Hacker News Reader

The problem with KYC is the same as the problem with many laws: it’s an inconvenience for the good guys, and only stops the dumbest of the bad guys.

There are lots of ways around KYC laws for the criminally inclined. The most straight forward would be simple identity fraud with stolen documents. Ironically, the more accustomed people become to uploading photos of their passport online, the easier it becomes for criminals to phish for the exact information they need for identity fraud.

With more banks closing branches and allowing opening of accounts online, and an increasing number of online “KYC compliance solutions” with dubious security, this problem will only get worse IMO.

The problem with KYC is the same as the problem with many laws: it’s an inconvenience for the good guys, and only stops the dumbest of the bad guys.

It's not just an inconvenience for the good guys. For community banks, the penalties for messing up are a much bigger deal than for an HSBC or a Bank of America. The problem isn't the stupidest of the bad guys. The problem are the still-stupid bad guys who have a modicum of ability. For smaller banks, who have to pick from borrowers who can't get a loan from the big banks, there are also marginal good guys who can get themselves into trouble, financial and/or legal.

With more banks closing branches and allowing opening of accounts online, and an increasing number of online “KYC compliance solutions” with dubious security, this problem will only get worse IMO.

Agreed. It's very difficult to solve and will be very important. Therefore, this is a possible opportunity?

Here's a company that's trying to approach it with blockchain: https://tradle.io/

Yes. Please do not ask or share photocopies of your documents over insecure channels. And even then you trust the person on the other line not to screw up with your data... Especially in the U.S. where a person just needs to know your SSN apparently...

Along the lines of getting identity stolen, hotel front desks are one spot. (for instance, in China, aliens are required to provide their passports and hotels are required to make a photocopy of it by law when checking in).

Also in India & many other countries. In India they usually took multiple photo copies of my passport. I would be incredibly surprised if my passport wasn’t for sale online, it’s been photocopied at least 100 times.

For those outside of banking, KYC = Know your Client.

https://www.investopedia.com/terms/k/knowyourclient.asp

edit: changed customer to client and added reference link.

KYC requirements give the government much more power over the individual, because they totally eliminate individual privacy against government monitoring.

I believe this idea that a privacy-free society can work in the long run is delusional and is only going to create social dysfunction on a very large scale.

> If I do nothing for six months they'll just cut a cheque for the money in the account and close it.

Seems like you get a lot more time than the BoA folks.

And BoA sent out random letters asking for highly personal information, without the recipient having any way to know they were legitimate.

Instead BoA should have sent out letters asking the customer to call them, or log into their BoA account.

BoA just locks accounts because it is easier on BoA than the alternative. The consequences for the customer be damned. That's reason #1,000,000 not to work with BoA or Wells Fargo.

I really liked Wells Fargo, but had a terrible experience with their legal department. I had a judgement against me for <$500 and they froze $20k. Had I not raised hell with them they were going to keep the freeze for 120 days. That’s insane.

The big banks all seem to be very conservative when it comes to legal issues, at the customer’s expense.

Wells Fargo is beyond conservative. It is activley criminal.

https://en.m.wikipedia.org/wiki/Wells_Fargo_account_fraud_sc...

It's not too difficult to take a small step and open an account elsewhere. We can stop rewarding these large banks for their bad behavior. I've had a good experience with Ally.

Ally is just as much of a “large bank”, isn’t it?

I currently bank with a regional bank, but they were acquired by Arvest. I’m looking for alternatives now.

They currently don't seem to be behaving in ways that actively hurts customers. I don't think there anywhere close to as big as BoA. My issue is more with behavior. But yeah, I've been considering opening a local credit union account to try that out too.

Not quite just as much (1/10 the size), but certainly up there. Ally was formerly known as GMAC, which should ring some bells.

https://en.wikipedia.org/wiki/List_of_largest_banks_in_the_U...

You'd hope that being one of the 19 largest banks would keep them a little more responsive than being one of the 4 largest banks. As well as their customers being lower friction online ones, rather than trapped by circumstance brick-and-mortar ones.

But like everything in our "best-effort" economy, the only thing you can really do is open multiple bank accounts [0] and hope they aren't yet colluding hard enough through the commercial surveillance bureaus that their failures will remain reasonably independent.

[0] Obviously at places that aren't likely to institute monthly fees, or arbitrary requirements to avoid them.

I have always used a local credit union for basic checking/savings. No need for a big national bank for that.

What I don't understand is: didn't you need to show them some sort of identification to open your account back then? If so, then why would they ask you to provide those sames documents again?

Depends on how old the account is. 20 years ago the documentation requirements were quite lax. So if the account is really old, they may have to update the documentation.

I opened my first account with Bank of Scotland ~35 years ago - I don't think I provided any documentation (not sure I had any). However, this was in the days of personal bank managers who actually knew people - my parents had been banking with the same bank for a long time before that.

Yeh, for context, back in 1990 I was planning to travel to Peru and wanted to work out how to get funds in an emergency.

My bank manager (at a big Central London branch in Oxford St.) invited me in for a chat and a cup of tea, and we worked out how best to do things. I think I still have the letter from him that gives the the number I should telex too if needed, together with code name I should address the telex to. He was a avid bird watcher and was interested in talking about what I would be seeing in the rainforest.

I rather miss those days. I was a 22 year old with moderate means. There was no reason for him to give me special treatment.

In 1993 I got an account in an indian nationalized bank Bank Of Baroda by depositing just the minimum amount Rs 100, & an introducer's signature on my particulars form (introducer needed to be somebody with a good running account at bank AND the one who knows me well.)

In 2006, I had to open a bank account on behalf of my father in Ireland. To my amazement, even though I told them that I do it for a father back away somewhere in between Hongkong, Pakistan and Russia, they never asked for any form of ID...

I opened my first bank account 20 years ago. On my lunch break. At my school. In one of the classrooms, where the local branch of Midland Bank (which is now HSBC) was running an in school "office" with Business Studies students working as "tellers". They accepted the front cover of one of my school notebooks as ID.

Times change. I would have opened that account in, let's say 1991 soon after the bank was founded. At that time I was a teenager living with my parents. I probably gave them:

A working postal address

An account name

A purported signature

An initial deposit

From a banking point of view this is fine. They're not planning to lend me a lot of cash or anything out of the gate, there's no obvious reason to assume fraud, so why ask for more? And perhaps as importantly - why keep records, even if I gave them something else they've no reason to do more than glance at it and OK the account.

But twenty five years later this same account now had a completely different postal address in another city. Large volumes of money moved through the account, and associated accounts had been created for the same customer, entitling them to a credit card, savings accounts and so on.

For example about $200k was transferred through the account in one afternoon. What's that all about? By this point the KYC regulations say accounts need to trace back to actual government ID, a passport, a driving license, something. And definitely there shouldn't be accounts able to move six figures in an afternoon based on the fact that twenty five years ago some kid posted back a piece of paper...

but for identity purposes that account is not verified to a human just by what some kid posted on a piece of paper.

It is verified by 25 years of history. Tens of thousands of transactions. Bundles of other accumulated data from every linked account, and every change of address.

It is a whole lot easier to fake most government ID, than it is to fake 25 years of history.

The problem with this is that the more places that need a photocopy of your government id the more leaks are going to have photo ids in them. In the long run it won't work.

It's an easy problem to solve. Force people to signup through app and make them take pictures of their documents. You can safeguard against all but state-sponsored attacks by simply obscuring your device oauth key and rotating it frequently through app updates, detecting emulation/simulator, pinging E911 location of the phone via the carrier.

Look at how hard the Starbucks app is to crack open and get access to the remote APIs or how long Skype protected their protocol. Can easily put the same amount of effort to ensure that phone isn't tampered with and that you're getting a legitimate picture of the docs.

> Force people to signup through app

> Can easily put the same amount of effort to ensure that phone isn't tampered with

You put a proprietary app on your phone. You presumably did this for other "secure" companies too. You no longer have a way to know who did or didn't tamper with it.

Skype managed to do it for a communication app. Games do it all the time to prevents bots. How many AIMbots are there for on secured platform like PS4 or Xbox? There's none because its next to possible to do.

The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location. You easily detect if you're running on a simulator and most modern financial apps have this protection. How are you going to hook up a debugger on IOS device? There isn't a jailbreak for the current OS. Setup cert pinning on the app and you won't be able to even install your own trusted cert to look at the TLS traffic.

Is there a good writeup somewhere on how the phone apps you mentioned prevent tampering? I'd be super-interested in reading it.

Alternatively, are you available for consulting on the topic? I couldn't find any contact info in your profile. :(

Caveat: I am not a security expert by any means.

Starbucks app security is a good starter and easy to implement their strategies in an existing app. If you add in IOS version checking, you can help mitigate the risk of getting attacked by a jailbroken device on an older version of IOS.

https://blog.tendigi.com/starbucks-should-really-make-their-...

Skype is probably best in terms of securing the app from prying eyes and modification. Here's a good read on how they protected the app and the reverse engineering effort needed to crack it. http://www.oklabs.net/skype-reverse-engineering-genesis/

I threw in my linkedin profile into my hackernews profile. Feel free to add me. I just listed stuff protecting the app, there's additional strategies to secure the API including low-level pack inspection to detect proxies by looking at attributes like TCP timestamp or window size scale. Proxy-based attacks are the most common when it comes to financial fraud as the hackers aren't US-based but need a residential US IP to avoid detection and IP ACLs.

>The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location.

You know, mobile ads companies resort to borderline exploits to fight botting, but even they loose out.

Lockdown is a useless measure, from my experience. Both IOS and Android ad nets croak under 60-70% bot traffic.

If preventing leaks was as simple as you say they wouldn't be occurring on a regular basis. Also, there are plenty of other ways that the data could be leaked that doesn't require compromising a proprietary app or the API.

This seems to me to open a big can of worms, and goes to the heart of the identity problem space. There are any number of ways to spoof identity with paper- and card- identity-based systems, and if I'm an organization that has to know the physical person standing in front of me is some person in my database records, I don't know how I could realistically constrain spoofing to a 1:1,000,000 level or better.

Short of only authorizing on entire pairs or groups of people vouching for each other at the same time, like missile launch officers or bigger groups, it seems a really tough problem to comprehensively solve if you are only given a plastic card and one person standing in front of you (literally or figuratively) to base your decision upon.

KYC applies everywhere that wants to stop, or even to appear to care about, corruption.

Perhaps, but it's also a great cover story for banks to pry into more of your personal or business details than they really have any need or right to know.

For example, one of my businesses in the UK was flagged for a KYC procedure by its bank after several years with them. We'd provided the usual basic information about the business and its officers when opening the facilities with them. Nothing unusual had happened recently to suggest a significant change. And yet suddenly, we're getting annoying pop-ups every time we go onto online banking, demanding that we complete an extensive and poorly presented questionnaire that seemed to want far more information than any bank had apparently required to "know" us previously.

As it turned out, it was less trouble to go to a competing bank, open an entire set of replacement facilities there by providing similar basic information to what we'd given our previous bank before, and then close everything with the original bank.

In case anyone is wondering, HSBC was the offending bank, and for this and several other reasons, I would actively recommend against them for anyone in the UK who needs to set up business banking facilities.