Hacker News Reader

Comment by dijit | Hacker News Reader

Difference being that in Sweden there is a different requiremnet for causing harm (IE; national ID card or passport - or linked bank account) simply having a social security number and address is not enough for identity theft to occur.

in other countries they treat SSN's as private, thus they are trusted.

View on HN

But the only way to guarantee they stay as private as they are to begin with is to never use them.

Even if you only share them with people or merchants that you really, really trust, the sharing increases the risk of a leak.

That's not really true. Often you can order stuff from the internet with only knowing the SSN. You can order on invoice with Klarna for example.

Of course, for things that really matter, you need an ID.

But are you liable for those purchases? Can the seller accept some form of post-purchase payment mechanism and go after the SSN holder?

You're not, but it's up to you to deal with the administrativia (reporting it to the police, disputing the invoice).

You are not liable but you can't ignore it either, if you do nothing you are going to go to court in the end.

I thought Klarna would only allow invoicing if the delivery address matched the registered home address of the SSN owner.

I ordered some stuff yesterday and I only had to provide the SSN and it filled out the adress and everything. Then, I specified Klarna and the order was away.

But if you'd tried to get them to ship to a different address than the one they filled in then they would probably refuse. That adds a least a little bit of fraud security.

Actually it is and there have been a couple of cases both in Denmark and Sweden.

The problem is that the CPR is tied to all sorts of information from you credit card to your patient journal. You only need to get access to one of those things before you have the potential of access to all the other places.

It's that stupidly built.

Reply on news.ycombinator.com