Comment by GrinningFool | Hacker News Reader

Comment by GrinningFool | Hacker News Reader

Something I would have liked to see - but perhaps this letter wasn't the right place.

Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen.

Right now, it's all on me. I need to safeguard everything related to my government-issued nine digit ID that I never asked for - yet is somehow accepted as my financial identity, well beyond its intended scope.

If I fail to do so, or if I fail to aggressively identify fraudulent use of it by monitoring reports from 3-4 different agencies, it's on me. It's my credit that's screwed.

It's hard to emphasize enough how unreasonable that is. This isn't a house or other peace of real property that's in my control - it's 4 bytes of data that is assigned to me, but that I fundamentally have no control over.

In spite of that, I am accountable for any and all uses of that data. It's hours of my life each time a breach occurs - more if it's actually misused. The assumption of 'bad credit risk unless and until you convince the reporting agencies that fraud has happened' is a fundamentally flawed one.

I can't opt out. I can only keep spending my time and money to play the game - because it's the only one in town.

Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me.

My identity wasn't stolen! You gave a loan/credit card/whatever to someone and didn't verify who they were. How is your organization not doing the proper work a "theft" of my identity? I'm not involved and I don't want to be!

I’ve heard “bank fraud” used here.

> identity theft

Impersonation.

No, this implies that the victim is the end user, not the bank.

https://www.youtube.com/watch?v=CS9ptA3Ya9E

If the credit agency is harming your reputation with an incorrect credit report then the proper term for what they're doing is libel and you can sue them for it.

I'd like to see a startup or non-profit that automates libel civil lawsuits against the reporting agencies. At least then maybe we'd get some responsibility from them.

IANAL but banks have a lot of cash to throw at legal teams. AFAIK you’d have to show evidence of material damages. Seems very hard to automate...might be better for class-action.

Ya I agree. It seems these firms are relying on the fact that each individual suing them would have to put up considerable time and money, and so most don't .

But if some economy of scale could be provided in filing these lawsuits, like those boilerplate will in a box products, then the business of credit reporting in its current form may be made non-viable.

I wonder how many of the major US banks have binding arbitration clauses? I don't claim to know one way or the other, though I thought I heard that one major bank did & it had been standing up in court recently, but I may be mistaken. I also have no idea if they'd hold up in general -- but I'd be curious how many of the T&Cs that you sign have these clauses...

Probably all of them. So you would just have to find someone who had never opened a legitimate line of credit, but for whom a fraudulent line of credit had been opened.

Negligence

"Identity theft" isn't real. It's a term the banks et al. use so that they can have less responsibility.

Example: Someone opens a bank account using your information. That's fraud. Someone lied to the bank, and the bank believed them. That's the bank's problem. But by pointing at you and saying "Your identity was stolen" (using the term "stolen" to make it seem like this is similar to the theft of a physical object), it suddenly seems like it's your problem.

> It's a term the banks et al. use so that they can have less responsibility.

I agree that it's misleading, but have to concede that whoever first came up with that term must have been an expert in framing and spin. There are few words that so effectively distort the discussion as "identity theft".

Indeed. When one thinks of "identity theft victims", one doesn't think of a bank.

But it is the bank, it should be! When a bank is robbed, its clients aren't the victims. The bank is. The clients aren't giving money to the bank for nothing in return; what they get in return is assurance of safety and availability (otherwise, that would be a loan, not a deposit). Spinning the failure to deliver on that obligation as the client's problem is indeed great PR work.

Fraud is only half of the "identify theft" reframing. The term also attempts to excuse libel/slander by the credit agency.

Fraud is the one and only word needed.

Via https://en.wiktionary.org/wiki/fraud: The crime of stealing or otherwise illegally obtaining money by use of deception tactics.

Legally speaking

> Fraud must be proved by showing that the defendant's actions involved five separate elements:

> (1) a false statement of a material fact ["I am John Doe"],

> (2) knowledge on the part of the defendant that the statement is untrue [they are not John Doe],

> (3) intent on the part of the defendant to deceive the alleged victim [they want money],

> (4) justifiable reliance by the alleged victim on the statement [bank credit approves access based on identity], and

> (5) injury to the alleged victim as a result [bank loses customer money].

(https://legal-dictionary.thefreedictionary.com/fraud)

Credit fraud. The banks were defrauded, not you.

I like the term "bank slander"[1]. The company that gave a loan to fraudster (a bank) lies to the credit bureau (slander) and now you have to spend a bunch of time trying (and usually failing) to get those lies off your credit report.

[1]previous HN comment - https://news.ycombinator.com/item?id=15657887

Maybe "credit slander"? Including the added bonus of expanding the set of possible perpetrators.

Love this one and I am going to start using it in real life, peace!

> Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me.

I'll have a stab at coining the new word.

The concept is referring to attempted or successful deceit of the bank. Let's take the Latin word for deceit, fraudem, and modernize it so it won't sound so quaint. I think that "fraud" would do.

It's frustrating enough to see private enterprises using SSN as a form of identification, e.g. getting a lease on my apartment I had to provide my SSN.

What's worse is when government agencies themselves use it, knowing full well the number of recent data breaches. I recently went to the DMV in Colorado to obtain a driver's license (since I moved here from another state). They turned me away because I didn't have my physical social security card with me. I did have my U.S. Passport, which has far more security than a blue card with a number printed on the front of it. And sadly the Colorado DMVs will continue using SSN to identify people, even after hearing about the Equifax breach.

Honestly, a social security card may as well be a post-it-note with the number written in crayon or finger paint.

Just curious, how do other countries do it? For example, can I get a loan in Canada online or over the phone (not in person)?

The EU practice of shifting the practical risks from the impersonated person to the defrauded lender means that lenders are less eager to accept risks and more careful with verification.

Usually, you get loans from your bank - and since you have a preexisting relationship and secure authentication methods, you generally can do it remotely. However, establishing your identity to a new organization usually requires a visit in person and verifying official ID; the lenders who don't require this (e.g. various companies offering small payday loans) have a much higher rate of fraud and thus charge high interest rates to cover those risks. A popular measure that I've seen used is that they require you to wire them 1 cent from the account to which they'll pay out the loan, which can remotely show that you most likely own that account.

That's exactly what Troy is talking about in the section on KBA (Knowledge Based Authentication)

>Knowledge-based authentication (KBA) is predicated on the assumption that an individual holds certain knowledge that can be used to prove their identity. It’s assumed that this knowledge is either private or not broadly known thus if the individual can correctly relay it then, with a high degree of confidence, they can prove their identity. KBA is typically dependent on either static or dynamic “secrets” with the former being the immutable data attributes mentioned earlier (date of birth, mother’s maiden name, etc.) and the latter being mutable such as a password.

You can freeze your credit to "opt out"

But then you're opting out of the US financial system as it is available to consumers.

You can unfreeze if you need access to credit.

At which point you opt back in to the risk. It's not a workable solution.

And it costs you $10 per credit agency every time you need it.

> Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen.

In France, private credit bureaus don't exist. It's up to banks to track these things.

The country seems to work fine.

> In France

> The country seems to work fine.

I hope you realize the joy you have brought to many people's day by writing this.

I would pay a large sum of money to see all of the replies that will go unwritten.

I know that everyone loves to laugh at France, but France isn't a bad country. It's hardly a dysfunctional hellhole.

Everyone? Only estadounidenses.

In Germany life is also not dominated by the credit agencies like in the US but there is a thing called "Schufa" that does some credit reporting. Not sure how it works though.

The Schufa (https://en.wikipedia.org/wiki/Schufa ) provides data for their partners/customers on your credit rating and credit score.

Banks will usually not give you an account and shops won't give you credit if your rating is bad. For example, you are so late to pay your bills that the creditor has involved collection agencies or the courts to get their money.

Landlords will more often than not demand a document from the Schufa (supplied at your own expense) to consider you eligible for renting a flat or a house.

edit: grammar

The important distinction is that Schufa is heavily regulated and cannot e.g. give banks disputed information as long as the dispute is not resolved.

CRAs in the US are also highly regulated.

https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act

> Landlords will more often than not demand a document from the Schufa (supplied at your own expense) to consider you eligible for renting a flat or a house.

Not just landlords, employers do Schufa checks too, same for phone/mobile contracts, cable TV, and for what its worth even power/gas companies. The latter is really bad because it locks poor people into the highly expensive "Grundversorgung" tarriff (regulated, the local utility MUST offer it) by the local utility, thus taking away even more of their money.

Do the banks talk to each other about their customers? So if you don't pay a loan to bank A does bank B know about it and make their lending decisions based on that information? If so, it's functionally identical to the credit reporting agencies in the US.

Is the same type of credit with the same interest rates available just as easily in France as in the US?

Reply on news.ycombinator.com