Hacker News Reader

Comment by whatever1 | Hacker News Reader

The replacement driver's license of a colleague of mine was stolen from his mail, and since then his financial life has been ruined.

Cars were rented in his name across multiple states and never returned, At&T charged dozen of apple products in his account, SoFi approved and disbursed loan in his name, credit cards were opened, credit score completely ruined. Some of them happened even after he froze his SSN.

And the answer he gets is "Too bad, there is nothing we can do". He is now fighting multiple legal cases against him.

Every time I think about it my blood boils.

View on HN

> froze his SSN

What does it mean to freeze an SSN, and how does one go about it? I'm familiar with freezing credit (through the big 3 credit score companies), but that doesn't sound sufficient to protect against a lot of what you're describing.

I think he started with online available info (I believe Reddit has a good identity theft community), but the thing is that notices keep coming long after fraud has been committed. So every week he would find out there are more things he was on the hook for.

Eventually he hired a lawyer to help him out, there are so many reporting agencies (for subprime loans etc) that you need to reach out to.

Long term a new SSN will be issued for him, but there is a lot of cleanup before that.

Can I ask why in the USA can a malicious individual with a random person’s SSN number and name allow them to wreak havoc?

In my country we just have a name but you need an ID document to get anything done.

Do banks etc. consider an SSN number to be a password?

They said in their first comment that their drivers license had been stolen in the mail, which is what started all of it. I'd imagine they either went and bought their SSN from someone who had a collection of them from hacks or they used information they were able to get from places that ask for verification but show a few digits (e.g. "confirm your SSN: *-*-1234") to narrow down and then brute force different numbers at different sites until they got it.

There is no way to freeze an SSN. As you pointed out, all you can really freeze are credit files. In some circumstances, victims of identity theft can obtain a new SSN.

https://www.businessinsider.com/personal-finance/credit-scor...

Thing I never got about ID thieves pulling all this off with stolen basic credentials is just how they get approved so widely.

I mean, imagine, often, when you're the ACTUAL holder of an identity, trying to legitimately obtain credit, buy products and so forth, you get all sorts of absurd algorithmic or anti-fraud roadblocks that can make it tricky or fully block you, but then some dude with only part of your ID paperwork in his hands can just go ahead and take out loans, get credit, use your name for X or Y official thing just like that? Then also, them getting the mailing addresses they need for all these scams to work. How do they pull that off too?

I'm really puzzled by how these contradictions work?

I think this is one of those cases where the actual holder of the identity sees the process as an annoyance, and the ID thief sees it as a job. If you repeat the same procedure a hundred times you get really good at doing it efficiently.

That's a good point, and makes sense. Also, they can afford to be blithely reckless about all those attempts, more than someone stressing about rejections with their own, one true ID.

Because there are plenty of creditors who will not put customers through all of those hoops, and the front line sales guy at AT&T is motivated to get that phone sold and that line activated, that car salesman is motivated to get the car sold. If it turns out in 6 months the bank is holding the bag on a fraudulent loan those front line salespeople are not really going to have any impact to their bottom line

Every time I read bout what damage you can do to people's lives with hurt a number, in the US, I am glad that I live in a first world country.

Reply on news.ycombinator.com