Hacker News Reader

Comment by rsync | Hacker News Reader

I bought a new iPhone with cash, signed up for a Verizon MVNO using an assumed name and used an impersonal email address (and assumed name) for my Apple ID (which I seldom use).

Nobody in this chain has my real name or any significant PII. I don't care if any of them get "hacked".

Further, if my phone is lost I just recreate the chain and point my (twilio) number to the new SIM card. I can temporarily forward SMS to email for a day or three. Yes, of course twilio has an assumed name.

None of this was difficult nor illegal nor expensive.

The enabling factor is that Visa/MC do not actually verify cardholder name (even though everyone thinks they do).

So my bank sort of knows who all the providers are, but they'd need to collude with (MVNO or twilio or Apple) to have any real PII which could then be stolen ...

My threat model is PII theft via hacks (like this one) and wayward employees at each provider. My threat model is not state actors or LEAs.

View on HN

Interesting - I've always wondered if something like this is possible.

Even just if privacy.com or someone would let me signup with a fake identity to t-mobile. Then who cares if these folks get hacked?

Can you elaborate on "The enabling factor is that Visa/MC do not actually verify cardholder name"? Are you saying that you've got a credit card under an assumed name?

No, of course not.

I am saying that merchants do not have the ability to verify card holder name.

Your transaction will process properly with Mickey mouse as first last.

Only amex verifies cardholder name.

EDIT: relevant stackexchange is here: https://security.stackexchange.com/questions/220724/i-can-pa...

> None of this was difficult nor illegal nor expensive.

Is giving a false name to the CC companies not illegal in some way? At the very least I'm certain it is a breach of contract.

I think OP is saying that they give a fake name to the vendor, not the CC card company. Walmart (maybe?) isn't checking that the billing name you give them matches the name on the card. I don't know how true this is across all vendors.

This is correct.

I have the same, real-name relationship with my bank and card issuers that you or anyone else has.

Rando-web-merchant, on the other hand, never gets my real name.

"I don't know how true this is across all vendors."

Almost 100%.

There is a rarely used program called "verified by visa" that takes you through an additional verification step and encourages you to create some sort of account linked to your issuing bank (or something) but I have only run into that once in the years I have adopted this practice.

Slightly mitigating:

Merchants can request Address Verification (AVS) from the network, but the result is purely advisory: the merchant can ignore a mismatch if they choose. In my experience, most do ignore it.

This is also true of the CVV/CVV2/CSC/etc. Most web vendors require it, but it is not required to complete a transaction. Theoretically the provision of a correct CVV indicates that the consumer has the card in-hand. Chargeback appeals are somewhat more likely to succeed if the transaction included the CVV.

I appreciate the response and the link to the Stack Exchange question. I wasn't "getting" what you were saying, but now it makes sense. That's probably something I'll start doing too. Thanks for the idea.

When I use a privacy.com virtual card, I can use any name/address and the transaction is approved.

My hero!

Reply on news.ycombinator.com