Hacker News Reader

Comment by mrweasel | Hacker News Reader

Regardless of what you call it, the fact that someone using your information to take out loans and signing all sorts of contracts should never be your problem.

If a credit card company issues a card in your name to someone else, then clearly they didn't do their verification properly.

It should be possible to have all your personal information floating around and still be certain that no one can use that information for anything. I'm pretty sure it works for Sweden where their SSN aren't secret, nor are addresses or phone numbers.

Sure that may mean that you need to show up in the bank, or have a secure government authentication method, but that's not beyond implementation.

View on HN

Exactly, some of this is semantics. To me, a skimmer duplicated card isn't identity theft. Taking my identifying information and opening new credit is.

Again, this whole industry needs to change. We could cut massive amounts of the estimated $200B loss in the US with just simple things like mandatory chip+pin, 2FA or CCV for online purchases, your credit is always frozen and only unfrozen for a 24 hour period at your specific request (requiring MFA). It is so silly when I have to type in my 5 digit zip at the gas pump (something someone could easily find online or by asking for ID) even though my card has a chip.

Some banks offer virtual credit card numbers for one time use. It works great online.

There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.

None of this works for you as a person if your easily look up-able information can be used to apply for credit.

In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way.

The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.

ok... i think the point is that it should be mandated by law to have chip+pin(+maybe contactless)+CCV with credit cards, and also two factor authentication for most online transaction. Whether the current business model does not provide these assurances is inconsequential: it can be imposed as a customer protection law.

It is to be discussed whether the increase in the cost of the service would be worth it though.

They are good buffers. They are basically prepaid cards that can be refilled. Not sure about any assurances for fraud(probably none) but what is taken can be minimized.

The zip code at gas pumps is not just a poor security measure, it also blocks international travellers like me from obtaining any fuel sometimes!!!

Just make a note of the zip code of some random address in the neighbourhood. A hotel or even the airport will do. At least that has worked for me. The system doesn't seem to care that that zip code has nothing to do with my Norwegian issued American Express corporate credit card.

12345 is a valid zip code, it has a single address associated with it - General Electric in Schenectady, NY.

10101 and 01010 are also valid zip codes.

(00000 usually works too even though it's not a valid zip code)

I'm not positive, but I think zip verification fails open on foreign cards.

Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.

I like to use '90210'

When I was a teenager in the 90s I worked at a chain store that had the policy of asking customers for their zip code at checkout to collect data on who was shopping. People sometimes would get really mad (and I mean really mad) that I was asking them, and since it was before the internet went mainstream people had not been conditioned to give out personal information yet/were unfamiliar with big data/weren't getting anything in return for their zip code. So in order to confuse the system (and avoid upsetting anyone - I am conflict avoidant) I would solely use 90210 as the zip code of all our shoppers, despite being on the other side of the country from Beverly Hills. I conspired to get my coworkers to do the same. A quarter of a century later I still feel minor gratification that I stuck it to the man.

I'm partial to giving my address as 1060 West Addison St., Chicago, IL 60613.

That Wrigley Field, for those not from Chicago.

Wrigley Field is the home of the Chicago Cubs, a Major League Baseball team, for those unfamiliar with American sports.

When a store offers the option of entering a phone number instead of using a physical "loyalty card", I've found that XXX-867-5309 nearly always works, where XXX is your local area code (for me, it's 206).

My wife and I went on vacation and didn't have the proper "club card" for the store. 867-5309 worked as a phone number, and was issued to a "Jenny".

I wouldn't be surprised if 90210 is outrageously over represented...

Or 02134.

No it doesn't. Usually gas pumps are set to accept 00000 for foreign cards and sometimes there's instructions for Canadians cards to substitute the letters for 0s. (ABC123=000123) Even if the pump blocks foreign cards altogether (and it usually won't), you can always use your card to pay inside.

I was travelling through the states a few weeks ago with a few friends. Neither zeros nor substitution ever worked for any of us.

I tried researching this last time it came up. Yeah, if you're from Canada you can run it through that formula (sucks if you didn't look that up before you left home). Nobody in the thread had luck with 00000 or something similar. I didn't really see clear instructions for other countries. It sucks if you need gas outside of business hours.

I had the reverse situation as an American traveling to Iceland when no chip+pin cards were available to me. I picked up the rental car with an almost empty tank. They point me around the corner--the gas station is automated. I start driving the 50km to reykjavik and cross my fingers.

Later in the trip I get into a similar situation of an automated gas station in a desolate area. I waited until a local came by, offered them cash to use their credit card. They seemed suspicious like it was some sort of scam (I dont blame them), but thankfully that worked out.

Yeah I had a similar problem in Canada. Got to the airport, tried to buy a bus ticket to get downtown from the automated kiosk. It asked for the pin on my credit card, which it doesn't have of course.

I was stuck. I eventually found a shop inside that would sell me a bus ticket if I bought something else.

I've had some success using the first 5 digits of a 6-digit Indian postal code.

Low trust versus high trust society is the thing you need to understand here. You live in a high trust society which means that, in general, it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.

While that might be true to a degree, chances are that what is really going on here is that it is more profitable to externalize the costs of insufficient authentication to unsuspecting people. While both result in higher profits, one does so by actually increasing the value that is being created while the other does so by making a third party pay, possibly even more than the increase in profit, so one of them is more efficient for society, while the other is just more efficient for the company but might still even be less efficient for society overall.

I understand, but in practice the fraud liability when it comes to identifying parties between two huge companies is very, very clearly laid out.

As in, weeks or months or years of discussion.

Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.

I understand what you are saying but that just means that the consumer pays for that in any case (in higher prices or interest rates or ...). Using your verbiage, I would like it to be even "higher" trust so that I don't have to pay for fraud that seems almost trivial to prevent.

It is not trivial to prevent at all. You need to spend money and fraud prevention effort at every trust point.

All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault.

In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people.

Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.

Not attacking you but you've lost me. How does switching to chip+pin at the gas pump instead of zip code cost "salaries of people" or "risk of physical assault"? There might be a cost to upgrade the panels to read the chip but they need upgraded anyway with electro-mechanical locks to prevent skimmers anyway. There are also savings in police, courts, incarceration, etc. This won't stop all obviously, but there is a subset of criminals who perform CC fraud because it is so easy and hard to get caught.

Chip and pin switch is the best case. Think about all your other accounts. Gas, power, water, fines, etc.

Also i don't know have ever been involved in an "it upgrade" project and what it means to have the gas pumps now do different things. I want life to not be like that, but I think you would find its a bit harder than you are imagining.

> Think about all your other accounts. Gas, power, water, fines, etc.

The way those work in the rest of the world is basically by giro. You control your bank account, and the only possible transaction is you sending out money to other bank accounts. If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The system is not perfect and fraud still exists (mostly in the form of trying to pass a fake bill as a real one), but fraud is much less prevalent than in the US system.

If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The problem is that that someone else can claim to be me at my address to you (the impersonator), you send the bill to me (the authentic). I look this bill over and decide not to pay because I didn't request these services. Now we have a dispute, all due a third-party who impersonated me.

Unfortunately, this is also exploitable by me to later claim I didn't purchase the service from you, which I might do to avoid paying.

There's currently no easy way for you, as the service provider, to authenticate the request without an out-of-band opt-in (mailing a contract to the same place you'd send the bill to confirm that the services would be paid for), which would delay the delivery of said services. By the time the third-party has received the services and you've sent the bill to the authentic party, the impersonating party is long gone, and the authentic party is left holding the bag as the less powerful party in the exchange/dispute.

It's not a question of trust it's a question of where the legal liability falls.

> it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.

And that's not a big problem even that it is not nice. The problem is when your company lends money to someone that says it's me. And it becomes my problem. Why?

The company wants a lot of conversions, so it has a low entrance cost. Then that company should pay for that problem, not unrelated third parties.

> Low trust versus high trust society is the thing you need to understand here.

For me, that's just one of the reasons.

Sweden, for example, is a high trust society. But companies are trying to play fair because they are going to be punished otherwise. Isn't that fair?

But, of course, in a society with a lot of corruption, and cheating, and low trust. Companies are going to defend themselves more. As they risk will get more fraudulent transactions that real ones.

* To me, skimmer duplicated card isn't identity theft.*

No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.

A commenter below already mentions the difference between high-trust and low-trust society. I'm from a country which has a notoriously low-trust society. Opening a credit card or bank account is notoriously hard. It's so hard that a large portion of the society is left out of the system.

The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands.

I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts.

Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

I agree the system has to protect both sides and that may not always pan out completely. I'm genuinely curious what you think would work better. All systems have drawbacks. Some of them may be systemic but those are harder to abuse than a waiter writing down your CC # and selling that to people who encode them on magstripes.

I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.

If you are really interested, read this ArsTechnica article [1]. Interesting tidbit [2]. This makes it far superior to even chip+pin. You have to enable TouchId to use Apple Pay - there's the 2FA which doesn't requiring writing it down. It never sends the real cc number - no way for the waiter to even see it. It's a shame it's not catching up. Even in a tech-savvy city like SF it's adoption is abysmal.

[1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-...

[2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.

it's not silly, it's infuriating. I can't pay at the pump with my card, because I don't have a US ZIP (I do have a perfectly secret PIN that I can use everywhere in Europe, but US doesn't seem to care about that)

US credit card companies do not do a lot of ID verification when opening accounts.

I applied for a new CC last year entirely on-line, and had the new card in my hands within a week. They never asked to verify my identity beyond my SSN / DOB / Address, which all seem likely to have been released in at least 3 breaches in the last few years. This is surprising to me, as I've been asked to show ID when opening a local bank account. To me this makes no sense: Why verify customers more stringently when they effectively loan you money than when you loan them money? I guess it may just have something to do with banking laws..

This is all just a long winded way to say that I think that credit card offers, by mail or web, are a problem. They cannot do any meaningful ID verification anymore, now that all info is essentially public. I think they need to partner with some agency that has a physical presence which can do verification of ID via government issued ID. Eg, a bank, merchant, etc, who can look at your driver license, passport, etc, and verify your identity. I suppose they are worried about adding too much friction.

Because bank accounts have different (and stricter) anti-money laundering and KYC laws.

Which, no offense to our government, is just stupid. I'm much more concerned about ID theft than I am about terrorism, which is the supposed motivation for the know your customer stuff.

I think those laws were originally designed for "normal" crime, as what-to-do-with-illict-money is a common problem for anything resembling organized crime.

Ing. Direct ask for copy of your documents to be sent by mail

which you obtain by posting craigslist "$30/hour work at home" ad

This is a wonderful idea but it is not cognisant of risk or user experience.

I am sort of surprised more HNers don't understand risk and the tradeoffs involved and seem to be taking an absolutist stance on this.

Equifax is an unforgivable failure of infosec but the general ideas around the risk of it seem like ...

Practically speaking, without significant landscape changes (and yeah equifax counts as one) it has generally been cheaper to trust people and write off the bad apples than to verify more. Or else there would be more verification!

Thats because most applications for homes, high value insurance or financial products are not actual fraud, they are usually consumers having trouble with you shitty process despite your best efforts to optimise for usability.

I don't know fully what the equifaxopocalypse means for americans though.

> it has generally been cheaper to trust people and write off the bad apples than to verify more

This is not the issue here. If a bank want to do this, go ahead, as long as they cover the losses. The problematic part is that if a bank gives a loan in my name to someone else, I get punished for it, not the bank.

Tell me which party to the transaction you are as you make this rational decision.

Or explain that you don't understand the industry or any of the regulatory frameworks involved.

Have you ever accepted a payment?

EDIT: not sure if I misread you, probably responding to a comment in flight. Your initial position seemed to be different to what I read now. I get that "identity fraud" as an industry position is a shitty attempt at moving risk but that was not the comment I was reponding to. Sorry if that sucks.

The party who gets a call from collectors or who is denied credit.

If I publish your nude pictures in a newspaper, you are similarly not a party to this transaction, but you are hurt by it. This is similar.

I apologise but I think you have a poor understanding of the way this stuff works.

Everyone absolutely wants to extend you credit.

No, you're missing the poster's point.

They're saying the problem is this:

You want to do business with company A. Company A asks company B for information about you. Company B lies to company A. Now company A won't do business with you, because company B lied about you.

Company B in this scenario is a company like Experian.

Cheaper for whom?

Cheaper for the banks, sure. It was cheaper for Ford to pay injury lawsuits than fix their exploding tires. But kind of trade off is illegal for one to make when another party is getting materially hurt — even if on average society is better off; after all, if we confiscated all of bill gates’ wealth, on average society is better off than if he gets to keep it.

I read many of your comments on this post and still do not seem to get your point.

You argue that there are reasons for the lack in verifications and then that this is desiderable from a societal point of view.

To the question "should a CC provider cover the expenses on CC give to fraudolent impersonators?" what do you answer?

>then clearly they didn't do their verification properly.

Indeed. And surely, when they then report you to a credit agency, then this is libel or slander. They have no reasonable basis to make the claim, and it results in severe hardship for you.

As OP says, the idea of "Identity" is a fiction designed to make it the responsibility of the citizen to deal with the "theft".

By definition, if it can be stolen, then it can't be considered an identity.

> that's not beyond implementation

It may be in the US. Because of Revelation 13:16-17: "16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads; 17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name."

That's why national ID is difficult to sell here. Sorry.

You seem to be under the impression that the national ID in Sweden is in the form of some kind of tattoo?

> receive a mark in their right hand

I guess if you got your ID by picking it up with your right hand it still is the mark of the beast.

I don't think mrweasel's comment was proposing national ID as a solution to "identity theft". It was just positing that solutions must exist other than keeping identifying information secret.

I thought barcodes are already the mark of the beast.

https://www.wired.com/2012/12/upc-mark-of-the-beast/

Then it was RFIDs, then Obamacare, then...

God's perfect wisdom just keeps getting lost in translation, what a shame!

Yet bank accounts typically require at least a copy of state-issued ID to open, all without national ID!

Part of the resistance to national ID is also a question of federalism - we do not officially have a 'national government' - we have a 'federal government', even though in practice it is hardly federal anymore.

You don't need national ID if every state issues a real ID document. There's no European wide ID but national IDs of all EU countries are accepted everywhere by law and it works.

Well shit thats what peope don't get. You accept a shitty system that kinda works or a national system that works super well that looks like modern fascism with good biometrics.

Choose your poison. Carefully.

Since when is providing a way to identify people facism? This isn't the 18th century. Economics are global. You cannot just use the fact you've known the shopkeep your whole life as an authentication service.

Either we have a good functioning way to uniquely identify people or we don't. If you have the former, you could use it for evil, in much the same way as how with the later it is used for evil a lot with the various frauds talked about in the OP.

If the government wants to do evil it will do so with or without national ID, but the ability for fraudsters to do evil is dependent on there being no effective and secure universal identification.

I'm going to guarantee that the NSA tracking profiles on every US citizen don't need national ID cards to pick you out of a crowd. They could build a comprehensive identity database from CCTV and store cameras whenever you buy something to build a complete and hardened profile to identify you with. They have access to way more than enough material to start branding the "undesirables" and having them carted off to gas chambers within a week. We just suffer in the meantime under this false belief that ID cards are the make or break of liberty.

I upvoted you and I think you made your point well, I just feel the opposite way to you. Thanks btw :)

I would prefer shitty nonfunctioning systems which still allow me to use cash and buy a bowl of noodles to the alternative where I need to be more or less authorised to make that transaction. But thats just me.

US already has national IDs. They're called Social Security Numbers.

CGPGrey did an excellent video on this topic: https://www.youtube.com/watch?v=Erp8IAUouus

> a secure government authentication method, but that's not beyond implementation

We have secure epost for communications between people and the state here in Norway already. The authorities keep pestering me to register to use it so that they no longer have to send me paper documents.

Is it actually secure or is that just the marketing ploy of the government?

I don't really know. I've never heard of any exploits but that could be because it might simply not be an attractive enough target.

Reply on news.ycombinator.com