6 ms·

This area of finance is utterly, completely backwards and seems like one of the most (evil)successful bits of proper-burden reversal in existence. The entire co

by xoa 4y ago

This area of finance is utterly, completely backwards and seems like one of the most (evil)successful bits of proper-burden reversal in existence. The entire concept of "identity theft" as it exists now is 100% pure industry propaganda. Nobody is cloning bodies and transplanting brains or something. It's not that anyone is "stealing my identity" it's the financial institutions don't bother to verify it and then somehow have managed to make a system where this is my problem. If I haven't chosen to have a business relationship with a given financial institution or credit bureau, and they choose to give somebody else financial services, it shouldn't matter if that person used my name or widely circulated information about me, anything less then full biometrics/video for signup and establishing mutual certificates and cryptographically signed interactions thereafter should be presumptively invalid. If Person M lies to a Bank A about their info claiming to be Person A and tries to escape their commitments sure they've committed fraud, but if the Bank A then tries to go after Person A then the bank are literally accessories to fraud and should face criminal prosecution or at the least massive financial penalties (with both expenses and punitive fines paid to Person A). If the banks want to have private credit bureaus to help them with scaling, abstracting and reducing bias in the risk aspect sure; there are reasonable arguments for that. But said credit bureaus should have no role in identity verification, and if they are lying about people (claiming financial things about them which are not true) that again should be on them, with serious statutory penalties. All the burdens are completely backwards, in turn massively perverting the incentives. And it's eternally infuriating. Some rando applying for a credit line on the opposite side of the country should be Not My Problem, 100% of the time, whether they have my name or address or a random symmetric 9 digit number some government assigned me. All the tools exist for financial institutions to manage their risk/convenience tradeoff, but they're the ones who have the power, information and should have the incentive to do so. They are externalizing onto the general public instead.

ValentineC 4y ago
As someone who's lived in a couple of countries, I think one reason credit bureaus are so heavily relied on in the US (and UK) is because they lack a centralised identity database that regulated financial institutions are able to draw from. Credit bureaus — as well as the various credit building products that are so common in these countries — are required to play that role.
- mindslight 4y ago
  Strengthening government identification would only be reasonable after the US has the equivalent of the GDPR. As it stands right now, doing so would just be another vulnerability for private surveillance companies to abuse just as they've abused social security numbers, driver's license numbers, and even phone numbers.
  - dangerlibrary 4y ago
    One way to ensure something never gets done is to bog it down with a bunch of politically challenging prerequisites.
    - mindslight 4y ago
      It's already "bogged down" - I described a direct concern. Brushing that aside is equivalent to saying the concerns don't matter. Social security numbers were introduced for the sole purpose of administering the social security program. The protections on private entities abusing them were neutered, which is how we ended up with the backwards regime under discussion. People have a vague fear that social security numbers are important and shouldn't be casually shared, which is the only thing holding back (for example) grocery stores from demanding your social security number to get the regular prices. If say the US issued everyone a cryptographic identity via a smart card, there would be little stopping every single business from demanding that you scan this card. Imagine needing to link your singular legal identity to every single online service, so they could better associate your surveillance records. Big tech is currently doing its best to accomplish this through phone numbers, but at least it's possible to get additional phone numbers.
      - dangerlibrary 4y ago
        The nature of the problem you are describing (private companies having a more reliable unique ID to correlate data than phone number) seems incrementally worse than what we have today. In practice, most people rarely, if ever, change their phone number. I don't like that companies demand my phone number to get cheaper groceries, but in practice I just type in "(local area code) 867-5309" [1] into whatever terminal is asking for my phone number and get the discount 100% of the time. The consequences of the problem the proposal is trying to address seem larger to me. Currently, you can be denied access to capital and even basic financial services because identity management has been outsourced to unreliable third parties with no incentive to do a better job. [1] Sorry Jenny https://youtu.be/6WTdTwcmxyo https://youtu.be/6WTdTwcmxyo
gmac 4y ago
There's a nice sketch on this point by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E David Mitchell discusses it further here: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi...
TheRealDunkirk 4y ago
It's a generalized problem that American corporations have worked hand-in-hand with the government to make sure that they avoid the vast preponderance of legal culpability for any and all malfeasance they cause. You almost have to hand it to them. Almost. As with all systemic issues we face, we can't fix it until we "fix" Citizens United, and that -- as well as any other Constitutional Amendment these days -- will be nigh impossible.
- kmeisthax 4y ago
  In this particular case the corporations in question - banks - would love to see the problem solved too. They don't want to make fraudulent loans in other people's names. The problem is that America's government does not provide a strong form of identity. In fact, strong identity is culturally resisted: civil libertarians[0] have been adamant that America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier. Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. Names are quite common, people move all the time, phone numbers change and can get stolen, SSNs were specifically designed to be easily forgeable[1], most Americans do not have passports, not everyone has a US birth certificate, not everyone can get a driver's license, the ID-only cards you can get are intentionally designed to be a pain for the above two categories, etc. [0] This is also one of the few times where I don't have to distinguish between left- and right-wing libertarians either. [1] If you were born before 2011 you can obtain valid SSNs by incrementing or decrementing the last four digits of your own. You will get the SSN of someone else who was born in the same hospital as you. The first five digits are just a function of the state the SSN was issued in and when you were born. There is no check digit, they only started randomly issuing numbers in 2011, and even then it does not matter because compromised SSNs are never reissued unless you are an FBI informant.
  - carapace 4y ago
    > America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier. No, it makes establishing trustworthy business transactions slightly harder. Only slightly, and the necessary technology has been off-the-shelf for some time now. > Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. The folks at my local credit union and I know each other personally. It would take a "Mission Impossible"-style impersonation to get them to succumb to fraud ("identity theft".)
vel0city 4y ago
> a random symmetric 9 digit number some government assigned me SSNs aren't even that random, they're very deterministically generated for the most part. If you know when and where someone was born its not too hard to guess the first 5 digits or so, meanwhile the last four digits are routinely shown places.
- Caligatio 4y ago
  The geographic numbering scheme was thankfully stopped for anyone born in June 2011 or later ( https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html)
  - vel0city 4y ago
    Wonderful news. Now its more challenging to steal an 11 year old's information :) Thanks for sharing this!
hereforphone 4y ago
If someone somehow hacks your brokerage account and steals everything, you may be completely out of luck. The bank will consider it your fault, not theirs, unless it's a mass hack (multiple accounts). The law will probably agree with them, and you'll be out your savings.
seanhunter 4y ago
Totally agree. As an example of how little companies do in these cases to verify things and how lazy they are about ensuring when they pursue claims that they are doing so against the relevant person, here's my story. Some time ago someone obviously signed a gas contract for a company and just put my home address as the billing address. The first I heard about it was when I received a gas bill for a property that I have absolutely no connection with. It was addressed to a company I have no connnection with at my home address. I've lived in the same house for over 10 years and this company has never been associated with my address in that time. I don't think it was before either but w/e. I accidentally opened this bill because I receive a lot of mail and didn't realise it was incorrectly addressed. Having seen that it was the wrong thing I wrote to the company explaining their mistake. I also gave them the name and address of the actual officers of the company who had the debt (this is public information in the UK where I live). I didn't hear back except that I received 3 or 4 more bills all of which I returned to sender. A few months later I received a legal letter from a collections firm saying they had been engaged to collect this debt and I had to pay up or they would take me to court. I wrote to them explaining the situation saying that this debt, company and the property and debt underlying the address was nothing whatsoever to do with me and that I had written to the creditor to that effect some time ago. I didn't hear back until a few months later, when I received another legal letter from a different person at the same collections firm basically repeating the threat to take me to court. I wrote to them again and also called them up to explain. The person at the collections agency thanked me for calling and said they would deal with the matter. A few more bills arrived. I returned them to sender (at least once in an envelope with a covering letter explaining the situation again). Then I received a notice saying a default court judgement had been entered and that the bill had to be paid. I wrote to them again and said they had to stop harrassing me and actually pursue the collection against someone associated with the actual company. It was super clear that at no time did anyone associated with either the original creditor or the collections agency make the slightest effort to actually try to collect this debt from someone who was actually responsible for it. This is in spite of the fact that I spoonfed them the names and addresses of actual people who were associated with the company responsible etc. This situation could also never have occurred if they had actually made any effort at all to check whether the company was associated with the billing address.
Nextgrid 4y ago
It's true but part of the problem is also that people submit to it. The credit system "works" because for the most part, the information they provide is legitimate enough, to the detriment of victims of fraud who now have to prove their innocence. If people with the means (those that have "fuck you" money and can afford to walk away) suddenly turn around and say "nope" and are happy to have bad/fraudulent credit, the entire credit system collapses - banks need to lend to survive and if the credit system stops being useful in verifying someone's creditworthiness (because even creditworthy people's records are contaminated with bad/fraudulent data) then banks will switch to a different system that doesn't have these problems (and that system could be to manually search for bankruptcy records and evaluating proofs of income, like it's done in many European countries), or lose out to those who switch because the "fuck you money" people will prefer them as they're willing to ignore the credit history system and use alternative means of evaluating creditworthiness. Of course, a legal solution that outlaws this privacy nightmare is best, but that's a lost cause in the US. The market-based approach described above is more likely to work.

by xoa 4y ago

ValentineC 4y ago

As someone who's lived in a couple of countries, I think one reason credit bureaus are so heavily relied on in the US (and UK) is because they lack a centralised identity database that regulated financial institutions are able to draw from. Credit bureaus — as well as the various credit building products that are so common in these countries — are required to play that role.

mindslight 4y ago
Strengthening government identification would only be reasonable after the US has the equivalent of the GDPR. As it stands right now, doing so would just be another vulnerability for private surveillance companies to abuse just as they've abused social security numbers, driver's license numbers, and even phone numbers.
- dangerlibrary 4y ago
  One way to ensure something never gets done is to bog it down with a bunch of politically challenging prerequisites.
  - mindslight 4y ago
    It's already "bogged down" - I described a direct concern. Brushing that aside is equivalent to saying the concerns don't matter. Social security numbers were introduced for the sole purpose of administering the social security program. The protections on private entities abusing them were neutered, which is how we ended up with the backwards regime under discussion. People have a vague fear that social security numbers are important and shouldn't be casually shared, which is the only thing holding back (for example) grocery stores from demanding your social security number to get the regular prices. If say the US issued everyone a cryptographic identity via a smart card, there would be little stopping every single business from demanding that you scan this card. Imagine needing to link your singular legal identity to every single online service, so they could better associate your surveillance records. Big tech is currently doing its best to accomplish this through phone numbers, but at least it's possible to get additional phone numbers.
    - dangerlibrary 4y ago
      The nature of the problem you are describing (private companies having a more reliable unique ID to correlate data than phone number) seems incrementally worse than what we have today. In practice, most people rarely, if ever, change their phone number. I don't like that companies demand my phone number to get cheaper groceries, but in practice I just type in "(local area code) 867-5309" [1] into whatever terminal is asking for my phone number and get the discount 100% of the time. The consequences of the problem the proposal is trying to address seem larger to me. Currently, you can be denied access to capital and even basic financial services because identity management has been outsourced to unreliable third parties with no incentive to do a better job. [1] Sorry Jenny https://youtu.be/6WTdTwcmxyo https://youtu.be/6WTdTwcmxyo

gmac 4y ago

There's a nice sketch on this point by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E David Mitchell discusses it further here: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi...

TheRealDunkirk 4y ago

It's a generalized problem that American corporations have worked hand-in-hand with the government to make sure that they avoid the vast preponderance of legal culpability for any and all malfeasance they cause. You almost have to hand it to them. Almost. As with all systemic issues we face, we can't fix it until we "fix" Citizens United, and that -- as well as any other Constitutional Amendment these days -- will be nigh impossible.

kmeisthax 4y ago
In this particular case the corporations in question - banks - would love to see the problem solved too. They don't want to make fraudulent loans in other people's names. The problem is that America's government does not provide a strong form of identity. In fact, strong identity is culturally resisted: civil libertarians[0] have been adamant that America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier. Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. Names are quite common, people move all the time, phone numbers change and can get stolen, SSNs were specifically designed to be easily forgeable[1], most Americans do not have passports, not everyone has a US birth certificate, not everyone can get a driver's license, the ID-only cards you can get are intentionally designed to be a pain for the above two categories, etc. [0] This is also one of the few times where I don't have to distinguish between left- and right-wing libertarians either. [1] If you were born before 2011 you can obtain valid SSNs by incrementing or decrementing the last four digits of your own. You will get the SSN of someone else who was born in the same hospital as you. The first five digits are just a function of the state the SSN was issued in and when you were born. There is no check digit, they only started randomly issuing numbers in 2011, and even then it does not matter because compromised SSNs are never reissued unless you are an FBI informant.
- carapace 4y ago
  > America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier. No, it makes establishing trustworthy business transactions slightly harder. Only slightly, and the necessary technology has been off-the-shelf for some time now. > Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. The folks at my local credit union and I know each other personally. It would take a "Mission Impossible"-style impersonation to get them to succumb to fraud ("identity theft".)

vel0city 4y ago

> a random symmetric 9 digit number some government assigned me SSNs aren't even that random, they're very deterministically generated for the most part. If you know when and where someone was born its not too hard to guess the first 5 digits or so, meanwhile the last four digits are routinely shown places.

Caligatio 4y ago
The geographic numbering scheme was thankfully stopped for anyone born in June 2011 or later ( https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html)
- vel0city 4y ago
  Wonderful news. Now its more challenging to steal an 11 year old's information :) Thanks for sharing this!

hereforphone 4y ago

If someone somehow hacks your brokerage account and steals everything, you may be completely out of luck. The bank will consider it your fault, not theirs, unless it's a mass hack (multiple accounts). The law will probably agree with them, and you'll be out your savings.

seanhunter 4y ago

Totally agree. As an example of how little companies do in these cases to verify things and how lazy they are about ensuring when they pursue claims that they are doing so against the relevant person, here's my story. Some time ago someone obviously signed a gas contract for a company and just put my home address as the billing address. The first I heard about it was when I received a gas bill for a property that I have absolutely no connection with. It was addressed to a company I have no connnection with at my home address. I've lived in the same house for over 10 years and this company has never been associated with my address in that time. I don't think it was before either but w/e. I accidentally opened this bill because I receive a lot of mail and didn't realise it was incorrectly addressed. Having seen that it was the wrong thing I wrote to the company explaining their mistake. I also gave them the name and address of the actual officers of the company who had the debt (this is public information in the UK where I live). I didn't hear back except that I received 3 or 4 more bills all of which I returned to sender. A few months later I received a legal letter from a collections firm saying they had been engaged to collect this debt and I had to pay up or they would take me to court. I wrote to them explaining the situation saying that this debt, company and the property and debt underlying the address was nothing whatsoever to do with me and that I had written to the creditor to that effect some time ago. I didn't hear back until a few months later, when I received another legal letter from a different person at the same collections firm basically repeating the threat to take me to court. I wrote to them again and also called them up to explain. The person at the collections agency thanked me for calling and said they would deal with the matter. A few more bills arrived. I returned them to sender (at least once in an envelope with a covering letter explaining the situation again). Then I received a notice saying a default court judgement had been entered and that the bill had to be paid. I wrote to them again and said they had to stop harrassing me and actually pursue the collection against someone associated with the actual company. It was super clear that at no time did anyone associated with either the original creditor or the collections agency make the slightest effort to actually try to collect this debt from someone who was actually responsible for it. This is in spite of the fact that I spoonfed them the names and addresses of actual people who were associated with the company responsible etc. This situation could also never have occurred if they had actually made any effort at all to check whether the company was associated with the billing address.

Nextgrid 4y ago

It's true but part of the problem is also that people submit to it. The credit system "works" because for the most part, the information they provide is legitimate enough, to the detriment of victims of fraud who now have to prove their innocence. If people with the means (those that have "fuck you" money and can afford to walk away) suddenly turn around and say "nope" and are happy to have bad/fraudulent credit, the entire credit system collapses - banks need to lend to survive and if the credit system stops being useful in verifying someone's creditworthiness (because even creditworthy people's records are contaminated with bad/fraudulent data) then banks will switch to a different system that doesn't have these problems (and that system could be to manually search for bankruptcy records and evaluating proofs of income, like it's done in many European countries), or lose out to those who switch because the "fuck you money" people will prefer them as they're willing to ignore the credit history system and use alternative means of evaluating creditworthiness. Of course, a legal solution that outlaws this privacy nightmare is best, but that's a lost cause in the US. The market-based approach described above is more likely to work.