9 ms·

> but in some cases, may have affected information such as name, contact and demographic information, date of birth, and That's all you need to steal someone'

> but in some cases, may have affected information such as name, contact and demographic information, date of birth, and That's all you need to steal someone's identity. Major reason why I never give any website my real birthday, and use a password manager to remember all the various "birthdays" I've been required to provide for no ostensible reason. If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday (e.g., legal reason to validate you're old enough to open a bank account or whatever), not "i want to send a happy birthday newsletter every year (and also sell it in a package to data brokers)"

capableweb 4y ago
> That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are. What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that. Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against. Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.
- dt3ft 4y ago
  In Sweden, this information is public.
  - sigmoid10 4y ago
    I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.
    - omnicognate 4y ago
      Several bank loans and store cards were taken out in my name using only my name, address and date of birth, in the UK. The same cynical business logic applies the world over: it's cheaper to clean up after the inevitable fraud than to implement proper identity checks. This calculus is of course aided by the fact that the detection of the fraud and the organising of the cleanup is taken care of entirely by the victim. "Victim", not "customer", because usually there is no business relationship between the company with the shitty identity checks and the person that has to live with the consequences. I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object. [1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/HowdoIaddaprotectivepasswordtomycreditreport https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...
      - Nextgrid 4y ago
        The fact that the UK has this nasty concept of “credit history” helps with this, since now all that’s needed to take out credit is basic details to lookup the credit bureau profile and then they “vouch” for you. In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified. Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example). With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.
  - reaperducer 4y ago
    I always find it curious that allegedly Swedish people on HN post this sentiment over and over, but then never link to their own personal information. Why not share, if it's so harmless? Isn't that the point you're trying to make?
    - plugin-baby 4y ago
      Maybe they don’t want their identity and their opinions to be linked.
    - capableweb 4y ago
      I'm not Swedish, but a friend of mine showed me a website for it. Here is a random example of a person who lives in Täby, Sweden: https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/0NtmTRHQ_UPVAeg75zpXwEra1s7sMSEASqfupT1TuvI https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/... > Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86 The website also adds information about income: > (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year. If the person runs any companies, that would be visible as well. All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)
  - nibbleshifter 4y ago
    Which is absolutely demented.
- cush 4y ago
  > I wish we could stop propagating the idea that it's possible to "steal someone's identity" Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality. It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data
  - dec0dedab0de 4y ago
    There was a push a while back to call it bank fraud. Because the banks are the victims and should be responsible to protect/insure themselves. By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them. Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.
    - deleted 4y ago
      [deleted]
    - cush 4y ago
      Every bank I deal with (3 of them) take responsibility for any claims from identity theft/bank fraud. Looks like the push worked!
    - jen20 4y ago
      > I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel. This is interesting - do you know if it has ever been tested?
      - buildbot 4y ago
        I’d donate to gofundme for the legal costs next time it comes up…
      - dec0dedab0de 4y ago
        I don't know, and I don't even remember where I heard it, I think it was on here but I dont know. I think maybe I was wrong about 'bank fraud' and the term being pushed was 'bank libel' instead of identity theft. Because all the negative sides of supposed 'identity theft' were from the banks saying the individual did something they did not.
- LtWorf 4y ago
  I think it's way more common in USA than in europe because here you can't just phone a bank and open an account with your tax agency code. Normally the first time you need to go and show your id.
  - EVa5I7bHFq9mnYK 4y ago
    SSN is certainly not enough. I just recently opened 4 accounts with US banks remotely. All four requested to send them pictures of both sides of my ID card + my selfie holding said ID card. And there were additional steps to confirm my identity before activating the accounts.
    - AstralStorm 4y ago
      All of this thanks to KYC anti money laundering regulation.
    - LtWorf 4y ago
      Can't you easily forge that?
      - deleted 4y ago
        [deleted]
      - EVa5I7bHFq9mnYK 4y ago
        Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.
- derefr 4y ago
  You could take someone's identity details and use them to get a death certificate made. This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead. Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."
  - jamiek88 4y ago
    Undeading yourself in some societies ain’t trivial either. In others it’s nigh on impossible. India has/had a loophole that scammers use to declare someone dead and steal their property.
    - hanche 4y ago
      See: Uttar Pradesh Association of Dead People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_Dead_People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...
    - vinay_ys 4y ago
      Source? With biometric identity system Aadhaar and 2FA auth for everything I find this hard to believe.
  - gzer0 4y ago
    If someone does that- creates a fake 'death certificate' in my name via publicly accessible information and it actually goes through, how do you even go about trying to fix that? is this even fixable?
    - AstralStorm 4y ago
      Here in Poland they would need that person's ID number and a fake signature plus data of an accredited doctor. (Both of which is easiest done by compromising a doctor fully. They have access to ID database.)
- chefandy 4y ago
  Semantics. Nobody thinks your password being stolen means someone actually takes it from you or your device getting hacked means someone inflicted a physical blow with a sharp object. Someone illegitimately uses your personal information to claim your identity in recipt of goods and services. They stole your identification information to impersonate you.
  - recursive 4y ago
    And framing. "Identity theft" makes it sounds like you lost something. In reality, it's the financial institution that lost something.
    - chefandy 4y ago
      If someone stole your idea, did you lose something tangible? Also, crimes generally consider cause and effect, including indirect effects if they're foreseeable. Is having to expend time, energy, and perhaps resources to protect the usage of information institutions use to identify you an unexpected side effect? Is it worth nothing? Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.
  - lolinder 4y ago
    "Semantics" is an extremely lazy way to dismiss an argument. Semantics is all that really matters in communication: what is the meaning of what is said? There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.
    - 4y ago
- sorokod 4y ago
  Mitchell and Webb on identify theft https://m.youtube.com/watch?v=-c57WKxeELY https://m.youtube.com/watch?v=-c57WKxeELY
traceroute66 4y ago
> If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday Not much help for the American cousins, but this already exists throughout Europe and has done for years .... its called GDPR. TL;DR : If it is or it is tied to PII (personally identifiable information) you have to: (a) Justify collecting it in the first place (b) Justify storing it, and storing it no longer than necessary (c) Obey with the "right to be forgotten" and delete it on request
- ItsTooMuch 4y ago
  You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers - that of course overrides GDPR, or more precisely, the law is the reason to store the information so there's no need to find other reasons. Also, don't forget that these laws also have requirements on you keeping logs, most of the time 3, 5 or more years. So yeah you have to obey a deletion request when that time is up, not "on request" - that would be illegal in most cases. In many EU countries birthdate (and more) is public information, btw - my own birthdate is made public by the state itself (on the business registry website), together with my name and residence address. Same for any owner of real estate - be it land, house or unit - names, residence addresses and birthdates are publicly available in the online cadastre.
  - tcmb 4y ago
    > You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers That is simply not true, not in this very general formulation. What businesses does this statement of yours apply to? It's certainly not common for an ecommerce site to ask for your birthday on signup.
    - ItsTooMuch 4y ago
      Any online service thanks to DSA, for example: Anything that children might use (yes, so everything - intent doesn't count). Anything where users can upload content (writing comments is enough according to our lawyer). You picked about the only remaining thing where it's not always a requirement. It's a requirement even there if the transaction is over certain threshold (varies by local law, usually around 10k EUR) or certain categories of items (drugs, alcohol, tobacco-related, sextoys, weapons etc).
QuarterReptile 4y ago
I don't spend much of my time worrying about this, but if you do: Put credit freezes on yourself and maintain them that way as the default. This cuts your attack surface significantly. Plant your flag with any large government entities that are used for collecting benefits (IRS, your state's stuff, etc.) Do I love the state of affairs? No, but if it were something I worried about, I'd at least make myself a hard target.
- busymom0 4y ago
  > Plant your flag with any large government entities that are used for collecting benefits What does this mean?
  - sillystuff 4y ago
    I think GP means create your account on these sites before a fraudster does it for you. I.e., if you already have an account, they need your login credentials to access your account. But, if you have not established an account, they can often establish a new account using nothing but publicly available data like your birthday and street address for identity verification, then access your data (IRS experienced a lot of fraudulent accounts being created to steal peoples' tax refunds; their new verification system is less susceptible, but IMO too invasive [biometric data]).
  - QuarterReptile 4y ago
    Sillystuff answered correctly.
- sillystuff 4y ago
  There are _a lot_ of credit reporting agencies to place freezes with. I put freezes at several credit reporting agencies. It took quite a bit of time to work through a small subset of this list: https://www.consumerlawfirm.com/credit-reporting-agencies.htm https://www.consumerlawfirm.com/credit-reporting-agencies.ht... 'Nationwide', 'Check and Bank' and 'Supplimentary/Alternative' are probably the minimum. I wish we had privacy and security by default instead of "opt in"
encryptluks2 4y ago
There needs to be better laws protecting individuals that use aliases and what not for registration. Technically, there are certain federal laws that can make doing so illegal in certain circumstances.. while not enforced at a high rate, I do see them occasionally being applied unfairly and don't like knowing that by using aliases and what not that I could be opening myself to criminal prosecutions.
icedchai 4y ago
That info is generally already public and easily accessible. Try googling yourself or a relative. You can find their date of birth, address, phone numbers, and neighbors in a couple of minutes.
YetAnotherNick 4y ago
> That's all you need to steal someone's identity I have this information for many billionaires. Now tell me how to steal their identity. I would like to live their life.
kerneloops 4y ago
I usually give them 1970/1/1 as my birthday. That's easier to remember, since password managers don't work well with date inputs sometimes.
systemvoltage 4y ago
This is a game of whack-a-mole, and no amount of regulation will help if the fundamental identity is founded up on bits of information like this. We should pass regulation for verification of identity using secure means, not giving out SSN + Birthday and call it a day. This is making the problem worse I think.
rtev 4y ago
This information is immediately available for anyone in the country, after they turn 18, via whitepages. This security via obscurity effort isn’t providing any meaningful protection.

capableweb 4y ago

> That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are. What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that. Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against. Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.

dt3ft 4y ago
In Sweden, this information is public.
- sigmoid10 4y ago
  I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.
  - omnicognate 4y ago
    Several bank loans and store cards were taken out in my name using only my name, address and date of birth, in the UK. The same cynical business logic applies the world over: it's cheaper to clean up after the inevitable fraud than to implement proper identity checks. This calculus is of course aided by the fact that the detection of the fraud and the organising of the cleanup is taken care of entirely by the victim. "Victim", not "customer", because usually there is no business relationship between the company with the shitty identity checks and the person that has to live with the consequences. I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object. [1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/HowdoIaddaprotectivepasswordtomycreditreport https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...
    - Nextgrid 4y ago
      The fact that the UK has this nasty concept of “credit history” helps with this, since now all that’s needed to take out credit is basic details to lookup the credit bureau profile and then they “vouch” for you. In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified. Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example). With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.
- reaperducer 4y ago
  I always find it curious that allegedly Swedish people on HN post this sentiment over and over, but then never link to their own personal information. Why not share, if it's so harmless? Isn't that the point you're trying to make?
  - plugin-baby 4y ago
    Maybe they don’t want their identity and their opinions to be linked.
  - capableweb 4y ago
    I'm not Swedish, but a friend of mine showed me a website for it. Here is a random example of a person who lives in Täby, Sweden: https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/0NtmTRHQ_UPVAeg75zpXwEra1s7sMSEASqfupT1TuvI https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/... > Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86 The website also adds information about income: > (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year. If the person runs any companies, that would be visible as well. All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)
- nibbleshifter 4y ago
  Which is absolutely demented.
cush 4y ago
> I wish we could stop propagating the idea that it's possible to "steal someone's identity" Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality. It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data
- dec0dedab0de 4y ago
  There was a push a while back to call it bank fraud. Because the banks are the victims and should be responsible to protect/insure themselves. By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them. Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.
  - deleted 4y ago
    [deleted]
  - cush 4y ago
    Every bank I deal with (3 of them) take responsibility for any claims from identity theft/bank fraud. Looks like the push worked!
  - jen20 4y ago
    > I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel. This is interesting - do you know if it has ever been tested?
    - buildbot 4y ago
      I’d donate to gofundme for the legal costs next time it comes up…
    - dec0dedab0de 4y ago
      I don't know, and I don't even remember where I heard it, I think it was on here but I dont know. I think maybe I was wrong about 'bank fraud' and the term being pushed was 'bank libel' instead of identity theft. Because all the negative sides of supposed 'identity theft' were from the banks saying the individual did something they did not.
LtWorf 4y ago
I think it's way more common in USA than in europe because here you can't just phone a bank and open an account with your tax agency code. Normally the first time you need to go and show your id.
- EVa5I7bHFq9mnYK 4y ago
  SSN is certainly not enough. I just recently opened 4 accounts with US banks remotely. All four requested to send them pictures of both sides of my ID card + my selfie holding said ID card. And there were additional steps to confirm my identity before activating the accounts.
  - AstralStorm 4y ago
    All of this thanks to KYC anti money laundering regulation.
  - LtWorf 4y ago
    Can't you easily forge that?
    - deleted 4y ago
      [deleted]
    - EVa5I7bHFq9mnYK 4y ago
      Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.
derefr 4y ago
You could take someone's identity details and use them to get a death certificate made. This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead. Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."
- jamiek88 4y ago
  Undeading yourself in some societies ain’t trivial either. In others it’s nigh on impossible. India has/had a loophole that scammers use to declare someone dead and steal their property.
  - hanche 4y ago
    See: Uttar Pradesh Association of Dead People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_Dead_People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...
  - vinay_ys 4y ago
    Source? With biometric identity system Aadhaar and 2FA auth for everything I find this hard to believe.
- gzer0 4y ago
  If someone does that- creates a fake 'death certificate' in my name via publicly accessible information and it actually goes through, how do you even go about trying to fix that? is this even fixable?
  - AstralStorm 4y ago
    Here in Poland they would need that person's ID number and a fake signature plus data of an accredited doctor. (Both of which is easiest done by compromising a doctor fully. They have access to ID database.)
chefandy 4y ago
Semantics. Nobody thinks your password being stolen means someone actually takes it from you or your device getting hacked means someone inflicted a physical blow with a sharp object. Someone illegitimately uses your personal information to claim your identity in recipt of goods and services. They stole your identification information to impersonate you.
- recursive 4y ago
  And framing. "Identity theft" makes it sounds like you lost something. In reality, it's the financial institution that lost something.
  - chefandy 4y ago
    If someone stole your idea, did you lose something tangible? Also, crimes generally consider cause and effect, including indirect effects if they're foreseeable. Is having to expend time, energy, and perhaps resources to protect the usage of information institutions use to identify you an unexpected side effect? Is it worth nothing? Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.
- lolinder 4y ago
  "Semantics" is an extremely lazy way to dismiss an argument. Semantics is all that really matters in communication: what is the meaning of what is said? There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.
  - 4y ago
sorokod 4y ago
Mitchell and Webb on identify theft https://m.youtube.com/watch?v=-c57WKxeELY https://m.youtube.com/watch?v=-c57WKxeELY

traceroute66 4y ago

> If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday Not much help for the American cousins, but this already exists throughout Europe and has done for years .... its called GDPR. TL;DR : If it is or it is tied to PII (personally identifiable information) you have to: (a) Justify collecting it in the first place (b) Justify storing it, and storing it no longer than necessary (c) Obey with the "right to be forgotten" and delete it on request

ItsTooMuch 4y ago
You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers - that of course overrides GDPR, or more precisely, the law is the reason to store the information so there's no need to find other reasons. Also, don't forget that these laws also have requirements on you keeping logs, most of the time 3, 5 or more years. So yeah you have to obey a deletion request when that time is up, not "on request" - that would be illegal in most cases. In many EU countries birthdate (and more) is public information, btw - my own birthdate is made public by the state itself (on the business registry website), together with my name and residence address. Same for any owner of real estate - be it land, house or unit - names, residence addresses and birthdates are publicly available in the online cadastre.
- tcmb 4y ago
  > You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers That is simply not true, not in this very general formulation. What businesses does this statement of yours apply to? It's certainly not common for an ecommerce site to ask for your birthday on signup.
  - ItsTooMuch 4y ago
    Any online service thanks to DSA, for example: Anything that children might use (yes, so everything - intent doesn't count). Anything where users can upload content (writing comments is enough according to our lawyer). You picked about the only remaining thing where it's not always a requirement. It's a requirement even there if the transaction is over certain threshold (varies by local law, usually around 10k EUR) or certain categories of items (drugs, alcohol, tobacco-related, sextoys, weapons etc).

QuarterReptile 4y ago

I don't spend much of my time worrying about this, but if you do: Put credit freezes on yourself and maintain them that way as the default. This cuts your attack surface significantly. Plant your flag with any large government entities that are used for collecting benefits (IRS, your state's stuff, etc.) Do I love the state of affairs? No, but if it were something I worried about, I'd at least make myself a hard target.

busymom0 4y ago
> Plant your flag with any large government entities that are used for collecting benefits What does this mean?
- sillystuff 4y ago
  I think GP means create your account on these sites before a fraudster does it for you. I.e., if you already have an account, they need your login credentials to access your account. But, if you have not established an account, they can often establish a new account using nothing but publicly available data like your birthday and street address for identity verification, then access your data (IRS experienced a lot of fraudulent accounts being created to steal peoples' tax refunds; their new verification system is less susceptible, but IMO too invasive [biometric data]).
- QuarterReptile 4y ago
  Sillystuff answered correctly.
sillystuff 4y ago
There are _a lot_ of credit reporting agencies to place freezes with. I put freezes at several credit reporting agencies. It took quite a bit of time to work through a small subset of this list: https://www.consumerlawfirm.com/credit-reporting-agencies.htm https://www.consumerlawfirm.com/credit-reporting-agencies.ht... 'Nationwide', 'Check and Bank' and 'Supplimentary/Alternative' are probably the minimum. I wish we had privacy and security by default instead of "opt in"

encryptluks2 4y ago

There needs to be better laws protecting individuals that use aliases and what not for registration. Technically, there are certain federal laws that can make doing so illegal in certain circumstances.. while not enforced at a high rate, I do see them occasionally being applied unfairly and don't like knowing that by using aliases and what not that I could be opening myself to criminal prosecutions.

icedchai 4y ago

That info is generally already public and easily accessible. Try googling yourself or a relative. You can find their date of birth, address, phone numbers, and neighbors in a couple of minutes.

YetAnotherNick 4y ago

> That's all you need to steal someone's identity I have this information for many billionaires. Now tell me how to steal their identity. I would like to live their life.

kerneloops 4y ago

I usually give them 1970/1/1 as my birthday. That's easier to remember, since password managers don't work well with date inputs sometimes.

systemvoltage 4y ago

This is a game of whack-a-mole, and no amount of regulation will help if the fundamental identity is founded up on bits of information like this. We should pass regulation for verification of identity using secure means, not giving out SSN + Birthday and call it a day. This is making the problem worse I think.

rtev 4y ago

This information is immediately available for anyone in the country, after they turn 18, via whitepages. This security via obscurity effort isn’t providing any meaningful protection.