Important thing here: each id number has an address. I.e if you call them and say you are Bob with id 123456789 then they know the street address. So they can send a confirmation letter that needs to be signed, to the address belonging to Bob with id 123456789.

This makes the phone scam a lot more involved because you can impersonate someone on the phone but the mail makes it kind of 2fa. The credit card you tried to open in Bob's name will always be sent to the real address of Bob.

The bank didn't need to store much here - names and addresses they can lookup directly from the id number.

>Well I mean, what it comes down to is you need someway of establing that it's actually you over a phone or Internet

Why do you need that exactly? If you are selling something, it's quite simple: if you receive the money, you provide the service -- if not, you don't.

The payment processor can use 2FA (this is actually done by a number of banks in Europe, when you enter the payment information, you get a text message with a code from your bank to confirm the transaction).

> The payment processor can use 2FA (this is actually done by a number of banks in Europe, when you enter the payment information, you get a text message with a code from your bank to confirm the transaction).

I think 3-D Secure is the protocol they use.

https://en.wikipedia.org/wiki/3-D_Secure

In Sweden you use a special authentication method you install on your phone through your bank to prove your identity. It's basically a national 2FA. So when you for example declare your taxes you enter your social security number and authenticate the action with your phone each time.

So no, I don't think there's any Equifax equivalent where a data leakage would enable stuff like this.

How does the bank know it is you or your phone when you open an account?

You open the account in person, by showing them your ID card. The bank has access to the central national database of IDs, so they can compare if the ID card shown by the person matches the information coming from the central db, matching the person showing it on the picture. Hence you have strong in-person proofing, that is now the basis for the 2FA.

Thats how it should be done, except in the US there is no way to check against a national database of IDs, not even on the state level with DMVs. You literally trust the plastic card the person shows you and thats where the problems start. Online its even worse.

@EGreg below me - no, the national database has biometric information including finger and retina prints as well (definitely fingerprints, not sure of retina prints). The bank is able to check that too.

I see, so if you temporarily steal a card from a person who looks like you, you can open acccounts in their name?

Yes if you forge a drivers license or passport with my name and id number, and you put your own photo on it (or happen to look like me) you could probably do something bad like get a phone contract or request a credit card in my name.

However, most of those scenarios have the added security that the CC or some necessary confirmation letter to sign is sent to the registered address of that id. So you'd also have to stalk my mailbox to actually get the credit card. This actually happens - so people use locked mail boxes to protect against this.

That is, even for this "manual" id method, there is 2fa in the form of regular mail, made possible by the fact that you can't use my id and give them your street address. When you show my id - they immediately know what address belongs to that id.

Yes. If you steal the ID card or passport of a person who looks like you, you can do most things in life in their name. Take out a loan, travel the world, get married, etc.

The major benefits compared to SSN authentication still are:

* It's a physical object, you have to be physically present to steal each one instead of getting a hundred million at a time.

* Most people would quickly notice that their card is gone, report it, and get it revoked. You only have between a few hours to a week to use it, not the next 50 years.

If I call my bank, the bank personnel can (and do) request a challenge to the 2fa app. Same with connections over the Internet.

The 2fa app is driven by a separate company that only does identification service.