Read Ross Anderson book Security Eng., it deals a lot with these types of issues. In short, banks try not do anything about as long they do not have to pay for it.

I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.

Well, you’ve come to the right place.

When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?”

Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty.

Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law.

One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer.

This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists).

Corollary: open an account at every major bank to establish a duty-relationship everywhere.

Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.

Haha, I'd never heard this. I liked their TV show I should check out the radio stuff.

Classic Mitchell and Webb skit https://www.youtube.com/watch?v=CS9ptA3Ya9E

surgical in this sense means only blowing up the bus stop instead of leveling 6 blocks with a MOAB. Your feelings about safety are supposed to be negatively affected by a bomb. Whether that bomb is a precise or strategic bomb is immaterial.

About 3% of the us adult population doesn’t have government issued photo id. So if the issue is forgery say so, it’s not a lack of id or a cultural norm against it.

What? US banks won't bank you if you don't have 27 distinct forms of government ID and a recent rectal exam.

And then they have someone with an incomprehensible accent in a call center that probably also runs scam calls calling you up and asking for your password as part of their ordinary SOP.

They deploy fancy new tech like "verifying your voice" with some AI crap while simultaneously not allowing your password to have more than 8 characters. (Which must have two symbols but if one of them is ` you'll experience random spontaneous logouts).

There may be many causes of the disaster that is bank security, people not having ID is absolutely not part of it.

I want to be pedantic, it is not the identity they’ve stolen in the first case, but the documentation of the identity. A person’s identity is just intrinsically part of the person.

It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government.

Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.

What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)

As I understand it, it’s mostly fundamentalist Christians blocking national IDs.

We have at least two different national ID systems in the US: passports, and Real ID.

One of those two is as of last week or so required to board a flight in the USA.

The security around the facilities which make the documents is also significant. Getting the printing apparatus is no small feat.

    > Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details.

Woah. First, on HN I keep seeing this term "Europe". Europe is 50 countries. Please try to be more specific. Did you mean EU? If yes, then my question: Really? All 27 EU nations support and actually use this identity programme with financial institutions? I never heard about it. And, just saying that it exists isn't enough. Do normies use it (like your parents & grandparents)?

There's apparently no good way of doing this. Denmark have a system for identifying yourself online. It has a 2FA component, either an app on your phone, where you have to swipe or something (I don't use it) or a physical code generator. It should be basically impossible to break, except it's not, because people will get calls from "their bank" asking the to do the 2FA stuff. Basically any measure put in to prevent this is being circumvented by people believing that the bank, who barely wants to deal with customers, would actually call them up Thursday evening.

I think the current solution is to have users scan a QR code, if they are on a different device than the one with their authenticator app. I haven't hear of anyone with the hardware token being scammed though, but most of the people who have the hardware version, do so because we don't even trust an app on our phone.

But yes, there are PLENTY of cases of identity theft even in countries with electronic identification solutions.

One thing the US could do, but won't, is have an account registered with the federal and state governments. Any money coming from the government should ONLY go to that account and it changing it should require a thorough identity validation.