Hacker News Reader

Comment by wklauss | Hacker News Reader

Physical IDs can be faked.

Isn't that an area that cannot be controlled at all? There are government issued IDs and if a normal company cannot trust them, then there's no way out. Biometric identification can be the last unbreakable protection, but that's also only valid until you find someone who, for example, lost/damaged his eyes in an accident and is up for scamming the company you're targeting.

I mean, there's a reasonable limit of what companies may want to check, but once those proofs can be faked, it's not their responsibility to fix the issue anymore.

(PS. some countries have more restrictions than others too - for example in Poland you need two IDs with a photo to get any kind of mobile plan on a contract - that leaves plenty of ways to verify your identity)

It's a question of how closely the ID can be inspected for accuracy.

When I go to the store and buy beer, they want to see my license. They always make me take it out, which means the clerk can feel it, and the "feel" will often give away a fake to someone who has handled thousands of legit IDs. Next, they look at the pic on the ID and then look at me to make sure they at least kinda match. Nobody is really holding them up for a side-by-side, but you at least kind of have to look like the guy on the ID, which immediately limits the pool of people who could be faking my identity. Then, assuming it feels right and looks like me, they scan the ID and verify a record of that ID card with the state, which simply confirms that the state issued such an ID.

Between those three things, the system is actually pretty secure. But when you ask someone to scan in and email a copy of the front of their license as proof of ID, all three of those "checks" are eliminated.

Biometrics aren't unbreakable and can be spoofed quite trivially in many cases.

Here's a professor spoofing high-end fingerprint scanners with gelatin and a printer: http://vast.uccs.edu/~tboult/tmp/fingerprint-boult-koaa-medi... (sorry for the sensationalism at the beginning)

If the government database of IDs were available online (perhaps only queryable by a number on the card), the bank could look at the online version and verify it matches. Then you'd at least need to hire a lookalike to fool them.

Physical IDs don't get faked [in places where serious physical IDs are used, USA driverlicences in bars don't count] - it's simpler to make counterfeit dollars than counterfeit passports; from what I have seen from banking fraud statistics, if physical IDs are required, fake ID's are an extremely rare circumstance. You do get cases of (a) stolen IDs and (b) IDs bought off of homeless guys, and then used to open accounts and register companies for money laundering, etc. But not fake IDs - it's apparently too much effort and risk when compared to stealing or buying identities.

Exactly, but as you say the reason is that there's an easier and less risky (although it depends on the quality of the ID) way to get/steal money.

But that doesn't prove that requiring a physical ID is a safer method, just that there is a better workaround.

However, showing up in person is a huge inconvenience for a hacker in another country. Another technique banks use is to send a physical piece of snail mail to a physical postal address containing a verification code or card.

Reply on news.ycombinator.com