4 ms·

I like the current model of risk management, but the problem is that if a bank is defrauded by someone pretending to be you, you’re on the hook. That is, the cr

I like the current model of risk management, but the problem is that if a bank is defrauded by someone pretending to be you, you’re on the hook. That is, the credit bureau doesn’t do a good enough job verifying identity.

mhb 4y ago
And it's completely ridiculous that that isn't entirely the bank's problem and you should be able to sue the credit agency for libel.
- kmonsen 4y ago
  It’s because they call it identity theft. It’s not the bank getting defrauded but you having your identity stolen. Someone steals $1000 from a bank, they come to you and say hi he said his name was kmonsen so we would like to get the money back from you.
- sokoloff 4y ago
  The credit agency is reporting what has been reported to them. If credit agency Foo correctly reports that “Bank A has reported to us that mhb is delinquent on their loan”, that’s not libel if the bank did report that and the agency has no reason to believe the underlying fact is untrue. (Once you start the dispute process, they stop saying that for a while until it’s resolved. My mental model is a lot of the dispute process is based on avoiding libel.)
  - mhb 4y ago
    In that case, yes. Not in the case of "identity theft" in which the person is incorrectly authenticated by the credit agency.
    - sokoloff 4y ago
      What does "authenticated" mean in this case? When I apply for credit, the credit is granted by a bank or financial institution. They are the ones responsible for authenticating that I am who I say I am, not the credit agency.
      - mhb 4y ago
        There is some interaction between the bank and the credit agency taking place regarding sokoloff. I don't know the details of how they identify which sokoloff they are discussing, but it doesn't seem particularly clever (DOB, last 4 of SSN?). Something in that interaction has led them to misidentify the person who wants money with the real sokoloff. Maybe it's the bank's fault. Maybe it's the credit agency's fault. It's not sokoloff's fault. If there is harm to sokoloff, in the future, by the credit agency representing that sokoloff's credit is not what it should be because the credit agency did a bad job authenticating an identity when the bank asked about it, it should be liable (and libel).
        sokoloff 4y ago
        If fake-sokoloff shows up to the bank, pretends to be sokoloff, the bank checks with the credit agency who says "yup, sokoloff is a good credit risk", and the bank gives fake-sokoloff money in part based on the premise that sokoloff is a good risk, I don't think the credit agency has done anything wrong there. The bank failed by authenticating fake-sokoloff as sokoloff. (I'm no fan of credit agencies, but I am a fan of correctly diagnosing system problems and assigning root cause to the right place in the system.) There is a second-order effect where it should be straightforward for sokoloff to repudiate a loan taken out by fake-sokoloff and incorrectly tagged to sokoloff. An agency failing to follow that process may then be liable of libel.
        mhb 4y ago
        There is a chain of authentication between fake-sokoloff and the credit agency. Maybe fake-sokoloff has tricked the bank due to the bank's weak security. Now the bank asks the credit agency for information about sokoloff by providing whatever weak metrics it has obtained. Both the bank and the credit agency have failed due to accepting weak metrics.
        mhb 4y ago
        Also, in future interactions, the credit agency makes representations to others about sokoloff's credit. Why should the standard of what they are able to say be set by the least secure report they have received from a bank? They hold themselves out to be a credit reporting company - not just an aggregator of hearsay.
StanislavPetrov 4y ago
>That is, the credit bureau doesn’t do a good enough job verifying identity. Credit bureaus routinely report false information and defame people based on false/unverified information that they don't even attempt to properly vet. If some random person called me on the phone and reported that you were a sex offender, and I dutifully repeated that to every job you applied for, every apartment you tried to rent and anyone else who asked me, I would be guilty of defaming you and responsible for damages. It should be no different for so-called credit reporting agencies.

mhb 4y ago

And it's completely ridiculous that that isn't entirely the bank's problem and you should be able to sue the credit agency for libel.

kmonsen 4y ago
It’s because they call it identity theft. It’s not the bank getting defrauded but you having your identity stolen. Someone steals $1000 from a bank, they come to you and say hi he said his name was kmonsen so we would like to get the money back from you.
sokoloff 4y ago
The credit agency is reporting what has been reported to them. If credit agency Foo correctly reports that “Bank A has reported to us that mhb is delinquent on their loan”, that’s not libel if the bank did report that and the agency has no reason to believe the underlying fact is untrue. (Once you start the dispute process, they stop saying that for a while until it’s resolved. My mental model is a lot of the dispute process is based on avoiding libel.)
- mhb 4y ago
  In that case, yes. Not in the case of "identity theft" in which the person is incorrectly authenticated by the credit agency.
  - sokoloff 4y ago
    What does "authenticated" mean in this case? When I apply for credit, the credit is granted by a bank or financial institution. They are the ones responsible for authenticating that I am who I say I am, not the credit agency.
    - mhb 4y ago
      There is some interaction between the bank and the credit agency taking place regarding sokoloff. I don't know the details of how they identify which sokoloff they are discussing, but it doesn't seem particularly clever (DOB, last 4 of SSN?). Something in that interaction has led them to misidentify the person who wants money with the real sokoloff. Maybe it's the bank's fault. Maybe it's the credit agency's fault. It's not sokoloff's fault. If there is harm to sokoloff, in the future, by the credit agency representing that sokoloff's credit is not what it should be because the credit agency did a bad job authenticating an identity when the bank asked about it, it should be liable (and libel).
      - sokoloff 4y ago
        If fake-sokoloff shows up to the bank, pretends to be sokoloff, the bank checks with the credit agency who says "yup, sokoloff is a good credit risk", and the bank gives fake-sokoloff money in part based on the premise that sokoloff is a good risk, I don't think the credit agency has done anything wrong there. The bank failed by authenticating fake-sokoloff as sokoloff. (I'm no fan of credit agencies, but I am a fan of correctly diagnosing system problems and assigning root cause to the right place in the system.) There is a second-order effect where it should be straightforward for sokoloff to repudiate a loan taken out by fake-sokoloff and incorrectly tagged to sokoloff. An agency failing to follow that process may then be liable of libel.
        mhb 4y ago
        There is a chain of authentication between fake-sokoloff and the credit agency. Maybe fake-sokoloff has tricked the bank due to the bank's weak security. Now the bank asks the credit agency for information about sokoloff by providing whatever weak metrics it has obtained. Both the bank and the credit agency have failed due to accepting weak metrics.
        mhb 4y ago
        Also, in future interactions, the credit agency makes representations to others about sokoloff's credit. Why should the standard of what they are able to say be set by the least secure report they have received from a bank? They hold themselves out to be a credit reporting company - not just an aggregator of hearsay.

StanislavPetrov 4y ago

>That is, the credit bureau doesn’t do a good enough job verifying identity. Credit bureaus routinely report false information and defame people based on false/unverified information that they don't even attempt to properly vet. If some random person called me on the phone and reported that you were a sex offender, and I dutifully repeated that to every job you applied for, every apartment you tried to rent and anyone else who asked me, I would be guilty of defaming you and responsible for damages. It should be no different for so-called credit reporting agencies.