Hacker News Reader

Comment by _8j50 | Hacker News Reader

Ahhh FFS, this post is complaining about third party KYC providers. Give me a break, in what world can you get a visa or mastercard without KYC? They provide privacy not anonymity, payment privacy that is not hiding your identity privacy. Your payments are private. Your payment info can't be easily tracked across the different cards you create. That's it.

View on HN

It's not the existence of KYC, it's that their KYC provider is slimey and not privacy respecting. Selling your data to potential bidders is a no go.

Pretty sure selling your passport pic is illegal, as far as name, address and IP all major banks are doing this already.

The scenario is that a potential buyer audits random records to validate that checks are/were handled ok and the data that must be preserved for KYC audits actually is. This isn’t “selling your data to potential bidders” (if they are bidders there is no sale presumably?) so not sure why you are reading into it such intent.

I agree that most of the comments here amount to handwringing (or not understanding what amount of "privacy" is legal), but also, what KYC is really necessary for a company like this? If I understand correctly, all they do is pass through transactions. They don't hold customer deposits or provide credit. Isn't all this third party verification a little much?

The point of KYC is to make money laundering harder (and other transactions that the various governments want to track/police). To that extent, yes, they need to be able to show a regulator who was making those transactions.

The actual funding source/bank behind them won't see any detail beyond "privacy.com".

Any card issuer (or virtual card issuer) has to do this.

My point is that privacy doesn't need to do KYC because there is no possibility of the customer evading regulators. Assuming that privacy answers subpoenas, they would be able to give the government detailed transaction info and a bank account which would identify the customer. KYC at this level of abstraction doesn't seem to solve any kind of legal problem. I'm glad to be educated by an expert, though.

Edit: A sibling explains a good liability reason for this, which makes sense but would not imply any legal reason.

How do you validate that they own the bank accounts if you don't know who the user is?

They only verify control. They do the method of making two small deposits and asking what they were.

Which is why KYC is required. Two small deposits just means you have access to someone's bank account, not that you're actually them. Money launderers will pay mules to use their bank account to move money around.

> what KYC is really necessary for a company like this? If I understand correctly, all they do is pass through transactions.

Products like this are particularly susceptible to fraud, especially given that they're charging your bank account directly. Without any KYC, if I as a fraudster get access to your bank login, I can basically drain your account. That opens up a ton of liability to Privacy. Also, the card networks tends to be pretty risk-averse with allowing issuing products access to their networks if there's a lot of fraud going through their services.

So, it's much easier to put KYC in place in order to avoid the headache of dealing with fraud/AML/etc

Ok yes, I can see that they would want to have some insulation from having banks charge them back on whole user accounts. That makes sense.

It is a legal requirement for their bank and for mastercard.

Privacy is backed by an actual credit card ever since they restructured things to get around most sites rejecting their cards due to mistaking them for prepaid.

That's what the post is complaining about, but the problem is quite deeper. The KYC bit is actually ok IMO -- you're giving your identity to places that likely already have it.

What this kind of article should be about is the same thing that VPN is about. privacy.com actually removes privacy. Now, instead of VISA being the only aggregator of your purchase data, privacy.com is also. Either way, the merchant and VISA know your purchase history. Now, so does "privacy".com.

If you want to hide something from your bill so that someone else in your household doesn't see it, then ok. If you want to hide your address and name from a merchant (say for a digital downlaod) then ok. If you actually want more privacy, privacy.com is the opposite of what you want.

> Either way, the merchant and VISA know your purchase history. Now, so does "privacy".com.

how does the merchant know your purchase history if you're using virtual cards with bogus info?

thanks for the correction.

Reply on news.ycombinator.com