destination accounts are tied to individuals whose identities are known, not that they are tied to the same individual.
SMAAART 5y ago
What a nightmare!
qwerty456127 5y ago
Why not just outlaw loans with interest rates above some reasonable limit rendering the obligations void and the very attempt of offering such a loan a crime?
- MertsA 5y ago
  These loans are illegal in most states however the loan sharks have paid individuals associated with a native american tribe to "own" the company in an effort to claim tribal sovereignty much like casinos like to do in states where gambling laws aren't favorable. The state may set an upper limit on these usurious loans but if an individual tribe has not then they can run the business under the jurisdiction of the tribal council even though most of the people getting these loans legitimately are not a member of the local tribe.
IMAYousaf 5y ago
What're the best practices for dealing with this if one is a victim?

191 points by picture 5y ago

In a just world, companies such as this lender would not only lose the money they loaned, but would be liable for the vast amounts of time and grief they caused a completely unrelated individual. Only then might we get a financial system which is robust against ID theft. While the costs are externalized to countless individuals, nothing will change.

hbrav 5y ago
There really should be an investigatory process when credit is fraudulently taken out in someone else's name. How did the company get duped into making the loan? If the answer is something like "we treated an SSN as identification", that company should lose the right to be a credit issuer.
walrus01 5y ago
I wonder at the likelihood of success if this person were to sue the company in his local small claims court for a claim at N hours multiplied by $80 per hour to fix the problem. At the minimum it would require them to hire local counsel to show up and answer a statement of claim.
- throwoutway 5y ago
  Sounds like a startup opportunity. There’s enough victims out there that should be compensated for their grief.
- arwhatever 5y ago
  I would like to sue for the mortgage interest rate increase a fraudulent bank account cost us when buying our house.

InefficientRed 5y ago

Serious question for any lawyers out there: why isn't there more serious recourse for consumers when credit agencies commit libel? If Equifax issues a report saying that I owe X, and I contact them with proof that this was a fraudulent loan, and they continue issuing that report... how is this not criminal libel?

hbrav 5y ago
Serious answer (I am not a lawyer): partly because the threshold for libel is really high in the US. Partly because there is also some procedure for challenging credit reports. I'm going to try and find the blog post about it...
- hbrav 5y ago
  This: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
mindslight 5y ago
Regulatory capture through the "Fair" Credit Reporting Act. Go read it - they've legislatively exempted themselves from the standard time-honored tort! Similarly to how medical providers can nonsensically create post-facto arbitrary bills instead of needing to create contracts like every other industry. Curiously, political pushes for reform never advocate for getting rid of the corrupt laws, but rather creating a whole new regulatory regime whose corporate giveaways will only become apparent down the line.
- cperciva 5y ago
  Similarly to how medical providers can nonsensically create post-facto arbitrary bills instead of sticking to contracts like every other industry. While medical providers do seem to take this to ludicrous, my understanding is that there's an underlaying common law principle concerning actions taken on behalf of someone in an emergency, and it's not just medical providers to whom this applies.

ryandrake 5y ago

It’s way past time for banks to start taking responsibility for issuing fraudulent loans. If someone else takes out a loan using my information, it shouldn’t even remotely be my problem to help clean up, and it shouldn’t involve me at all. This is between the bank and the fraudster. Even the term “identity theft” is slimy: deftly deflecting blame from the negligent bank, trying to draw an unrelated 3rd party into the mix by nominating him as the “theft victim.”

gr1zzlybe4r 5y ago
Completely agree, and I've worked at fintech companies that issue credit products.
gruez 5y ago
>It’s way past time for banks to start taking responsibility for issuing fraudulent loans. That sounds nice and all, but what would that actually look like in terms of legislation? Legally speaking you're already not responsible for fraudulent loans, and the onus is on the creditor to prove that the debt was actually yours.
- toomuchtodo 5y ago
  Legally, yes. In practice, debt collectors (which originators of debt of all sorts will quickly dump unpaid debt onto, even medical providers who don't want to wait for patients to cough up the funds due) will take advantage of unsophisticated/financially illiterate citizens to coerce payment, even if there is no obligation to pay. The fix is straightforward: require evidence of the debt upfront, and if you're attempting to collect on debt you can't verify was agreed to by the person you're pursuing, damages are substantial (say, $1M per occurance). Make reporting of violations via the CFPB frictionless. You will see debt originators rapidly standing up robust identity proofing systems (having customers come into a branch with their IDs), and asking Congress to legislate their implementation (Login.gov and similar for private enterprise, with the end game being a usable national ID system such that Estonia has [1]). Tangentially, current risk management in this space between identity and finance sucks. I worked with someone to get liens off their Lexis Nexis Risk Solutions report (which mortgage originators use for compliance purposes with conventional mortgage underwriting guidelines as it relates to foreclosures and real estate fraud) that were on their report for almost 8 years in error. It took a CFPB complaint for Lexis Nexis to remove them with citations from an attorney to state statute, and this data isn't classified as consumer reporting, so it's almost impossible to obtain financial recourse/damages for these occurrences. [1] https://privacyinternational.org/case-study/4737/id-systems-analysed-e-estonia-x-road https://privacyinternational.org/case-study/4737/id-systems-... [1] https://news.ycombinator.com/item?id=29980189 https://news.ycombinator.com/item?id=29980189 (HN thread of the above link)

ipsin 5y ago

Why isn't the Bank of America account in his name? I was under the impression that know your customer laws would require them to match up the individual taking the loan and the individual holding the bank account. Is it really just a simple as an ACH transfer?

warkdarrior 5y ago
KYC laws just require that the source and destination accounts are tied to individuals whose identities are known, not that they are tied to the same individual.

SMAAART 5y ago

What a nightmare!

qwerty456127 5y ago

Why not just outlaw loans with interest rates above some reasonable limit rendering the obligations void and the very attempt of offering such a loan a crime?

MertsA 5y ago
These loans are illegal in most states however the loan sharks have paid individuals associated with a native american tribe to "own" the company in an effort to claim tribal sovereignty much like casinos like to do in states where gambling laws aren't favorable. The state may set an upper limit on these usurious loans but if an individual tribe has not then they can run the business under the jurisdiction of the tribal council even though most of the people getting these loans legitimately are not a member of the local tribe.

IMAYousaf 5y ago

What're the best practices for dealing with this if one is a victim?