Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

Stripe Identity does it for $1.50/proofing request. Not sure what ID.me charges (what Login.gov is pushing out across the federal agency fleet).

If you fake it, of course the recourse is the legal system for identity fraud.

View on HN

> [T]he recourse is the legal system for identity fraud.

Is it though? Are there sets of federal or state laws [in the United States] that say you must never misrepresent your identity to a private party (X) if they ask for it? Wouldn't their recourse just be their ToS? What if a retail store clerk asked you when buying toothpaste? I suppose the law would probably be around the fake identities themselves? (e.g. creating a fake driver's license) But that would still be up to the state to prosecute, right?

I presume there are of course laws about misrepresenting your identity to the government, but now I am curious to what extent that's the case for private parties.

(I don't know much about the law in this area)

The mere possession of a fake ID is illegal. Even borrowing an ID is illegal.

That's true. I suspect if you provide a completely fabricated identity to X they could turn around and report that to the respective state or federal authority who could prosecute you for possessing it with evidence being the act of using it by uploading to that verification service.

If I’m American and I use a fake I D from another country, is that illegal?

I'm not a lawyer.

It it worth a night in jail, a couple thousand dollars in legal fees and being felon to find out?

I’m head of security at a fintech and working with our fraud team and general counsel to mitigate identity fraud is a component of my work. Statute around this is somewhat robust and effective as long as you put the effort in to pursue.

In interest to your circumstance, mitigating identity fraud in the sense of situations where people have stolen another person's identity, or people who create completely fake identities, where both of them then committing some other act like theft?

I am curious how it would play out for X, if someone created a new identity and simply attempted to subscribe to their service in that sense.

You cannot fake a new identity that doesn’t have any backing in canonical identity systems. With sufficient data enrichment, you can rapidly ascertain which systems are inaccurate or deficient. I recommend https://doi.org/10.6028/NIST.SP.800-63-3 for further reading on digital identity and identity assurance.

I admit my experience in this domain has primarily been in financial services. We have different motivations than say, a social network. We plug into…as much signal is as commercially reasonable. Regardless, your identity assurance level will be governed by the effort and resources you’re willing to sink into the effort (data sources, remote identity proofing, device fingerprinting, activity heuristics, etc). If X wants to make sure you are who you say you are, they can, for a few dollars per user. And if you can’t identity proof because you don’t have a government credential, I’d hazard you don’t have much economic value to the platform (just facts, not a sleight).

For X, if you can show a gov ID that matches your credit card you’re paying with, that’s pretty high confidence you are who you say you are. Otherwise, you’re breaking the law (financial fraud if it’s not your credit card, edge cases aside if someone else is authorizing you to use their plastic).

Here's the Illinois state statute:

720 ILCS 5/16-30)

    Sec. 16-30. Identity theft; aggravated identity theft.

    (a) A person commits identity theft when he or she knowingly:

        (1) uses any personal identifying information or personal identification document of another person to fraudulently obtain credit, money, goods, services, or other property;

I've known dozens of people who went to jail for this, but only when they obtained money, not for services, but the statute is clear.

Thanks for providing that. The section you include seems particular to using another person's existing identity, rather than generating / crafting a new one from thin air that isn't you or anyone else, which is what I think the ultimate parent was referring to:

> Nowadays, you could autogenerate both, and it's way more expensive to check the [id] than to generate one

This section seems the most relevant (?):

        (5) uses, transfers, or possesses document-making implements to produce false identification or false documents with knowledge that they will be used by the person or another to commit any felony;

..but what if your intent is not for committing a felony, but simply such that X doesn't have your government-issued identification?

I did think about what you're saying when I was looking up the statute, but having looked at these ID scan services, they seem to have put a large amount of time into trying to verify the legitimacy of the ID from the scans and I'm not sure you could easily pass it with an identify crafted from whole cloth?

To your second point, yes, you would have to be committing a felony, which you wouldn't necessarily be. I got someone off a burglary charge that way once, since a burglary is defined as entering a premise for the purpose of committing a felony or a theft and the defendant only entered the premises for the purpose of slapping his girlfriend, which was a misdemeanor o_O

You do have to be careful though, violating the terms of service of a web site is at least a misdemeanor in a number of states (including Illinois), and is a felony for repeated violations.

1) do they actually check against government databases

2) it isn't even illegal to fake your identity towards a company, is it? I mean only if you do it to commit fraud, not pay, or get alcohol under the legal age or something like that.

Reply on news.ycombinator.com