Hacker News Reader

Comment by losteric | Hacker News Reader

I still hold that this shouldn't matter to consumers.

My priority of problems is

* When fraud happens, banks can pass the pain and burden of proof onto consumers.

* Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan.

* There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley for auditing/accountability of aggregated personal information).

If 1. was addressed, banks would have an incentive to fix 2., and force credit reporting agencies to improve 3.

View on HN

At some level I think the banks are stuck in a conflict of interest with regard to risk. The reason we need banks and credit agencies is precisely because there is risk. If transacting parties could trust each other without an intermediary we could all just trade directly and all would be fine. So banks are actually disincentivised to create a world where risk is very low. They also don't want it to be very high. They need just enough risk that it is both (a) too big a problem for us to ignore and (b) small enough of a problem that they can solve it (for a fee, of course), but finally (c) still big enough of a problem that they are relatively insulated from competition.

I think it's no coincidence that the current state of affairs sits right at the sweet spot of these intersecting interests. And the problem is that the model requires an element of risk which is quite hard to control. Every now and then it flares up and becomes much bigger than they want. So we have incidents like this where the insecurities inherent in the system get exploited on a massive scale and the risk threatens to cross from profitable to massively unprofitable.

I suppose at a very high level your thesis might be true, but at a practical level, I don't think it is. The banks have simply seen it's cheaper to eat the cost of fraud (and ensure the victim has the burden of proof wherever possible) than implement stricter security measures.

This goes from the transaction terminal to the bank's server room.

Europe has had chip cards for over 20 years. In the US, it was very recently implemented; only in the past year.

It wasn't that the US banks were occupying some "sweet spot" of retail transaction risk/reward; they simply didn't want to shell out the extra bucks to send people cards with chips in them. Neither merchant nor bank wanted to pay for chip-reading terminals. So, nobody budged until just the past year.

I don't know whether it was legislation, or perhaps the growing cost of credit card fraud (i.e. card skimmers, etc), but for whatever reason, it certainly wasn't a "sweet spot". We've had chip technology for 20+ years, they just didn't want to pay for it.

And even after pushing out chip reader terminals and cards with chips, banks in the US refuse to institute mandatory PIN code entry on all payments with the chip - as its everywhere in Europe. So nothing really changed.

It still amazes that people don't know the chip readers work faster with PINs, too. An argument against PINs I keep hearing is that the chip readers are so slow that PINs would slow things down further. The funny thing is that the chip readers right now are waiting real wall clock time in a "wish-it-were-PIN" system to generate signatures in two different timestamps instead of generate a single signature with a user PIN. It's technically hilarious.

Well here in europe it didn't happen all at once. It was a gradual rolling of chip based cards, atms and terminals. There was a non-insignificant amount of time where some atms / pos terminals would reject your card because you/it didn't have the right technology.

But ultimately I think its the people themselves that demand more security from their banks. E.g. Bank one introduces chip based cards and more people choose that bank because they want more security. Then gradually some atms start to be "chip only", and banks start to see the chipless ones get all the skimmers and accelerate their replacement to lower costs which forces business to atart getting more pos terminals with chips to meet the demand of people with cards that have mag strip disabled.

Having more security seems to be what everybody wants and benefits from, its just that europe has smaller players which accelerates market forces in that direction, and meybe because european consumers just want more security in general.

I think people would demand more security if they really understood how venerable the technology was. But no one beats that drum. So consumer remain ignorant and just keep shopping.

How do banks in Europe verify identity? i.e. I call the bank and claim to be "Margaret Thatcher," what's the next step?

Here in the U.S. the next step is usually asking for the social security number. I called VISA/Citi to re-activate my card after traveling and they asked for the associated phone number with my account. Neither of these are especially secure, in my opinion.

Can't talk about the whole Europe, but in my country there aren't many banking services provided via phone and banks keep decreasing their count insisting on their clients to use mobile app, online banking or ATM. I believe you can't even get available balance in my current bank via phone.

Local UK bank after separation from Lloyds (now called TSB) asks for 3 random letters of your security answer which is also used as part of online banking authentication. Additionally, your address and previous transactions if you're calling re. fraud.

Re: Cost of fraud.

Agreed. It still amazes me how prevalent credit card fraud is. Certainly that's preventable - if they want it to be. The problem is, the banks don't bear that cost, the consumer does. Even if the bank factors the loss into the cost of doing business, that still gets passed on to the consumer.

Consumers are limited by law to a $50 loss for credit card fraud and every bank I know waives even that.

It is merchants (stores, internet sites) that bear the cost of fraud.

But what of the time, stress, etc.?

Merchants don't bear the cost, the consumer does. The merchant might not hand me a bill but that cost is embedded somewhere in the price.

The bottomline is the consumer pays. No matter how you cut it, the consumer always pays.

I see it differently.

It's my meta data. More valuable than phone meta data, and perhaps (to me) more valuable than my medical records. I have a relationship (as well as ethical and legal protections) with my doc. On the other hand, I've never met Equifax. They have no relationship with me other than to exploit my personal info. I never opted into that.

Yes. It lowers risk. But who benefits more? Who carries the risk? Me? Or them? It's the latter, yes. Yet we have no choice in the matter? That's not kosher.

I heard in US if somebody knows your SSN, he can take a loan accounted to you by phone.

It is so strange.

What gives banks right to do that?

There is a huge difference between taking a loan "on someone's behalf" (as their representative, eg by someone with power-of-attorney) versus via impersonating them. The former is rare but legitimate; the latter is fraud.

I mean the latter. Changed "a loan on you behalf" to "a loan accouted to you"

Yes and outside of the US nobody would be able to do a loan with a power-of-attorney without showing evidence of it

It may be fraud, but if it's possible, that's still a problem.

SSN can not be used as authorization, because it isn't secret information. And really, the same is true for credit card numbers; they're shared with too many parties to consider them secret.

Reply on news.ycombinator.com