8 ms·

> That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot ta

> That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are. What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that. Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against. Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.

dt3ft 4y ago
In Sweden, this information is public.
- sigmoid10 4y ago
  I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.
  - omnicognate 4y ago
    Several bank loans and store cards were taken out in my name using only my name, address and date of birth, in the UK. The same cynical business logic applies the world over: it's cheaper to clean up after the inevitable fraud than to implement proper identity checks. This calculus is of course aided by the fact that the detection of the fraud and the organising of the cleanup is taken care of entirely by the victim. "Victim", not "customer", because usually there is no business relationship between the company with the shitty identity checks and the person that has to live with the consequences. I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object. [1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/HowdoIaddaprotectivepasswordtomycreditreport https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...
    - Nextgrid 4y ago
      The fact that the UK has this nasty concept of “credit history” helps with this, since now all that’s needed to take out credit is basic details to lookup the credit bureau profile and then they “vouch” for you. In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified. Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example). With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.
      - jamiek88 4y ago
        You’d have to see it to believe it how easy and normal credit is over here in USA. Even coming from uk it surprised me. You can even buy tyres on tick. That only works because of low friction lending.
    - deleted 4y ago
      [deleted]
    - b800h 4y ago
      Lenders are "encouraged" to check the password. In your experience, how frequently do they do so?
  - ajsnigrutin 4y ago
    In slovenia, you have your name, surname and date of birth, but also unique citizen number (EMŠO) and your personal tax number. They tell you not to tell anyone your EMŠO... but EMŠO is generated from your date of birth, gender, former yugoslav republic you were born in (slovenia=50) and the sequental number of your birth that day (0-499 boys, 500-999 girls)... plus a checksum. So if you were born in slovenia, are a boy, and were a third boy born on 20th december 1970 (970... because why waste numbers?!?!), your emšo would be 201297050003K (K=checksum, too lazy to calculate). We also have a tax number, that they also tell you not to share... but then you open up an independent contractor business (technically, it's a not a seprate company, but "you" are the company), and your personal tax number is published in many many online systems, info pages, you have to put it on receipts, ads, you have to tell it when you're buying toilet paper for work use, etc. But yeah... if you want to open a bank account, you need a government issued id card (or passport), and they check it very very throughly.
    - AstralStorm 4y ago
      Polish PESEL has the same problem of only having 5 numbers per day, one of which is also checksum so limited. Tax number NIP is relatively public, any relevant accountant will have it. The remaining secret thing is indeed the ID card and/or the passport. That's why if it ever gets lost or stolen you're supposed to immediately file for a replacement. Theoretically at that point someone might impersonate you.
- reaperducer 4y ago
  I always find it curious that allegedly Swedish people on HN post this sentiment over and over, but then never link to their own personal information. Why not share, if it's so harmless? Isn't that the point you're trying to make?
  - plugin-baby 4y ago
    Maybe they don’t want their identity and their opinions to be linked.
  - capableweb 4y ago
    I'm not Swedish, but a friend of mine showed me a website for it. Here is a random example of a person who lives in Täby, Sweden: https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/0NtmTRHQ_UPVAeg75zpXwEra1s7sMSEASqfupT1TuvI https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/... > Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86 The website also adds information about income: > (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year. If the person runs any companies, that would be visible as well. All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)
- nibbleshifter 4y ago
  Which is absolutely demented.
cush 4y ago
> I wish we could stop propagating the idea that it's possible to "steal someone's identity" Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality. It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data
- dec0dedab0de 4y ago
  There was a push a while back to call it bank fraud. Because the banks are the victims and should be responsible to protect/insure themselves. By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them. Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.
  - deleted 4y ago
    [deleted]
  - cush 4y ago
    Every bank I deal with (3 of them) take responsibility for any claims from identity theft/bank fraud. Looks like the push worked!
  - jen20 4y ago
    > I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel. This is interesting - do you know if it has ever been tested?
    - buildbot 4y ago
      I’d donate to gofundme for the legal costs next time it comes up…
    - dec0dedab0de 4y ago
      I don't know, and I don't even remember where I heard it, I think it was on here but I dont know. I think maybe I was wrong about 'bank fraud' and the term being pushed was 'bank libel' instead of identity theft. Because all the negative sides of supposed 'identity theft' were from the banks saying the individual did something they did not.
LtWorf 4y ago
I think it's way more common in USA than in europe because here you can't just phone a bank and open an account with your tax agency code. Normally the first time you need to go and show your id.
- EVa5I7bHFq9mnYK 4y ago
  SSN is certainly not enough. I just recently opened 4 accounts with US banks remotely. All four requested to send them pictures of both sides of my ID card + my selfie holding said ID card. And there were additional steps to confirm my identity before activating the accounts.
  - AstralStorm 4y ago
    All of this thanks to KYC anti money laundering regulation.
  - LtWorf 4y ago
    Can't you easily forge that?
    - deleted 4y ago
      [deleted]
    - EVa5I7bHFq9mnYK 4y ago
      Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.
derefr 4y ago
You could take someone's identity details and use them to get a death certificate made. This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead. Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."
- jamiek88 4y ago
  Undeading yourself in some societies ain’t trivial either. In others it’s nigh on impossible. India has/had a loophole that scammers use to declare someone dead and steal their property.
  - hanche 4y ago
    See: Uttar Pradesh Association of Dead People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_Dead_People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...
  - vinay_ys 4y ago
    Source? With biometric identity system Aadhaar and 2FA auth for everything I find this hard to believe.
- gzer0 4y ago
  If someone does that- creates a fake 'death certificate' in my name via publicly accessible information and it actually goes through, how do you even go about trying to fix that? is this even fixable?
  - AstralStorm 4y ago
    Here in Poland they would need that person's ID number and a fake signature plus data of an accredited doctor. (Both of which is easiest done by compromising a doctor fully. They have access to ID database.)
chefandy 4y ago
Semantics. Nobody thinks your password being stolen means someone actually takes it from you or your device getting hacked means someone inflicted a physical blow with a sharp object. Someone illegitimately uses your personal information to claim your identity in recipt of goods and services. They stole your identification information to impersonate you.
- recursive 4y ago
  And framing. "Identity theft" makes it sounds like you lost something. In reality, it's the financial institution that lost something.
  - chefandy 4y ago
    If someone stole your idea, did you lose something tangible? Also, crimes generally consider cause and effect, including indirect effects if they're foreseeable. Is having to expend time, energy, and perhaps resources to protect the usage of information institutions use to identify you an unexpected side effect? Is it worth nothing? Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.
- lolinder 4y ago
  "Semantics" is an extremely lazy way to dismiss an argument. Semantics is all that really matters in communication: what is the meaning of what is said? There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.
  - 4y ago
sorokod 4y ago
Mitchell and Webb on identify theft https://m.youtube.com/watch?v=-c57WKxeELY https://m.youtube.com/watch?v=-c57WKxeELY

dt3ft 4y ago

In Sweden, this information is public.

sigmoid10 4y ago
I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.
- omnicognate 4y ago
  Several bank loans and store cards were taken out in my name using only my name, address and date of birth, in the UK. The same cynical business logic applies the world over: it's cheaper to clean up after the inevitable fraud than to implement proper identity checks. This calculus is of course aided by the fact that the detection of the fraud and the organising of the cleanup is taken care of entirely by the victim. "Victim", not "customer", because usually there is no business relationship between the company with the shitty identity checks and the person that has to live with the consequences. I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object. [1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/HowdoIaddaprotectivepasswordtomycreditreport https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...
  - Nextgrid 4y ago
    The fact that the UK has this nasty concept of “credit history” helps with this, since now all that’s needed to take out credit is basic details to lookup the credit bureau profile and then they “vouch” for you. In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified. Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example). With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.
    - jamiek88 4y ago
      You’d have to see it to believe it how easy and normal credit is over here in USA. Even coming from uk it surprised me. You can even buy tyres on tick. That only works because of low friction lending.
  - deleted 4y ago
    [deleted]
  - b800h 4y ago
    Lenders are "encouraged" to check the password. In your experience, how frequently do they do so?
- ajsnigrutin 4y ago
  In slovenia, you have your name, surname and date of birth, but also unique citizen number (EMŠO) and your personal tax number. They tell you not to tell anyone your EMŠO... but EMŠO is generated from your date of birth, gender, former yugoslav republic you were born in (slovenia=50) and the sequental number of your birth that day (0-499 boys, 500-999 girls)... plus a checksum. So if you were born in slovenia, are a boy, and were a third boy born on 20th december 1970 (970... because why waste numbers?!?!), your emšo would be 201297050003K (K=checksum, too lazy to calculate). We also have a tax number, that they also tell you not to share... but then you open up an independent contractor business (technically, it's a not a seprate company, but "you" are the company), and your personal tax number is published in many many online systems, info pages, you have to put it on receipts, ads, you have to tell it when you're buying toilet paper for work use, etc. But yeah... if you want to open a bank account, you need a government issued id card (or passport), and they check it very very throughly.
  - AstralStorm 4y ago
    Polish PESEL has the same problem of only having 5 numbers per day, one of which is also checksum so limited. Tax number NIP is relatively public, any relevant accountant will have it. The remaining secret thing is indeed the ID card and/or the passport. That's why if it ever gets lost or stolen you're supposed to immediately file for a replacement. Theoretically at that point someone might impersonate you.
reaperducer 4y ago
I always find it curious that allegedly Swedish people on HN post this sentiment over and over, but then never link to their own personal information. Why not share, if it's so harmless? Isn't that the point you're trying to make?
- plugin-baby 4y ago
  Maybe they don’t want their identity and their opinions to be linked.
- capableweb 4y ago
  I'm not Swedish, but a friend of mine showed me a website for it. Here is a random example of a person who lives in Täby, Sweden: https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/0NtmTRHQ_UPVAeg75zpXwEra1s7sMSEASqfupT1TuvI https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/... > Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86 The website also adds information about income: > (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year. If the person runs any companies, that would be visible as well. All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)
nibbleshifter 4y ago
Which is absolutely demented.

cush 4y ago

> I wish we could stop propagating the idea that it's possible to "steal someone's identity" Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality. It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data

dec0dedab0de 4y ago
There was a push a while back to call it bank fraud. Because the banks are the victims and should be responsible to protect/insure themselves. By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them. Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.
- deleted 4y ago
  [deleted]
- cush 4y ago
  Every bank I deal with (3 of them) take responsibility for any claims from identity theft/bank fraud. Looks like the push worked!
- jen20 4y ago
  > I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel. This is interesting - do you know if it has ever been tested?
  - buildbot 4y ago
    I’d donate to gofundme for the legal costs next time it comes up…
  - dec0dedab0de 4y ago
    I don't know, and I don't even remember where I heard it, I think it was on here but I dont know. I think maybe I was wrong about 'bank fraud' and the term being pushed was 'bank libel' instead of identity theft. Because all the negative sides of supposed 'identity theft' were from the banks saying the individual did something they did not.

LtWorf 4y ago

I think it's way more common in USA than in europe because here you can't just phone a bank and open an account with your tax agency code. Normally the first time you need to go and show your id.

EVa5I7bHFq9mnYK 4y ago
SSN is certainly not enough. I just recently opened 4 accounts with US banks remotely. All four requested to send them pictures of both sides of my ID card + my selfie holding said ID card. And there were additional steps to confirm my identity before activating the accounts.
- AstralStorm 4y ago
  All of this thanks to KYC anti money laundering regulation.
- LtWorf 4y ago
  Can't you easily forge that?
  - deleted 4y ago
    [deleted]
  - EVa5I7bHFq9mnYK 4y ago
    Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.

derefr 4y ago

You could take someone's identity details and use them to get a death certificate made. This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead. Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."

jamiek88 4y ago
Undeading yourself in some societies ain’t trivial either. In others it’s nigh on impossible. India has/had a loophole that scammers use to declare someone dead and steal their property.
- hanche 4y ago
  See: Uttar Pradesh Association of Dead People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_Dead_People https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...
- vinay_ys 4y ago
  Source? With biometric identity system Aadhaar and 2FA auth for everything I find this hard to believe.
gzer0 4y ago
If someone does that- creates a fake 'death certificate' in my name via publicly accessible information and it actually goes through, how do you even go about trying to fix that? is this even fixable?
- AstralStorm 4y ago
  Here in Poland they would need that person's ID number and a fake signature plus data of an accredited doctor. (Both of which is easiest done by compromising a doctor fully. They have access to ID database.)

chefandy 4y ago

Semantics. Nobody thinks your password being stolen means someone actually takes it from you or your device getting hacked means someone inflicted a physical blow with a sharp object. Someone illegitimately uses your personal information to claim your identity in recipt of goods and services. They stole your identification information to impersonate you.

recursive 4y ago
And framing. "Identity theft" makes it sounds like you lost something. In reality, it's the financial institution that lost something.
- chefandy 4y ago
  If someone stole your idea, did you lose something tangible? Also, crimes generally consider cause and effect, including indirect effects if they're foreseeable. Is having to expend time, energy, and perhaps resources to protect the usage of information institutions use to identify you an unexpected side effect? Is it worth nothing? Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.
lolinder 4y ago
"Semantics" is an extremely lazy way to dismiss an argument. Semantics is all that really matters in communication: what is the meaning of what is said? There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.
- 4y ago

sorokod 4y ago

Mitchell and Webb on identify theft https://m.youtube.com/watch?v=-c57WKxeELY https://m.youtube.com/watch?v=-c57WKxeELY