Again, this whole industry needs to change. We could cut massive amounts of the estimated $200B loss in the US with just simple things like mandatory chip+pin, 2FA or CCV for online purchases, your credit is always frozen and only unfrozen for a 24 hour period at your specific request (requiring MFA). It is so silly when I have to type in my 5 digit zip at the gas pump (something someone could easily find online or by asking for ID) even though my card has a chip.

As in, weeks or months or years of discussion.

Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.

And that's not a big problem even that it is not nice. The problem is when your company lends money to someone that says it's me. And it becomes my problem. Why?

The company wants a lot of conversions, so it has a low entrance cost. Then that company should pay for that problem, not unrelated third parties.

> Low trust versus high trust society is the thing you need to understand here.

For me, that's just one of the reasons.

Sweden, for example, is a high trust society. But companies are trying to play fair because they are going to be punished otherwise. Isn't that fair?

But, of course, in a society with a lot of corruption, and cheating, and low trust. Companies are going to defend themselves more. As they risk will get more fraudulent transactions that real ones.

All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault.

In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people.

Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.

Also i don't know have ever been involved in an "it upgrade" project and what it means to have the gas pumps now do different things. I want life to not be like that, but I think you would find its a bit harder than you are imagining.

The way those work in the rest of the world is basically by giro. You control your bank account, and the only possible transaction is you sending out money to other bank accounts. If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The system is not perfect and fraud still exists (mostly in the form of trying to pass a fake bill as a real one), but fraud is much less prevalent than in the US system.

The problem is that that someone else can claim to be me at my address to you (the impersonator), you send the bill to me (the authentic). I look this bill over and decide not to pay because I didn't request these services. Now we have a dispute, all due a third-party who impersonated me.

Unfortunately, this is also exploitable by me to later claim I didn't purchase the service from you, which I might do to avoid paying.

There's currently no easy way for you, as the service provider, to authenticate the request without an out-of-band opt-in (mailing a contract to the same place you'd send the bill to confirm that the services would be paid for), which would delay the delivery of said services. By the time the third-party has received the services and you've sent the bill to the authentic party, the impersonating party is long gone, and the authentic party is left holding the bag as the less powerful party in the exchange/dispute.

I had the reverse situation as an American traveling to Iceland when no chip+pin cards were available to me. I picked up the rental car with an almost empty tank. They point me around the corner--the gas station is automated. I start driving the 50km to reykjavik and cross my fingers.

Later in the trip I get into a similar situation of an automated gas station in a desolate area. I waited until a local came by, offered them cash to use their credit card. They seemed suspicious like it was some sort of scam (I dont blame them), but thankfully that worked out.

I was stuck. I eventually found a shop inside that would sell me a bus ticket if I bought something else.

10101 and 01010 are also valid zip codes.

(00000 usually works too even though it's not a valid zip code)

Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.

The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands.

I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts.

Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.

[1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-...

[2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.

No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.

There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.

In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way.

The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.

It is to be discussed whether the increase in the cost of the service would be worth it though.

I applied for a new CC last year entirely on-line, and had the new card in my hands within a week. They never asked to verify my identity beyond my SSN / DOB / Address, which all seem likely to have been released in at least 3 breaches in the last few years. This is surprising to me, as I've been asked to show ID when opening a local bank account. To me this makes no sense: Why verify customers more stringently when they effectively loan you money than when you loan them money? I guess it may just have something to do with banking laws..

This is all just a long winded way to say that I think that credit card offers, by mail or web, are a problem. They cannot do any meaningful ID verification anymore, now that all info is essentially public. I think they need to partner with some agency that has a physical presence which can do verification of ID via government issued ID. Eg, a bank, merchant, etc, who can look at your driver license, passport, etc, and verify your identity. I suppose they are worried about adding too much friction.

I am sort of surprised more HNers don't understand risk and the tradeoffs involved and seem to be taking an absolutist stance on this.

Equifax is an unforgivable failure of infosec but the general ideas around the risk of it seem like ...

Practically speaking, without significant landscape changes (and yeah equifax counts as one) it has generally been cheaper to trust people and write off the bad apples than to verify more. Or else there would be more verification!

Thats because most applications for homes, high value insurance or financial products are not actual fraud, they are usually consumers having trouble with you shitty process despite your best efforts to optimise for usability.

I don't know fully what the equifaxopocalypse means for americans though.

This is not the issue here. If a bank want to do this, go ahead, as long as they cover the losses. The problematic part is that if a bank gives a loan in my name to someone else, I get punished for it, not the bank.

Or explain that you don't understand the industry or any of the regulatory frameworks involved.

Have you ever accepted a payment?

EDIT: not sure if I misread you, probably responding to a comment in flight. Your initial position seemed to be different to what I read now. I get that "identity fraud" as an industry position is a shitty attempt at moving risk but that was not the comment I was reponding to. Sorry if that sucks.

If I publish your nude pictures in a newspaper, you are similarly not a party to this transaction, but you are hurt by it. This is similar.

Everyone absolutely wants to extend you credit.

They're saying the problem is this:

You want to do business with company A. Company A asks company B for information about you. Company B lies to company A. Now company A won't do business with you, because company B lied about you.

Company B in this scenario is a company like Experian.

Cheaper for the banks, sure. It was cheaper for Ford to pay injury lawsuits than fix their exploding tires. But kind of trade off is illegal for one to make when another party is getting materially hurt — even if on average society is better off; after all, if we confiscated all of bill gates’ wealth, on average society is better off than if he gets to keep it.

You argue that there are reasons for the lack in verifications and then that this is desiderable from a societal point of view.

To the question "should a CC provider cover the expenses on CC give to fraudolent impersonators?" what do you answer?

Indeed. And surely, when they then report you to a credit agency, then this is libel or slander. They have no reasonable basis to make the claim, and it results in severe hardship for you.

As OP says, the idea of "Identity" is a fiction designed to make it the responsibility of the citizen to deal with the "theft".

By definition, if it can be stolen, then it can't be considered an identity.

It may be in the US. Because of Revelation 13:16-17: "16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads; 17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name."

That's why national ID is difficult to sell here. Sorry.

Part of the resistance to national ID is also a question of federalism - we do not officially have a 'national government' - we have a 'federal government', even though in practice it is hardly federal anymore.

I guess if you got your ID by picking it up with your right hand it still is the mark of the beast.

https://www.wired.com/2012/12/upc-mark-of-the-beast/

God's perfect wisdom just keeps getting lost in translation, what a shame!

Choose your poison. Carefully.

Either we have a good functioning way to uniquely identify people or we don't. If you have the former, you could use it for evil, in much the same way as how with the later it is used for evil a lot with the various frauds talked about in the OP.

If the government wants to do evil it will do so with or without national ID, but the ability for fraudsters to do evil is dependent on there being no effective and secure universal identification.

I'm going to guarantee that the NSA tracking profiles on every US citizen don't need national ID cards to pick you out of a crowd. They could build a comprehensive identity database from CCTV and store cameras whenever you buy something to build a complete and hardened profile to identify you with. They have access to way more than enough material to start branding the "undesirables" and having them carted off to gas chambers within a week. We just suffer in the meantime under this false belief that ID cards are the make or break of liberty.

I would prefer shitty nonfunctioning systems which still allow me to use cash and buy a bowl of noodles to the alternative where I need to be more or less authorised to make that transaction. But thats just me.

We have secure epost for communications between people and the state here in Norway already. The authorities keep pestering me to register to use it so that they no longer have to send me paper documents.