The United States. I assure you that even though other countries have credit reporting, they do not use SSNs.
> will have no choice but to finally switch to a new system.
Really? I think they will just carry on unless and until the financial downside (losses from extending bad credit, or lawsuits from identity theft victims, or penalties from the federal government intervening directly) is shown to be really huge.
What I do not understand is why victims of this have not sued their banks over this yet. Suing should be the US couterbalance to this. People are innocent victims of fraudulent behaviour of their banks, and those banks are being robbed by thieves. Banks are supposed to guard their customers' money, which in this case they are clearly not doing. Maybe they do it unknowingly, or they are incompetent, but in the end those banks are behaving fraudulently too.
Identity theft is not just because of ssn or other unique semi secret numbers. It's part of it, yes, but the root cause is a combination of culture and lack of inventive (ie, identity theft is just not a big enough problem for actors to care).
More and more companies are insisting on customers signing binding arbitration clauses as a condition of doing business: car dealers, banks, airlines, you mention it. It's all very well to say, well, don't do business with them, when all the competition are doing the exact same thing. If you need, say, a new car, well, good luck getting one without signing most of your rights away, and this is no exaggeration.
Binding mandatory arbitration clauses mean that you cannot sue the company, and agree to accept the verdict of the arbitrator, for which there is no appeal, and who is generally hired by the company having the arbitration dispute and is therefore impartial /s.
I have read FTC field reports about vehicle warranty claims where one arbitration decision was so outlandish even the FTC wrote that it was irrational, and the vast majority were in favor of the dealer.
With a locked mailbox (which is the default) it becomes a hassle to steal an identity.
If I get a new credit card it's sent to the address I id'd for.
(Yes, I had an ID theft near-miss that involved a locked mail box in a locked stairwell. To me, the more obvious perpetrator seemed to be someone with access to the mail delivery pipeline, but the investigator I spoke certainly did not think terribly highly of the security of a locked mailbox)
Over here it's basically used for everything that needs authentication / signatures - taxes, banking etc.
Cannot do this with SSN.
They use ID cards with at least some features to make forging said ID cards more difficult, unlike the US SSN which is pretty much just a number on a piece of paper.
This is mainly an issue of authentification and as long as your credentials remain crappy/easy to guess/easy to forge (like the US SSN system), that long it will stay easy to game the system.
Imho this def con talk about birthing and killing virtual babies might also be quite relevant to the issue, tho it's not entirely focused on the US: https://www.youtube.com/watch?v=9FdHq3WfJgs
No, but many use systems which are not appreciably better than SSNs from a security and identity theft perspective.
Identity theft isn't something I hear about often here.
The ID is government issued, cheap to obtain in case of loss (30€ and a bit of waiting until the new one arrives) and contains a photo of you so it's of no particular value to someone who doesn't look like you.
IIRC identity theft isn't a huge problem in Germany but it exists, however most credit agencies offer options to lock down or delete data concerning such theft, I haven't interacted with any of them yet though.
In addition, each government service uses a different ID number and is forbidden from sharing information or using another service's ID number. So you have a fiscal number for taxes, a social security number for health things, an identity card number that only has meaning with the card itself. Your private (non-healthcare) insurance, your bank, and other private institutions can issue you their own number as well (or another kind of id key) but can not share them between themselves and cannot ask you to give them numbers of unrelated services. Citizens are responsible for forwarding themselves most information between separate services when needed.
In practice it makes it sometimes tedious to auth at any of these services (you have to find your number in whatever mail you received or card you got issued) but it really makes it more difficult to impersonate another citizen, as you would at most gain access to one service, and it wouldn't help you access any other.
Or use the eID functionality, which is growing now that the old IDs are starting to expire.
A couple of weeks ago I had a friend over who used my WLAN to eID for some service (i think it was pre-paid CC? Neither of us can't remember at this point) over his android phone using some "AusweisApp2".
He ended up in a video chat with a lady who asked him to show his face/ID and swivel the ID in the light so she could see the reflections of the security features.
I was sitting next to that whole process thinking about how difficult it would be to put on a convincing facemask and create a matching fake ID that would pass a video inspection.
Shouldn't be that difficult, most certainly less difficult than trying to convince a postman in person by showing them a fake ID at an address matching the fake ID.
Rather, it's just very difficult compared to faking an SSN number on the internet.
The address in this case would be difficult since a lot of institutions pull your address from the local registry, so you can't convince them to not sent stuff to any victims address unless you manage to change their address in the registry too.
Ah, that’s the system you use when you don’t have any of the new eIDs, but one of the old ones.
That should be phased out by 2021
To confirm your income: Your yearly income tax sheet, a payslip or your contract of employment.
There is really no reason whatsoever for credit check and background check agencies to exist. All they do is ask for these papers anyway.
But think about America right now. Do you honestly think we could get national ID numbers? Could you imagine people being asked for a DNA swab or fingerprint to establish their identity? The blow black would be monstrous, and I don't think it'd be entirely unjustified. With 1% of our population incarcerated or on probation, with no national health care and being the largest state sponsor of terrorism in the world, there is good reason for Americans not to trust their government. Add in all the fundie religious people crying "sign of the beast" and Alex Jones followers yelling "national RFID chips" and you're stuck with a situation that cannot change.
Not necessarily. Not all states require an SSN in order to issue an ID.
> But think about America right now. Do you honestly think we could get national ID numbers?
Unfortunately (for all the reasons you mentioned and more), we're pretty close, as the REAL ID system is about to take effect.
That's going to be a huge problem for people living in the states that don't issue REAL IDs. It's also going to be a problem for legal immigrants and transgender people in every state.
I was under the impression that every single state requires an SSN to issue a driver's license or id card in order to track and enforce child support order across state lines.
Which states don't require an SSN to issue an ID?
Legal immigrants have passports, and ID cards/driver's licenses from their home country. I'm not sure what will require two forms of REAL ID compliant identification.
Nope. If they did, the impetus behind the REAL ID act wouldn't even be relevant, because illegal immigrants wouldn't be able to obtain a drivers' license or state ID.
> Which states don't require an SSN to issue an ID?
California is the biggest one, and in fact, California makes it illegal to discriminate against anyone who has a driver's license but cannot show legal residency.
Some states mark licenses as "not valid for identification" if they don't show legal residency, but it's usually subtle and easily overlooked or ignored. And the SSN isn't the only way to show legal residency, either.
> Legal immigrants have passports, and ID cards/driver's licenses from their home country.
For foreigners, passports are the only acceptable form of identification from foreign governments. Driver's licenses and other government IDs are not allowed, with the exception of driver's licenses from Canada.
Missourians have good reason to distrust the DMV, as they have been caught red handed illegally useing their databases in the recent past.
One shouldn't verify documents unless you're a member of the organization that issued them.
I remember needing to get a new SSN card once and it was creepy how easy it was.
The difference is probably that here those agencies aren't somehow trying to guarantee my identity. They just answer what credit rating my identity has.
In non insane countries, you are considered debt-free when you have no credit, not when you accumulate credits and pay them with one another.
I'm not sure how you think the American system works if you think that "debt-free" has any meaning other than "no balances or debts outstanding".
In Estonia I believe the system is based on public key cryptography (every national ID has a private key that is used for signing things).
Wow, that's really user-friendly, I wish it would be handled like that in Germany too.
Instead, German registration offices are selling citizen registration data in bulk to most interested parties and they couldn't even tell you to whom [0].
People can opt out of that process, by handing in a written objection with their initial registration, tho barely anybody actually does that because barely anybody is aware of their data being sold in the first place.
These are implemented as biometric two factor auth. So you show your id card, scan your finger print and validate via a code received to the registered mobile device on sms
(1) https://www.google.com.sg/amp/m.timesofindia.com/business/in...
And in a delightful catch-22, Aadhaar is essentially a requirement for obtaining a cell phone.
You can bypass this with some other documents and providing a landline that they verify within a week, but it's incredibly cumbersome.
I don't know what the rules were back then for moving to Canada, but you could stay 180 days at a time back then.
I'm glad they can make discresionary decisions like that for special circumstances, such as someone who clearly can't have an ID or passport yet.
Mind if I ask, did they ask for your passport?
It's the same in the US too. The problem in the article is that the person had a legitimate driver's license issued in the stolen name with his own picture on it.
It's not just a simple as "he had the SSN".
+ Getting a mortgage as an identity thief? Fine. Easy to pay him a visit.
+ Getting a car? No. That's dumb. You can buy a car if you have the money.
+ Getting a bank account? Fine. Just force banks to disallow people to go below zero for several years (or forever). Replace all credit cards by debit cards.
That's basically the situation in the Netherlands for most part. Identity still gets stolen, but the impact is minimal.
This argument doesn't not follow logically. It's like saying you shouldn't lock your house because if somebody really wants to get in, they will do it.
As a result you have the equivalent of dozens of people trying to pick the lock of your door every day, and the law can't do much to stop it. That requires you to pay f*ing attention to the quality of your lock.
But it would no longer provide security if every person in the country had a copy of your key.
Of course, this isn't something I suggest you do. It's certainly not practical for most people. I mention it only to show that there are varied security needs. On this particular subject, my credit has been frozen since the OPM breech.
the day you get robbed, it will absolutely make a difference for whoever insure your house and its content.
It's pretty great to live here. The only crime in my area is growing weed and that's now legal.
The argument that it is ok, because anyway if somebody wanted it really hard they would find a way to get my personal details, is illogical.
SSN is fine, what we need is the right for our credit to always be frozen and anyone who grants credit outside of our approval is liable for the loss. We also just need to bite the bullet and make chip and pin mandatory everywhere.
We don't need to make identity theft impossible just reasonably hard. Other nations seem to have it figured out.
This means everyone in the US has to accept national ID.
(It could theoretically be done at state level but it would be a huge hassle compared to national, and your tax authority and others are already national and need to know every person that lives in the country).
Basically you need to trust the federal government to solve your ID problem. And if the answer to that is "Whoa that won't happen, people won't accept national anything" then the simple answer is you'll keep being subjected to ID theft.
Why is chip & pin a bullet to bite? Isn't that just better for all parties involved?
Sadly, just 'issued without approval' is a bit too wide a definition. You need to deal with 'john' helping others fraudulently impersonating 'john'. In that case, the bank should not be liable.
In general, I see potential for a weird type of coorperation. They verify identities for credit providers for a fee. In return, this coorperation takes on the liability of wrongly verifying identities.
Question is, given the importance of such a coorperation, how much regulation is needed? At what point is there so much regulation required that it is better left as a government-run service?
Of course the government will never let a good crisis go to waste. Instead, we will all get chips under our skin that can't be removed that will be passively scanned by the authorities everywhere we go.
The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where.
No. If you want to establish trust, use a random secret for each new trust relationship.
If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider.
Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).
They shouldn't even ask for it.
Currently fraud is held back by law enforcement. Which is triggered by fraud detection. Which is triggered when the wrong person gets a call from a collections agency.
And this chain of events is too long, but since there's no global (national) system to check if someone is a professional scam artist or a regular bloke, that's what banks are left with.
Seems like an opportunity to force the hand. I, like you, imagine such an action would induce systemic change.
Maybe.
Impossible. A large part of the American people is obsessed with "the government is going to oppress us all". National IDs or anything similarly working are therefore a big no-go.
If you could solve this problem, you could presumably also solve the gun debate to a large degree.
And it would help if individual making the faulty decision to extend credit lost all their commissions for the week. It should be a blight on their record, with more than 5 instances causing them to lose their jobs. And CEO of the worst offending company gets a hefty fine.
Maybe that would focus the industry on solving this problem.
So it would a "Credit ID," Passport Number, DL #, or something related. What's the difference, it will need to be stored next all your stuff, awaiting to be stolen. Now the banks eat the small % caused by fraud (cost of doing biz), your life is hell, but not theirs.
Scan your iris before getting the new loan isn't going to happen either, too costly and slow. If they ever do that online, they'll find a way to recreate that based on your existing scan, stored at the future Experian.
Identity theft in Europe is extremely rare. It is possible to do something in your name, sure, but it does not happen nowhere near as often and damage is limited compared to ssn system.
Not gonna happen, banks for now will rather swallow the relatively low loses due to fraud.
In USA you sign a piece of paper (pre-approved loan), or login online and the loan money is deposited in your account within a few days. All automated. So far it works out for them, if fraud loses increase, the banks, not us, will choose the next method. And Congress will approve it within weeks.
It should not be a passport number or driver's license number. It should be the original, physical passport or driver's license that you present in person. The physical object is much harder to steal or copy, and can be revoked.
You should not be able to open credit lines or accounts with a business without appearing at least once in person first.
The national ID also has an embedded smart card usable for authentication but for some reason using that has never took off.
Video is just another form of photo copy, so how would that work?
All in all this process makes it much much harder to steal an identity. Also, once you report your ID card stolen, its serial number will be blacklisted preventing it from being used. Add to this that there is a snail mail address on your cards which will typically be used to send login information such as passwords and PINS
Also, please don't use terms like "steal an identity", that is how banks frame things in order to make it appear that they are not responsible. Banks don't employ reliable authentication, thus they get defrauded by imposters--nothing is ever stolen from those who the importers pretend to be, it's only between the bank and the imposter, noone else is a party to that fraudulent transaction.
For now, it remains somewhat secure in practice and will hopefully bye augmented by use of cryptography already available in many IDs (though, as other comments note, not widely used in some countries)
>The SSN shouldn't be the critical key in that list.
Nothing in that list is secret.
Why only 14-year-olds and younger?
Just look what many other countries do.
(You also can have a certificate on it, but they missed an opportunity and didn't make it default, you have to ask for and pay extra for that. Would have been a chance to widely roll out certificates of the standard necessary to legally replace signatures, instead of other crap that has been proposed as a replacement sigh)
Also, how is the reliability of the 2FA device established? If there were some claim before a court that you authorized some sort of transaction, what would they have to demonstrate to prove your liability? What will the court do if you question whether the numbers generated by the 2FA device are actually cryptographically random?
For illustration, when I'm logging in, I get the option to login with my password, OR to login with 2 factors. When the second factor is optional, it doesn't provide much defense. Some select services require the second factor, but its very few. Until very recently, the second factor was SMS, which is rather easy to fool.
Also, as far as I know, Digid isn't related at all to banking. Instead, you need to show ID (passport or ID-card, drivers license does not suffice in this case) to open an account with a bank. After that, each bank has their own system.
I absolutely hope this happens too...
... but I have a feeling all of the banks and agencies involved will find a way to plug their ears more and pretend nothing is wrong.
They will look at how costly and complex it is to create a halfway decent identity system (even though it's really not hard, other countries do it just fine with digital and physical keys/tokens).
And they will just continue to push the burden of ID theft onto consumers, rather than their businesses.
I would do this with the information:
1. Write a script to webscrape sites like LinkedIn to find out if a name/address/ssn key could be tied to people like doctors, engineers and whoever else might have sufficient disposable income.
2. I would take out loans in their name. If I have to be there in person, I would go from city to city and find people I could easily get dirt on, like people that might be here illegally. I would then cut them in for a piece of the loan and then move onto a random city in a 200 mile radius.
3. Move away after I get away with enough to live on for the rest of my life.
4. Hell I might just sell the rest of the information and scripts to other people who lack scruples.
Neglecting all of that you do realize that International wire transfers do exist right?
Australia, NZ, Singapore, most EU countries all have instant person-to-person transfers with little to no fees and supported via the government. 500 euro can be gone like that. Poof. But it's all within the same country. And when it's within the same country, it's traceable, reversible and enforceable by law.
So the 1-3 business days isn't where the protection is at. It's the way we mark and track transactions. The real danger, is SWIFT transfers. Once that money leaves the country, it's very unlikely you'll ever see it again.
[1]: http://penguindreams.org/blog/the-american-banking-system-is...
I remain hopeful that the full list of 140M SSNs will be posted in full. It's a rare opportunity: if that happens, the US will have no choice but to finally switch to a new system. One that doesn't rely on SSNs being private. That's the absurdity. It is easy to steal your identity because we have allowed it to be easy.
It's going to be difficult to switch to a new system, but the pain will be worth it. Imagine if the author could finally have peace of mind because nobody could impersonate him.
That is a fairytale, admittedly. It's always going to be possible to steal someone's identity if you're determined. But just look how trivial it is right now. Your driver's license plus the thief's photo is all they need. And it's possible to forge: they don't even need to swipe your physical one.
Those are “the keys to the kingdom,” said Bo Holland, CEO of AllClear ID, an identity-monitoring service. “Once you have somebody's name, social, birth date, and address, you can go and open new accounts.”
The SSN shouldn't be the critical key in that list.
https://youtube.com/watch?v=Erp8IAUouus