Hacker News Reader

Comment by oxygen_crisis | Hacker News Reader

Obligatory rant against the "Identity Theft" deception promoted by banks.

The victims of fraud in these cases are the banks, not you.

You still have your identity. The banks/creditors gave their money (not yours) to a criminal through their own neglect.

It's an unconscionable fantasy that you as an individual are the victim in these situations when you had no involvement whatsoever.

Laws need to be updated to reflect this reality. Banks will continue to act haphazardly so long as they are allowed to pass the bill for their own carelessness onto innocent people.

Awareness should be spread by disavowing the entire "identity theft" deceit any time it comes up in a public forum.

Highly relevant Mitchell and Webb radio skit:

https://www.youtube.com/watch?v=CS9ptA3Ya9E

View on HN

>Banks will continue to act haphazardly so long as they are allowed to pass the bill for their own carelessness onto innocent people.

I kind of feel like banks are fans of one mister Dewey Crowe, "The anus is upon you" to protect your data. (https://www.imdb.com/title/tt1489428/characters/nm0380632?re...)

If you want to sell this idea you at least need to have a name for it.

Fraud. It's called fraud. Someone is defrauding the bank. The bank is the victim. However, the person whose identity was referenced by the criminal has nothing to do with the interaction. The criminal did not steal an identity. They stole money from a bank through fraud.

Lets take this one step farther, call it identity fraud and not just fraud; otherwise, identity theft will probably be with us.

That term was already coined as a synonym. I wonder which form of fraud does not involve some kind of misrepresentation though. What makes it notable that a person who actually exists is being used as the conman's fictitious identity if we aren't interested in somehow offloading the risk to that person? Presumably this happened before the 1960s when it began to be called "identity theft" (and if you look at an ngram the term really only comes to be widely used in the mid-to-late 90s).

You build up a reputation for being a reliable borrower of debts or a good/clean societal record and someone steals that identity to abuse it and leave you with the baggage. You report "Identity Theft" to regain that identity and reputation, not on behalf of the money banks lost to fraudsters, hence the name.

There are plenty of things wrong with the current credit identity system, the name of identity theft is either not one of them at all or near the bottom of the list.

> someone steals that identity

This is exactly the fantasy that we need to dispel, not rationalize.

Nobody steals your identity. You always have your identity, and nobody else ever does. Your identity is not the few pieces of trivia a criminal can easily discover about you.

The criminal never takes or has your identity. The bank is simply neglecting to correctly identify someone.

> steals that identity to abuse it

Criminals are not abusing your identity, they are abusing the banks' careless failure to correctly identify people.

> to abuse it and leave you with the baggage

The criminal is not leaving you with the baggage, the bank is. They use willfully inept processes, because they have tricked you into believing you should bear the responsibility for the consequences of their own hubris.

I mostly agree with you that banks are hiding their victim status but I think your framing is too intense. The magical idea of identity as an intangible self isn’t helpful.

It is bank fraud and imitation with the intent to abuse the reputation of the person imitated. It should be illegal to imitate you when it negatively hurts you. It’s illegal to imitate police and doctors etc because it uses their reputations for fraudulent means. This is the same thing.

Banks are the financially defrauded victims in this situation, but the victims are also individuals because banks passed the reputational risk of fraud to the customers. If your credit score is hurt and you need to hire lawyers to fix it or you get denied for a mortgage (or just a good rate), you’ve experienced tangible harm.

Banks know they experience harm here. They plan for it. It’s baked into the prices and financial statements. Read the essays by Patrick McKenzie, he’ll argue that fraud is intentionally tolerated. They know that the consumer won’t be expected pay once the fraud is discovered. That’s not their goal, and they’re not being deceitful here.

You can argue if this system is overall good or bad, but it almost certainly has led to cheaper credit for everyone. Outsourcing credit worthiness to a magic national number (or 3) is cheaper than every credit union assessing risk themselves, with less knowledge.

> the victims are also individuals because banks passed the reputational risk of fraud to the customers

In that case I am not a victim of the fraudster, I am a victim of the bank.

The banks do not have sufficient incentive to improve their identification methods, so long as we tolerate the concept that we bear any responsibility for a transaction that involves only themselves and a fraudster who knows the answers to a few trivia questions about me.

It’s like defamation. If someone goes and spreads a bunch of terrible lies about you by pretending to be you… then you are their victim.

You’re not the victim of people who merely believe the lies and start to avoid you.

That's not a good analogy. If those people believe the fraudster and give them something.. I'm not liable for whatever they gave that person. You're leaving out the most important part. Avoiding != Requiring something.

I think I was focusing on the fact that identity fraud ruins your credit score, so you can’t get loans and the such for yourself.

To me that was akin to being ostracized because your reputation was ruined by an impersonation.

But most victims of identity theft don't have to repay the loans. They just have ruined credit scores. So I think it's an excellent analogy

> The banks do not have sufficient incentive to improve their identification methods

On the contrary, they stand to risk 100% of the loaned money. What more could be at risk. Also the fair credit reporting act has pretty strict requirements for what a bank or credit agency should do when you’ve told them the debt is fraudulent, returning you to whole eventual.

What would be required to fix false identity frauds? Is that more or less tolerable for society than X% of people dealing with a stolen identity. What about people who have some problematic history (ran away from home, prior homeless, etc)? How would strict requirements impact them?

Really I guess my question. Oxygen_crisis, why do you believe identity theft is actually a problem that needs solving?

> It is bank fraud and imitation with the intent to abuse the reputation of the person imitated. It should be illegal to imitate you when it negatively hurts you.

I think the argument is that the hurt is generated by the bank. Why isn't it the bank's responsibility to have their shit together and not do that?

You are not wrong at all. There is a certain level of fraud tolerated by banks so that they can more easily make loans to people. It's the classic security vs. convenience trade-off.

Two big problems are:

1. If you happen to be one of the victims of the fraud, it hurts! Sometimes a lot! A lot more than it hurts the bank.

2. If you don't like the level of (in)security that the banks have chosen, what other options do you have? Right now I don't know, I think maybe Bitcoin is your best bet?

Even if I pretend for a minute to seriously believe Bitcoin is less susceptible to fraud, using a different financial product doesn't help since the entire fraud takes place without your participation in many cases. They can just as well open credit lines with banks you don't use as ones you do.

I don't see how bitcoin changes much, other than you have to convince CoinBase that it wasn't your identity. Bitcoin specifically tries to avoid being tied to identity.

> Bitcoin is your best bet?

Because nobody can take out a fraudulent loan in bitcoin? Well.. that’s problem accurate.

I’m just not sure how is bitcoin even the tiniest bit relevant in this case?

It might generate even cheaper credit if the banks were allowed to randomly seize your assets whenever they felt like it with no justification whatever, so long as you weren't one of the unlucky targets.

There seem to be stories in these comments that leave consumers as victims without there being any intentional imitation. e.g., the five year old child getting mortgage payment demands. Or the person struggling to get a mortgage because of someone else with the same name but different age.

Having your identity stolen and having your identity permanently removed are not identical actions. If I use a keylogger to grab your passwords and impersonate you in emails, forums, and so on then your identity is stolen, it's in use by someone else instead of you without consent for a period of time. This does not mean your identity has been removed from you permanently. This also does not mean your identity was always in your control just because the sites should have done more verification to see if it was you. It was still stolen but the fraud wasn't caught, and the lost money due to fraud falls between the criminal and 3rd party regardless independent of your identity being fraudulently used. Keep in mind that's how it is today, if your identity is stolen it is already the bank that eats the loss due to fraudulent lending.

If you still disagree please try to make an argument without mentioning banks. Identity theft covers a lot more than banking fraud so the explanation shouldn't explain how you want the term to be changed to something which focuses solely on banks.

The processes in place do suck. That has nothing to do with the name of the crime though.

If you still disagree please try to make an argument without mentioning banks.

I don't think it's possible to avoid mentioning the banks. They are the ones committing the harm against you.

They are a stand-in for numerous other institutions who abuse you. You can take the name "bank" to mean any organization who is defrauded, and then abuses you to obtain repayment for that fraud.

I think it's important to recognize that this is a two-step process. The middle-man in this procedure is crucial, because they are the ones with a lot of power to use the legal system against you. If they were somebody other than a bank or other significant corporation, you'd be able to say, "No, I'm not the John Smith you gave money to. Go away and find that person." The imbalance makes it necessary to define the argument in terms of banks and similar institutions.

Criminal identity theft is one class of examples. An example scenario from this class is someone passes your identifiers off as theirs while committing a crime. Nobody was defrauded, no money exchanged, but you'll still want to report identity theft.

Claiming identity theft is precisely the process to notify the bank (or others) they cannot legally abuse you to get repayment for that fraud or you are not responsible for those crimes or whatever occured on your behalf. Under identity theft laws they are responsible for the loss due to fraud, not you. The same as credit card companies. The legal system is used but as much by you saying "I didn't buy that house, clear my records and eat the losses" as by the bank initially saying "this person didn't pay their loan". To not involve the legal system by both parties just opens up an even worse can of worms of fraud.

One thing I do agree on is that anything that can reasonably be done to make the process easier on the victim of identity theft should be as the process is too hard on them right now. Probably more fines to most middlemen to increase the cost further beyond their losses. I just don't think changing the name of the crime has anything to do with that kind of improvement.

> If I use a keylogger to grab your passwords and impersonate you in emails, forums, and so on then your identity is stolen

This is actually a great example.

If you impersonate me in an e-mail and talk someone into sending a thousand dollars they owed me into some strange account, a reasonable victim isn't going to come to me and say "we're square now, because I paid that fraudster's account what I owed you."

Instead they should admit they made a mistake in assuming it was me based on suspiciously inadequate information and pursue the fraudster if they want their money back.

Identity can’t be stolen. You can be impersonated. I think the point they’re making is that it’s not the victims fault if someone is impersonating them. I would agree. It makes zero sense for the victim of impersonation to be held accountable in any way for the actions of the criminal.

There is just more than a singular definition of identity in English and one of them can't be stolen while several others can. Impersonation is one way of stealing one of those definitions identity theft refers to. This doesn't mean the definition of identity is simultaneously violated.

The victim of impersonation isn't held accountable for the action of the criminal, particularly with banks. That's precisely what identity theft laws protect. I'm in favor of making that process even easier for the victim wherever possible but changing the name is not that.

> identity, noun, The condition of being a certain person or thing.

Someone who steals my passwords can impersonate me, they can not become me. Someone who tricks people into thinking they are me is still not me. An account is not an identity.

My online accounts are not me, and I am not my online accounts.

There are many dictionary definitions of identity. Take Merriam-Webster:

"1a: the distinguishing character or personality of an individual

2: the condition of being the same with something described or asserted

3a: sameness of essential or generic character in different instances"

Or the Cambridge dictionary:

"a person's name and other facts about who they are:"

Of course, you're always welcome to intentionally pick the incorrect context (going back to Merriam-Webster):

"4: an equation that is satisfied for all values of the symbols"

And just as easily rant the name of the crime has nothing to do with math so it needs to be renamed.

If it's open to interpretation, you're choosing the worst interpretation.

How this is interpreted is the primary problem that needs to be solved in order to legislate the issue, and from the interpretations you're supporting, it seems you're firmly on the side of the parties failing to identify fraudsters correctly, versus the innocent individuals.

"Worst interpretation" isn't about matter of preference on which interpretation is moral rather intentionally choosing the least supportive definition as proof the phrase is a misnomer. Ignoring the Cambridge one, which seems to be post phrase, definitions like "sameness of essential or generic character in different instances" are very stealable things, even if another definition is not.

As I've stated I'm in favor of the individuals. When doing so, I like to stick to factual and logical reasons why instead of insist the root of the problem is the chosen definition of "identity" does not match my preferred one. The root of the problem is the current process for dealing with identity theft is more burdensome than it needs to be on individuals. If you change the name it's still too burdensome because, outside of you, everyone already interprets "identity" to mean what it should in this case. That the process is bad is not proof the interpretation of the phrase is bad and needs to be fixed, it's proof the process is bad and needs to be fixed.

Just because someone disagrees with one component of your stance does not mean they automatically agree with all opposing positions that followed from it.

What is stolen is information relied on for authentication, but using “identity” with that meaning is common, even in technology.

That is, after all, what an “identity provider” actually provides.

"Identity provider" in technology is something that should be disavowed heavily, too. Identity is hard to define, but it's definitely not something that should be provided, unless we're talking about assuming others' identities.

Giving up ownership of our own identities led to very harmful results.

You're confusing two concepts that share a word: Your identity in the sense of self worth and personal ideals, and other people's view of you, your identity to them - Their interpretation of the former, to some extent, but also their judgements on your trustworthiness.

It's the latter that's being stolen. It's a crime against both you and your friends and creditors.

Often, bankers themselves are the fraudsters.

Reply on news.ycombinator.com