Hacker News Reader

> In reality people don't generally get their identities stolen, institutions/organizations fail to properly verify it.

This reminds me of a great Mitchell and Webb sketch. https://youtu.be/CS9ptA3Ya9E

Thanks for that, exactly to the point.

Having worked in the financial industry for a few years, this is definitely necessary. Financial companies over the last few decades have shifted from a culture of responsibility to a culture of sales. There is constant pressure to "streamline" the underwriting process, i.e. cut out safeguards and checks and throw money at people as quickly as possible. When there are no effective incentives to do a good job, they aren't going to do it, and the burden will be shifted off to the public.

The larger issue with identity theft than the inconvenience of proving that the transactions aren’t yours, is that it can lead to the victim being charged criminally and arrested.

I knew someone who had her identity stolen, she took all of the proper steps - going to the places to prove it wasn’t her, filed police reports, etc. and she still got arrested for various fraudulent activities like check kiting and theft by conversion. She ended up in jail for a weekend while relatives brought various forms of proof that there was already an ongoing investigation. She had a warrant out for her in another county that she didn’t know about.

I mostly agree with you here, but I think your rhetoric lets (those currently viewed as) the perpetrators off too easy. The companies are failing in their duty, but the fraudsters are actively malicious. Beyond the rhetoric, I don't think you've actually proposed reducing our punishment/pursuit of those people. Your proposed solution is very interesting.

With the proposed solution, banks and other companies would have more incentive to prevent themselves from being duped by a criminal claiming to be me because they know there is less of a chance of getting the real me to pay up in order to clear my credit. This should have the effect of reducing fraud because it will be less lucrative.

Agreed. My criticism wasn't of the solution but (as I tried to make clear) solely of the rhetoric - if "banks are blameless, it's only the fraudsters" flips responsibility, then that should mean that actually fraudsters are blameless. In fact there's blame to be shared by both banks and the fraudsters, and possibly the victim (depending on the details).

It used to be called bank fraud and it was the banks problem. Now it's called identity theft and it's your problem.

I agree in sentiment however then the burden shifts to proving that person C was not really person A, and therein lies the crux

What's the problem with that? We have cameras, passwords, tokens, witnesses. Tell credit issuers to demand photo of person holding up ID and a thumbs up instead of just typing in a social security number. If that still results in too much fraud, then the lender is incentivized to do more research and verify in person that the person is who they say they are.

Right now, in the interest of increasing commerce, we're forcing everyone in society to bear the burden of this specific fraud and the benefits go to the lenders. If person A is being defrauded by person B pretending to be person C, then person C has no reason to be involved unless they aided person B.

So, every consumer needs a computer with a web camera that can actually focus on their ID (not all do), plus we have to share pictures of ourselves holding our ID with anyone who asks for it. And then it will inevitably leak.

This is placing the burden on consumers in a different way.

I don’t see why anyone is entitled to credit via a couple form fields on a website. The burden is placed on the lender and the borrower. If the lender wants to come up with their own way that doesn’t need ID and a camera, they can.

The burden is lifted from the rest of us who somehow got tasked with making sure lenders aren’t making errors with the risk of losing hours of our lives fixing someone else’s problem.

It’s ridiculous that after your child is born, you’re supposed to spend your time to place a credit freeze at the 3 credit bureaus. Transfer the liability of identity fraud to the lenders, and they will figure out the solutions in no time.

Not the consumer as I read it but the credit issuer would have to collect this evidence, so they would have the burden. Also this would help build a reputation that is auditable of the credit issuers.

This feels like an idea that would benefit consumers and be a business opportunity targeted at creditors if we could only convince them this is their responsibility.

That would be the value add that companies like Equifax should offer as a B2B or B2C service. Instead of blindly attributing debit to profiles without verification, they could act as an intermediary to establish and verify credit relationships.

Each party is verified and the relationship is verified to ensure non-repudiation.

Isn't that what they already do? You apply for a credit card, get a few multiple choice identity questions, and if you answer them right, they assume you're the right person.

They're assuming, not verifying and the information they use is specious at best. It's sourced from 3rd parties and not verified by the individual. A perfect example of lack of verification and the weakness of their data is your history of addresses. Divorcees often find their ex's new residence will show up on their credit profile as their residence for years after being divorced.

An identity verification system would require the individual establishing their identity with the credit agency and provide as much or as little credit establishing information.

When a B2C transaction is established, the customer would provide the business with a token identifying the credit profile they want to use and the business would request a credit chect with it to the agency, and if the business accepts the credit score they can both acknowledge to the credit agency they wish to do business.

Innocent until proven guilty isn't it? If companies want to easily proof that someone did the transaction in question, all they have to do is verify the identity properly.

>however then the burden shifts to proving that person C was not really person A

First: No. The burden is on B to prove that C is A, the default should be that if they cannot quite definitively identify the counter party then tough cookies. And they need to do this while covering all expenses and time value with interest in the event they're mistaken.

Second: if only! Most identity theft is not even remotely subtle. It's people walking in with mediocre quality forged documents or minimal info literally hundreds or thousands of miles from any location C has ever visited in their lives. Or someone randomly claiming to be C via some simple 10 digit government number and an email address C has never used. Etc etc. It's not exactly mission impossible hacking-a-passport-and-wearing-full-3D-facial-prosthetics-and-voice-changer stuff we're talking about here. Standard "ID theft" is just from a financial party with all the incentives to push through acceptance as frictionlessly as possible and then simply hound whomever they can try to pin it on and feed them into "debt collection" systems until most people cave.

What the law needs to recognize is that everything about this should be literally criminal. The original criminal is the one who committed the original fraud. But everyone who goes along with it from then on out, every single 3rd party directly trying to steal money or time or whatever from the innocent victim, is an accessory to that fraud. All of them are involved, though as always they can seek (after paying their penalty) to shift expense/liability back up the chain if they can prove it. It's their fault for insufficiently verifying the original counter party, and then they've compounded it by seeking to defraud someone unrelated.

No.

Party B thinks Party C owes them money.

Party C thinks they do not owe Party B money.

Party B sues Party C and shows (or not) by a preponderance of the evidence that Party C owes them money.

The onus is on Party B.