5 ms·

Yeah, this confused me as well... Are these bots successfully completing FAFSA forms to the government? And the government is successfully generating ISIRs to

Yeah, this confused me as well... Are these bots successfully completing FAFSA forms to the government? And the government is successfully generating ISIRs to send to the schools? If yes, then this is a federal ID verification issue. If not, why are the schools sending aid payments sand ISIR? Or does CA run its own state-level aid programs that skip the federal forms completely (and botching the ID verification on their own)? Or are all of these effectively stolen IDs? Where the FAFSA and ISIR are for real people (but people who aren't actually students)? The article is missing a LOT of details, what a waste of time.

shusaku 1y ago
Identity theft is relatively common, so I’m not sure if their aid system should be considerable especially vulnerable or not.
- bee_rider 1y ago
  We need a better phrase, like “impersonation fraud” or something, which focuses on the two parties actually involved. You can’t actually steal somebody’s identity of course, they are just an uninvolved third party.
  - pixl97 1y ago
    Eh, I'd say it's a bit more complicated than that. Quite often the impersonator had nothing to do with the collection of the identity itself. There are people that 'copy' things like insecure online information around identity, but there are also people that physically steal things like drivers licenses and birth certificates. This is the stage of a crime that I'd consider actual identity theft. After that you have black market information brokers. They didn't capture the identities in the first place. They don't directly use the information to impersonate others and yet they are still complicit in a crime. Then you have the final stage of impersonation fraud as you state.
    - bee_rider 1y ago
      I want to be pedantic, it is not the identity they’ve stolen in the first case, but the documentation of the identity. A person’s identity is just intrinsically part of the person.
      - pixl97 1y ago
        >A person’s identity is just intrinsically part of the person. Is it? If I look at least somewhat like you, grab your ID, and stuff you in an incinerator then any ID system that does not take detailed biometrics will have no clue if I'm you or not. Saying identity is intrinsic is tantamount to saying "I am that I am". I mean, that's cool and all, but that tells me nothing about who you actually are. There is nothing intrinsic about your name for example. This can and does change for people. Again, same with location where you live. We spend our entire lives grown up and getting old, so how we look adapts. Then you get down to bio markers like fingerprints or dna, but these are recent inventions when it comes to human identification and take a fair bit of technology to use successfully.
- lolinder 1y ago
  There's no such thing as identity theft, it's all bank fraud or in this case student aid fraud. "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices. If the student aid system verifies identity by, for example, just validating that the applicants know a single 9-digit number that after the Equifax breach should be considered public information, that is a critical problem with their identity verification system and it should be patched.
  - tacass 1y ago
    I’ve long wondered why victims of this fraud don’t more often sue the institutions that granted fraudulent accounts, for any and all damages and cost incurred.
    - looofooo0 1y ago
      Read Ross Anderson book Security Eng., it deals a lot with these types of issues. In short, banks try not do anything about as long they do not have to pay for it. I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.
    - singleshot_ 1y ago
      Well, you’ve come to the right place. When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?” Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty. Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law. One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer. This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists). Corollary: open an account at every major bank to establish a duty-relationship everywhere. Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.
- atoav 1y ago
  Interestingly enough the US seems to have between 1.5 and 6 times more of such cases than Europe (the numbers I found are a little bit fuzzy and use probably different methodology when collected, so this could well be an entirely statistical phenomenom). I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of.
  - blizdiddy 1y ago
    We don’t have a national ID system, just a single, poorly suited Social Security number that’s been overloaded to serve as our entire identity in the eyes of the state. These numbers are effectively public knowledge, thanks to private credit agencies created to fill the gap when banks failed at risk assessment. We could’ve replaced this broken setup decades ago, but there’s a vested political interest in ensuring federal programs fail, to justify further privatization and the dismantling of social services. A proper national ID and strong privacy laws would be obvious policy wins, but that would require competent lawmakers. In my lifetime, the most consequential federal legislation has been the DMCA (1998), the Patriot Act (2001), and Obamacare (2010), which effectively marked the end of meaningful legislative power and the handoff of governance to the executive branch.
    - rgblambda 1y ago
      It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government. Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.
    - throwaway2037 1y ago
      What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)
    - 1y ago
b112 1y ago
Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals. This is even more likely to happen if you outsource part of the process.
- nobody9999 1y ago
  >Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals. This is even more likely to happen if you outsource part of the process. Often, posters on HN engage in pedophilia, tax evasion and satanic rituals. This is even more likely if you allow just anyone to create an account. That's ridiculous, right? Because I provide no evidence for my statement whatsoever. And yet, I manage to paint every HN user with that broad brush. It's an example of 'reductio ad absurdum'. If you have any evidence that your hypothesis is any more valid than mine, please do provide it. Otherwise, you're just smearing people without any reason except to validate your world view.
  - b112 1y ago
    Social engineering hacks are the primary hack. If you're not familiar with them, you aren't security conscious. SIM card swaps have been reportedly repeatedly, as being a social engineering hack. Often the exchange has been done via gift cards or crypto. More than one such hack resulted in millions being stolen. Your attack dog response is quite unwarranted. Why are you so upset at a generic comment, indicating that fraudulent identity verification can be done on both ends? Do you imagine that university admissions employees are perfect, uncorruptible? Is this some weird, US political minefield?
    - nobody9999 1y ago
      >Social engineering hacks are the primary hack. If you're not familiar with them, you aren't security conscious. You didn't say that financial aid administrators were being "socially engineered. Nor did you say that they had their SIMs swapped. Rather, you said[0]: "Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals." That might well be the case here. But unless you actually have even a shred of evidence (do you? if so, please provide it), you're painting thousands of people with the same broad brush. >Do you imagine that university admissions employees are perfect, uncorruptible? Is this some weird, US political minefield? I do not. But I also don't make completely unsupported accusations/attacks against random strangers as you did. Not a "political minefield" at all. You were just talking out of your ass and I called you on it. Full stop. [0] https://news.ycombinator.com/item?id=43924650 https://news.ycombinator.com/item?id=43924650
xienze 1y ago
[flagged]
- pixl97 1y ago
  I have a number of family members that work at different levels of government facing the public. Based on your rhetoric and their stories there's a high probability that you'd fall under the group I'd consider 'howlers'. What is that? The people that blame everyone else for problems without understanding any of the complexity of the system. Everything is some scary other persons fault. Then later they have to interface with the system after the laws they have promoted and they are aghast about how abusive the system has become. I got to see this in person just a few days ago. I was renewing my license in Texas and had a stack of all the proper identification that I needed because I triple checked online on what I'd actually need. In front of me was an older gentleman that evidently had waited till the last day to renew his license. He didn't have any of the needed documentation, in this case his birth certificate. The clerk told him that unless he had that record he could not renew. He was all pissed and storming out and said "I bet it was the democrats that make us do that!". It is this wild disconnect I see quite often where I see people that want others inconvenienced, you know people from other places or people that don't look the same, but proceed with shock when the rules apply to them also and start howling about it.
  - xienze 1y ago
    > He was all pissed and storming out and said "I bet it was the democrats that make us do that!". If your story is actually true, that man is somehow oblivious to the fact that Democrats are the ones always bringing up the “it’s so hard to get a driver’s license! And racist to require one for anything!” arguments. I’m not sure how you’ve come to the conclusion that I want to inconvenience people out of spite. I’d like to inconvenience illegal immigrants from getting their education subsidized by citizens. California wants the opposite.
    - pixl97 1y ago
      >If your story is actually true, Go in an sit around any precinct courthouse or state document renewal facility in Texas in the lobby for a week and you'll see it multiple times a week. It's not some particularly rare occurrence. The sovereign citizens are common too, and they really start howling commonly having to get escorted out.

shusaku 1y ago

Identity theft is relatively common, so I’m not sure if their aid system should be considerable especially vulnerable or not.

bee_rider 1y ago
We need a better phrase, like “impersonation fraud” or something, which focuses on the two parties actually involved. You can’t actually steal somebody’s identity of course, they are just an uninvolved third party.
- pixl97 1y ago
  Eh, I'd say it's a bit more complicated than that. Quite often the impersonator had nothing to do with the collection of the identity itself. There are people that 'copy' things like insecure online information around identity, but there are also people that physically steal things like drivers licenses and birth certificates. This is the stage of a crime that I'd consider actual identity theft. After that you have black market information brokers. They didn't capture the identities in the first place. They don't directly use the information to impersonate others and yet they are still complicit in a crime. Then you have the final stage of impersonation fraud as you state.
  - bee_rider 1y ago
    I want to be pedantic, it is not the identity they’ve stolen in the first case, but the documentation of the identity. A person’s identity is just intrinsically part of the person.
    - pixl97 1y ago
      >A person’s identity is just intrinsically part of the person. Is it? If I look at least somewhat like you, grab your ID, and stuff you in an incinerator then any ID system that does not take detailed biometrics will have no clue if I'm you or not. Saying identity is intrinsic is tantamount to saying "I am that I am". I mean, that's cool and all, but that tells me nothing about who you actually are. There is nothing intrinsic about your name for example. This can and does change for people. Again, same with location where you live. We spend our entire lives grown up and getting old, so how we look adapts. Then you get down to bio markers like fingerprints or dna, but these are recent inventions when it comes to human identification and take a fair bit of technology to use successfully.
lolinder 1y ago
There's no such thing as identity theft, it's all bank fraud or in this case student aid fraud. "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices. If the student aid system verifies identity by, for example, just validating that the applicants know a single 9-digit number that after the Equifax breach should be considered public information, that is a critical problem with their identity verification system and it should be patched.
- tacass 1y ago
  I’ve long wondered why victims of this fraud don’t more often sue the institutions that granted fraudulent accounts, for any and all damages and cost incurred.
  - looofooo0 1y ago
    Read Ross Anderson book Security Eng., it deals a lot with these types of issues. In short, banks try not do anything about as long they do not have to pay for it. I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.
  - singleshot_ 1y ago
    Well, you’ve come to the right place. When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?” Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty. Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law. One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer. This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists). Corollary: open an account at every major bank to establish a duty-relationship everywhere. Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.
atoav 1y ago
Interestingly enough the US seems to have between 1.5 and 6 times more of such cases than Europe (the numbers I found are a little bit fuzzy and use probably different methodology when collected, so this could well be an entirely statistical phenomenom). I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of.
- blizdiddy 1y ago
  We don’t have a national ID system, just a single, poorly suited Social Security number that’s been overloaded to serve as our entire identity in the eyes of the state. These numbers are effectively public knowledge, thanks to private credit agencies created to fill the gap when banks failed at risk assessment. We could’ve replaced this broken setup decades ago, but there’s a vested political interest in ensuring federal programs fail, to justify further privatization and the dismantling of social services. A proper national ID and strong privacy laws would be obvious policy wins, but that would require competent lawmakers. In my lifetime, the most consequential federal legislation has been the DMCA (1998), the Patriot Act (2001), and Obamacare (2010), which effectively marked the end of meaningful legislative power and the handoff of governance to the executive branch.
  - rgblambda 1y ago
    It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government. Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.
  - throwaway2037 1y ago
    What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)
  - 1y ago

b112 1y ago

Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals. This is even more likely to happen if you outsource part of the process.

nobody9999 1y ago
>Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals. This is even more likely to happen if you outsource part of the process. Often, posters on HN engage in pedophilia, tax evasion and satanic rituals. This is even more likely if you allow just anyone to create an account. That's ridiculous, right? Because I provide no evidence for my statement whatsoever. And yet, I manage to paint every HN user with that broad brush. It's an example of 'reductio ad absurdum'. If you have any evidence that your hypothesis is any more valid than mine, please do provide it. Otherwise, you're just smearing people without any reason except to validate your world view.
- b112 1y ago
  Social engineering hacks are the primary hack. If you're not familiar with them, you aren't security conscious. SIM card swaps have been reportedly repeatedly, as being a social engineering hack. Often the exchange has been done via gift cards or crypto. More than one such hack resulted in millions being stolen. Your attack dog response is quite unwarranted. Why are you so upset at a generic comment, indicating that fraudulent identity verification can be done on both ends? Do you imagine that university admissions employees are perfect, uncorruptible? Is this some weird, US political minefield?
  - nobody9999 1y ago
    >Social engineering hacks are the primary hack. If you're not familiar with them, you aren't security conscious. You didn't say that financial aid administrators were being "socially engineered. Nor did you say that they had their SIMs swapped. Rather, you said[0]: "Often issues such as this are the result of people involved in the verification process, being bribed or taking cash for approvals." That might well be the case here. But unless you actually have even a shred of evidence (do you? if so, please provide it), you're painting thousands of people with the same broad brush. >Do you imagine that university admissions employees are perfect, uncorruptible? Is this some weird, US political minefield? I do not. But I also don't make completely unsupported accusations/attacks against random strangers as you did. Not a "political minefield" at all. You were just talking out of your ass and I called you on it. Full stop. [0] https://news.ycombinator.com/item?id=43924650 https://news.ycombinator.com/item?id=43924650

xienze 1y ago

[flagged]

pixl97 1y ago
I have a number of family members that work at different levels of government facing the public. Based on your rhetoric and their stories there's a high probability that you'd fall under the group I'd consider 'howlers'. What is that? The people that blame everyone else for problems without understanding any of the complexity of the system. Everything is some scary other persons fault. Then later they have to interface with the system after the laws they have promoted and they are aghast about how abusive the system has become. I got to see this in person just a few days ago. I was renewing my license in Texas and had a stack of all the proper identification that I needed because I triple checked online on what I'd actually need. In front of me was an older gentleman that evidently had waited till the last day to renew his license. He didn't have any of the needed documentation, in this case his birth certificate. The clerk told him that unless he had that record he could not renew. He was all pissed and storming out and said "I bet it was the democrats that make us do that!". It is this wild disconnect I see quite often where I see people that want others inconvenienced, you know people from other places or people that don't look the same, but proceed with shock when the rules apply to them also and start howling about it.
- xienze 1y ago
  > He was all pissed and storming out and said "I bet it was the democrats that make us do that!". If your story is actually true, that man is somehow oblivious to the fact that Democrats are the ones always bringing up the “it’s so hard to get a driver’s license! And racist to require one for anything!” arguments. I’m not sure how you’ve come to the conclusion that I want to inconvenience people out of spite. I’d like to inconvenience illegal immigrants from getting their education subsidized by citizens. California wants the opposite.
  - pixl97 1y ago
    >If your story is actually true, Go in an sit around any precinct courthouse or state document renewal facility in Texas in the lobby for a week and you'll see it multiple times a week. It's not some particularly rare occurrence. The sovereign citizens are common too, and they really start howling commonly having to get escorted out.