I still hold that this shouldn't matter to consumers.

My priority of problems is

* When fraud happens, banks can pass the pain and burden of proof onto consumers.

* Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan.

* There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley for auditing/accountability of aggregated personal information).

If 1. was addressed, banks would have an incentive to fix 2., and force credit reporting agencies to improve 3.

At some level I think the banks are stuck in a conflict of interest with regard to risk. The reason we need banks and credit agencies is precisely because there is risk. If transacting parties could trust each other without an intermediary we could all just trade directly and all would be fine. So banks are actually disincentivised to create a world where risk is very low. They also don't want it to be very high. They need just enough risk that it is both (a) too big a problem for us to ignore and (b) small enough of a problem that they can solve it (for a fee, of course), but finally (c) still big enough of a problem that they are relatively insulated from competition.

I think it's no coincidence that the current state of affairs sits right at the sweet spot of these intersecting interests. And the problem is that the model requires an element of risk which is quite hard to control. Every now and then it flares up and becomes much bigger than they want. So we have incidents like this where the insecurities inherent in the system get exploited on a massive scale and the risk threatens to cross from profitable to massively unprofitable.

I suppose at a very high level your thesis might be true, but at a practical level, I don't think it is. The banks have simply seen it's cheaper to eat the cost of fraud (and ensure the victim has the burden of proof wherever possible) than implement stricter security measures.

This goes from the transaction terminal to the bank's server room.

Europe has had chip cards for over 20 years. In the US, it was very recently implemented; only in the past year.

It wasn't that the US banks were occupying some "sweet spot" of retail transaction risk/reward; they simply didn't want to shell out the extra bucks to send people cards with chips in them. Neither merchant nor bank wanted to pay for chip-reading terminals. So, nobody budged until just the past year.

I don't know whether it was legislation, or perhaps the growing cost of credit card fraud (i.e. card skimmers, etc), but for whatever reason, it certainly wasn't a "sweet spot". We've had chip technology for 20+ years, they just didn't want to pay for it.

Well here in europe it didn't happen all at once. It was a gradual rolling of chip based cards, atms and terminals. There was a non-insignificant amount of time where some atms / pos terminals would reject your card because you/it didn't have the right technology.

But ultimately I think its the people themselves that demand more security from their banks. E.g. Bank one introduces chip based cards and more people choose that bank because they want more security. Then gradually some atms start to be "chip only", and banks start to see the chipless ones get all the skimmers and accelerate their replacement to lower costs which forces business to atart getting more pos terminals with chips to meet the demand of people with cards that have mag strip disabled.

Having more security seems to be what everybody wants and benefits from, its just that europe has smaller players which accelerates market forces in that direction, and meybe because european consumers just want more security in general.

How do banks in Europe verify identity? i.e. I call the bank and claim to be "Margaret Thatcher," what's the next step?

Here in the U.S. the next step is usually asking for the social security number. I called VISA/Citi to re-activate my card after traveling and they asked for the associated phone number with my account. Neither of these are especially secure, in my opinion.

Can't talk about the whole Europe, but in my country there aren't many banking services provided via phone and banks keep decreasing their count insisting on their clients to use mobile app, online banking or ATM. I believe you can't even get available balance in my current bank via phone.

Local UK bank after separation from Lloyds (now called TSB) asks for 3 random letters of your security answer which is also used as part of online banking authentication. Additionally, your address and previous transactions if you're calling re. fraud.

I think people would demand more security if they really understood how venerable the technology was. But no one beats that drum. So consumer remain ignorant and just keep shopping.

And even after pushing out chip reader terminals and cards with chips, banks in the US refuse to institute mandatory PIN code entry on all payments with the chip - as its everywhere in Europe. So nothing really changed.

It still amazes that people don't know the chip readers work faster with PINs, too. An argument against PINs I keep hearing is that the chip readers are so slow that PINs would slow things down further. The funny thing is that the chip readers right now are waiting real wall clock time in a "wish-it-were-PIN" system to generate signatures in two different timestamps instead of generate a single signature with a user PIN. It's technically hilarious.

Re: Cost of fraud.

Agreed. It still amazes me how prevalent credit card fraud is. Certainly that's preventable - if they want it to be. The problem is, the banks don't bear that cost, the consumer does. Even if the bank factors the loss into the cost of doing business, that still gets passed on to the consumer.

Consumers are limited by law to a $50 loss for credit card fraud and every bank I know waives even that.

It is merchants (stores, internet sites) that bear the cost of fraud.

But what of the time, stress, etc.?

Merchants don't bear the cost, the consumer does. The merchant might not hand me a bill but that cost is embedded somewhere in the price.

The bottomline is the consumer pays. No matter how you cut it, the consumer always pays.

I see it differently.

It's my meta data. More valuable than phone meta data, and perhaps (to me) more valuable than my medical records. I have a relationship (as well as ethical and legal protections) with my doc. On the other hand, I've never met Equifax. They have no relationship with me other than to exploit my personal info. I never opted into that.

Yes. It lowers risk. But who benefits more? Who carries the risk? Me? Or them? It's the latter, yes. Yet we have no choice in the matter? That's not kosher.

I heard in US if somebody knows your SSN, he can take a loan accounted to you by phone.

It is so strange.

What gives banks right to do that?

There is a huge difference between taking a loan "on someone's behalf" (as their representative, eg by someone with power-of-attorney) versus via impersonating them. The former is rare but legitimate; the latter is fraud.

It may be fraud, but if it's possible, that's still a problem.

SSN can not be used as authorization, because it isn't secret information. And really, the same is true for credit card numbers; they're shared with too many parties to consider them secret.

I mean the latter. Changed "a loan on you behalf" to "a loan accouted to you"

Yes and outside of the US nobody would be able to do a loan with a power-of-attorney without showing evidence of it

Part of it is that even the name of the crime Identity Theft insidiously paints it as something purely between the thief and the end consumer, whose identity was "stolen". Alice stole Bill's identity! But where is the company she stole it from? Where is the bank where she fraudulently used this information? These corporations' lack of accountability is built directly into the name we use for the crime! It's as if they are bystanders, peripheral to the crime.

We need to bury this nebulous "Identity Theft" and call out more clearly the two specific crimes that happened: 1. negligence (the entity that gave up the info) and 2. bank fraud. When you use these terms, the companies don't get a free pass. Just change the words and they're part of the mess.

Something an uncle said:

It used to be called Bank fraud and it was the Banks problem. Now it's called Identity Theft and it's your problem.

The bank the identity thief borrows from does suffer and is the one on the hook for the money at the end of the day. So they are kind of accountable. It's the leakers like Equifax that are not.

Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.

So, if I don't want to give them my approval, I must: not sign up for a bank account, never open a credit card, avoid getting a mortgage, buy only in cash, stop renting [0], only apply to some jobs [1], not take out student loans...

[0] Some landlords require credit approval [1] Some jobs check credit

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

Because the patriot act. https://www.edmunds.com/car-buying/car-dealership-credit-rep...

I was also very surprised to buy a car with cash, only to have a credit check required. It's a real thing. And according to this article, not required, but dealerships are confused by the language of the law and insist on running a credit check, anyway.

I think they know better, but they use it as an excuse to run your credit thus giving them more information about you as a buyer and an opportunity to sell you on their credit products (which is what they make their money on anyway).

The link you posted shows the exact opposite of what you say. The Patriot Act doesn't mandate a credit check when purchasing a car.

You also cannot buy a house with cash. We had to launder my father's life savings in a bank for six months before we could use it to buy his house, because the seller still had a mortgage on the property when he listed the property. (Why my father's life savings was under his bed is a completely different story.)

They don't. I just bought a car from a dealership on August 1 without a credit check.

The dealership wanted to run a credit check if I were to pay with a personal check, but not if I paid with certified funds. I called my bank to have my debit card limit raised to $40,000 for 24 hours and paid for the car on my debit card with no credit check.

Did you have to do the IRS form stuff?

It's hard to recall all the forms that I signed that day. I don't remember any IRS forms.

Can confirm. I bought a car last week in California with cash. Dealer did a credit check.

The system is rotten and (short of moving country) impossible to avoid.

FYI dealers do this because they want to be able to offer you financing if your check bounces. It's also a way to ensure that you go through with the transaction because now your credit is worse and going somewhere else would lead to worse financing. Put a freeze on your accounts with the credit bureaus before you get serious about buying a car with cash. Tell them that they may not do a "hard pull" against your credit. If they try, complain to the appropriate government officials (not sure who this would be, some consumer protection agency) and take your cash elsewhere. It's a scam to lock you in to buying from them. I brought my own financing to a dealership and they wanted me to sign a thing which among other things authorized a credit check. I crossed that part out and signed it. This caused some back and forth with someone who was not in the room (basically my salesman had to go "get it approved") but they really wanted the sale because I drove a rental car down from 6 hours away just to buy this specific car (I had set the sale up ahead of time over email). I was very close to walking out and they probably knew it, and figured that they'd rather make the sale vs trying to sell me on their financing vs mine (I happened to get an extremely low rate from a credit union).

> It's also a way to ensure that you go through with the transaction because now your credit is worse and going somewhere else would lead to worse financing.

There is no need to spread misinformation. While it is true that a hard inquiry will have a minor effect on your credit score (less than a 5 point hit), multiple hard credit inquiries from car dealerships or mortgage lenders within a period of 45 days only count as a single inquiry.

You're not at all disadvantaged by taking your business elsewhere, you're just making things up to furnish your dubious story.

I have low patience with salesman who prefer to BS me with credit when I have the cash available

What would've happened if your reports were frozen? Would you have been denied the car?

I bought a car by check in CA and I'm 99% sure I didn't get a credit check. I did have to prove to the seller that the account from which the check was written had sufficient funds, but that was it.

I'm pretty sure the credit check is done automatically by the dealership software, as part of entering a person into the system to get their paperwork filled out. It's probably done to save time because 99.9% of the time it's necessary. The credit check won't stop the sale if you're paying with a briefcase full of cash or writing a check.

That said, going in with a briefcase full of cash is going to cause a lot of other problems.

Yes, but you really have zero choice. Unless you decide that you can live without a cell phone, rental car, credit card, mortgage or bank account the rest of your life.

You can do only burner prepaid sims that don't require a name/personal info (which is a bit difficult to find) but your general point is still very valid. You cannot escape the data collection systems in our society without going all Henry David Thoreau.

> You cannot escape the data collection systems in our society without going all Henry David Thoreau.

Or living suspiciously like a drug dealer (without money laundering).

You can get a rental car, prepaid credit cards, and prepaid cell plans without providing your SSN. Although I'm sure a mortgage and bank account wouldn't be possible.

Is it really a choice if it's necessary to participate in our economy? No bank or loan will offer terms that don't involve the use of one of these credit reporting agencies.

It is effectively not a choice, and they take advantage of that

Although, in the case of identity fraud, they don't have your approval. Someone else signed the paperwork.

A choice you can't say no to is no choice.

These fake contracts are the bigger problem.

Recourse? Of course there are! You can subscribe to paying them protection fee that's very vague on what it actually does and that you can't unsubscribe without faxing and snail mailing them forms.

Totally reasonable.

We have all agreed. We gave permission to any company that extends credit. They give our information to these credit reporting agencies on an on-going basis, personal information, including what our payment behavior and history is.

All of this comes down to trust. We trust our banks and credit card companies. They trust Equifax. Equifax's customer is your bank or credit lending company, not us. It's actually very similar to Google, et al. We aren't the consumer. They collect our personal information, vastly more than credit agencies. And the real customer are the advertisers who pay Google. The difference is, we probably trust Google more than Equifax (even before all of this).

A month ago, my mom said she wanted to start using Uber on her phone. I explained how to install it, and when she did (as well as the Lyft app for that matter) it wanted access to her camera, photos, contacts, a list of information on her phone. And she said fuck no. And refused to give permission. So she still uses cabs and pays cash.

If an app wanted all that just to call a cab, I’d say “fuck no”, too. (Not an Uber/Lyft user, can’t confirm.) GPS, that’s all you need, and that’s all you’ll get. If you need more, ask me directly instead of digging through my shit.

Android, at least until very recently, had no way of asking at the point of use, despite being a feature in Symbian S60 since before the iPhone :|

If she still wants to use Uber, you can add a link to https://m.uber.com to her homescreen, no app needed. It also avoids the tracking after leaving the car (assuming she closes the site).

Since when does Uber ask for use of your camera or access to photos? And for what?

You can take a picture of your payment card instead of typing the digits in.

It should ask for permission if you try to do that, not when you install the app.

It might be an android thing. In iOS you can ask when you need it, and still use the app if you say no. I've gotten the impression that Android asks everything up front at installation time and doesn't install if you say no, but I'm not an android user/dev so I don't know for sure.

That used to be true but the permissions model changed to just-in-time a couple versions ago.

We don't trust them. We are forced to say we do, because the other option (to go without all the services gated on that answer) is so uncomfortable as to be non-viable for most.

I suspect it will become a priority soon. Somebody is likely to pastebin the data for some cabinet members, Congresspersons, etc. Then the matter will make it to the front of the queue.

Which sadly makes it a very short list of people they actually have to compensate for their troubles.

It would be nice if people actually owned all their own data (credit, medical, etc.) instead of for-profit corporations. A valid service would be to authenticate/notarize the data, perhaps, and then you'd have actual competition.

> How can they not be liable? How is this not negligence?

The elements of negligence are:

1. Duty

2. Breach of Duty

3. Cause in Fact

4. Proximate Cause

5. Damages

You probably haven't suffered legally cognizable damages (yet). If and when you do, they might well be liable.

I'm not a lawyer, but I think it's pretty crappy that you have to show damages in order to nail someone for negligence. Shouldn't it be enough that they engaged in risky behavior? If I go out on the road and drive in a risky manner, I can end up guilty of all sorts of things without hurting anyone or damaging any property. But give up personally identifiable information (which we know leads to bank fraud) and somehow it's "show damages or GTFO".

Treating my identity (aka personal privacy) as my personal property would help remedy this imbalance. Make a buck off my data (property), give me my cut. Allow someone to steal some portion of my identity, pay me damages.

Don't want to be liable? Then don't store my data.

The credit system sucks. But has anybody created a better alternative yet?

Yes! Germany and I presume other European countries have a much better system.

The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID.

Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.

For remote identification we have for example post ident:

Article is in english: https://www.deutschepost.de/en/p/postident/identifizierungsv...

> You could get a margage if you have never borrowed money in your life but have a stable income.

Same in the US, although it's a bit of a pain in the ass. It's my understanding, though, (correct me if I'm wrong!) that Germany is a bit less thrilled about credit than most other countries—even in Europe.

Credit management is big in Germany through SCHUFA and other companies and queried much more liberally. E.g. every time you purchase something online the store will likely check your credit and determine available payment instruments (this is pre-purchase) based on the response.

I don't think so? Germans have less credit cards, but they are still borrow money in the form of overdraft loans on their bank accounts.

No, they don't, just as most Americans will always pay their credit cards in full. Overdraft loans have terrible APR, as does credit from credit cards.

Most countries don't have credit scores at all.

There's typically a single public entity that holds insolvency records within the legal framework. In some countries nobody can query it but yourself; you're therefore asked to submit a copy of your record in some occasions.

As for solvency, when you sign a lease or contract a mortgage, you're asked to submit proof of income.

(Someone mentioned Germany earlier, it's a terrible example in my opinion, Schufa isn't much different than the US credit agencies, albeit more accountable hopefully).

Yes, many times. It is not that hard to not base your entire banking system on a single number anyone can use.

What gives banks right to consider SSN an authenticator?

Is there a law allowing that?

Common sense suggests it should only be possible if user explicitly accepted "I agree that knowing my SSN is enough to prove it's me and I agree to be liable to any debts created with just my SSN presented".

But isn't your SSN given by the government? Does the US government require anyone to sign such an agreement before they get an SSN? Without it, a bank claiming I owe them money because "we got your SSN" is fraudulent, plain and simple. Report the bank to the FBI.

But that's probably far too sensible European thinking.

I regularly keep hearing reports of how the US handling of money is basically medieval with some badly thought out insecure bits pasted on top. And some of that gets exported! It sucks that I need to own a credit card to be able to make international purchases on the internet. Why is there not an international version of iDEAL?

You misunderstand US law. Yes, someone can use my SSN (along with other private information) to create a debt. That doesn't make me liable. If it shows up on my credit report, I can disclaim responsibility using existing legal protections. As long as I truly didn't create the debt, it is the debt holder's problem.

But the problem has been created; which you've got to fix by paying at least in your time spent solving this.

What you're saying is probably true in any country; but in reality imo it's way easier not to allow that to happen in the first place.

Note that this is a great question to ask about all the f*ed up things in the USA. Hardly ever asked though for some reason. Having been the country that landed people on the moon seems to have removed the option to ask if other countries have better ways of doing things.

As far as I know, USA is the only country that uses such terrible credit system. In most other countries credit rating is controlled by the government itself or is at least heavily regulated. I haven't encountered any problems with my credit system -- nobody can check my credit rating without my prior written (or digitally signed) permission and I can login online anytime to see who has checked it. Furthermore, once in a year I can get a complete, free report to explicitly see how my credit rating is calculated.

If you're looking for a model for better regulation, take a look at the EU's General Data Protection Regulations. It just makes sense to have a single piece of legislation that regulates the use of personal data and a single statutory regulatory agency with powers of enforcement.

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...