What should those of us without smartphones do? Not to mention that this seems trivial, if not easier to break. I can find the target on Facebook and use a faceswap program to generate a video that looks good enough so that the $9.50/hr worker spending all day comparing faces, who doesn't quite care enough, accepts the video.

Ok, I know US citizens are not automatically given ID cards, so if everybody takes the SSN you give them at face value, I get that.

I don't understand the bank account especially. Like I have some automatically deducted monthly payments, but I remember I needed to specifically authorize the receiving account to be able to ask for the money with my bank.

With cards,the standards are starting to get there, i.e: I can enable with my bank that every time I use the card for internet payment, I need to confirm my identity with code they send me in sms. As far as I know, I could ask for different second factor of authentification, I know my dad has standard rsa token.

Unfortunately I had problem using this with some foreign site (I think it was Amazon?), so I had to disable it. I live in Czech Republic.

For SSN, if you have good credit, you a SSN and a name is basically all that's needed to open a new account connected to your general credit record. If the account was opened in your name without your consent, it's a lot of work to get it disassociated from you.

For bank account numbers, most payments are processed through the 'automated clearing house', which is fancy check clearing. In the old days, maybe your bank would look at the check presented and return it without payment if they could tell it wasn't legitimate / your signature wasn't right. With an electronic withdrawl, there's not really any information provided to them to check anything.

It's a constant pain that there isn't a common standard scripting language for finances so I can automate this stuff sensibly.

You could still retrieve some identifying information through their API, but if you keep your account credentials somewhere separate from your database it's less likely for an attacker to get both.

So at the end of the day there is a lot of things which make data toxic easily avoidable, and it takes people at the company willing to invest in making the data "non-toxic" and to some extent non-useful to people outside the company.

It's beyond this. MOST email address forms won't accept a '+'. I had to change the extension character to '_' on my server because it's the only non-alphabetic character that everybody seems to accept.

[0] https://www.fastmail.com/help/receive/addressing.html

That said, many banks - including in the US - can already generate single-use virtual CC numbers.

Blur[0] from Abine has this in their premium version. I have used it, and overall it worked well, but I had some password syncing issues and stopped using it.

A final key innovation would be if email providers would make it super-easy to generate aliases per site. I do this myself manually with fastmail, but if there was a simple browser extension that would automatically create an alias and fill in a form, that would be great, because I could have a unique address that all funnels into one place, for everything I sign up to.

Something like this can be done on FastMail using a catchall alias[1], but it requires a custom domain, and the domain could be used to link all the accounts to you.

I'm experimenting with it, but what happens when I forget a password and the email I used to sign up for it? A password manager is an option for that, but they have their own problems.

Edit: FastMail also has subdomain addressing[2]. I believe it works with all of the FastMail provided domains.

[0] https://www.abine.com/index.html [1] https://www.fastmail.com/help/receive/alias-catchall.html [2] https://www.fastmail.com/help/receive/addressing.html

It's infuriating there's any chance for fraud at all when it seems like a solveable problem in 2015

Of course, then i go to the US and any random hobo on the street can charge me with just the card number and a scribble. The problem isn't that credit card companies don't know how to get rid of card fraud, it's that their customers like the convenience too much and won't let them do it.

The same thing for identity theft. In my country opening a bank account or getting a loan requires an id card, which is government issued and contains a digital certificate protected by a personal pin. Unless someone steals that card and knows your pin, they can't steal your identity.

These are easily solved problems. The reason they're not solved in the US is because the people won't allow them to be, or at least banks and government perceive it as such.

There was a mechanism from the 1990s to do online payments without giving the merchant a reusable secret identifier.

https://en.wikipedia.org/wiki/Secure_Electronic_Transaction

It's too bad that something like that didn't become widespread sooner, because it could have drastically cut down on credit card fraud.

So something like, a public key with a private key that only you own? ;)

Android Pay, that succeeded Google Wallet, uses such tokens.

I thought Google Wallet was available in many platforms, e.g. even in my browser which may or may not run Android.