News for hackers. Stuff that matters.

A comment on Klarna users are being signed in to random accounts.

Re:Klarna users are being signed in to random accounts by vesinisa on Thursday May 27, 2021 @07:37AM (#27301780)
Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address.

Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order items from web stores to automated pick-up lockers with someone's else's SSN for payment info. The victim usually only becomes aware about this activity when they start getting debt collection notices for unpaid invoices from multiple stores for thousands and thousands of euros. The debt collection process in Finland is famously unfair and harsh towards the supposed "debtor" (here: victim of fraud).

Unless the "debtor" (victim) actively opposes each and every individual collection, the cases will eventually end up in court with summary judgement. This will ruin the victim's credit rating, which has devastating results for just about all aspects of life. People are known to have collapsed under the burden of all this and ended up taking their own life.

Klarna's response to all this is that they want convenient checkout experience and some fraud is unavoidable. Although there are excellent technical means available to strongly identify users in Finland, they add a minor layer of inconvenience compared to just typing in your SSN. This is OK for Klarna since they give exactly zero fucks about security as long as they can make a little buck from it.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by avereveard on Thursday May 27, 2021 @07:40PM (#27309989)
Good to hear, I failed an interview with them at the sixth step or so because I make a point not to remember easily googleable trivia, bet their engineers are traversing rb trees on paper off memory like crazy right now trying to find a solution
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by 2rsf on Thursday May 27, 2021 @10:08AM (#27303311)
In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by simon1573 on Thursday May 27, 2021 @06:26PM (#27309357)
Qliro has that too, which I know since somebody bought shoes with my SSN. I don't know if it's a general feature or if you have to contact them, but the functionality is implemented at least.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by 2rsf on Friday May 28, 2021 @09:12AM (#27314932)
I contacted them and they said no, but they have other "smart" ways to prevent fraud
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tapland on Thursday May 27, 2021 @08:33PM (#27310416)
Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases.

That makes them double bastard.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by mlonkibjuyhv on Friday May 28, 2021 @06:58AM (#27313887)
They what now? That has to be illegal.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by 2rsf on Friday May 28, 2021 @03:29AM (#27312652)
they do what? how is that even possible? even if I never coupled my account to them?
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tappio on Saturday May 29, 2021 @04:51AM (#27323918)
It is called open banking. Banks are 'anti-competitive' so some people managed to lobby in a directive that forces banks to provide apis for companies like Klarna to access their bank accounts. All you have to do is accept tos.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by vesinisa on Friday May 28, 2021 @06:57AM (#27313882)
Wait, so you have to explicitly ask Klarna to not sell stuff under your payment info to random internet strangers? That's not too good either - I think ordering without BankID should be opt-in rather than opt-out.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by carlhjerpe on Monday May 31, 2021 @11:01AM (#27344730)
I can't remember ever opting in to the Klarna BankID requirement, but when i checked it was enabled on my account.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by sneak on Thursday May 27, 2021 @08:20PM (#27310306)
The actual victim of the fraud is the creditor who was defrauded by the criminal; they are just leveraging the unfair legal system to push the liability onto someone who was not party to the fraud in any way (the person whose name was used in the fraud by the criminal against Klarna).

This is the lie of "identity theft". It's not identity theft, it's money/goods fraud, from a bank that didn't do proper authentication.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tapland on Thursday May 27, 2021 @08:34PM (#27310421)
And guess who's their own bank?

Klarna \o/

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by sly010 on Thursday May 27, 2021 @06:26PM (#27309354)
I am not sure this makes sense. Shouldn't Klarna provide proof of the transaction to the court? Won't the court look at it and throw it out as baseless? If Klarna were actually on the hook for their own money, it wold only have to happen a few times before they realize it's not worth it. edit: definitely not a finnish lawyer
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by vesinisa on Friday May 28, 2021 @05:59AM (#27313515)
Problem is the invoice itself is real. You have to contest it actively to the debt collector and give at least some evidence as to why the debt is invalid. If you do not actively contest the collection, it will soon end up in court. This is a very routine case for a district judge where they will give a default judgement in favor of the plaintiff.

The problem is that the law in Finland is written so that even if the collection is baseless the supposed debtor needs to actively manage it or end up in legal jeopardy. Which is rather unfair if you are a victim of identity theft.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by beagle3 on Friday May 28, 2021 @12:28PM (#27317387)
This was probably already common fraud in Finland before Klarna if that’s what the law says - but Klarna would be a crazy force multiplier for the fraudsters and no help for the defrauded, so it becomes a much more pressing issue.

(No knowledge of the details, just speculation based on the discussion here)

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tappio on Saturday May 29, 2021 @04:54AM (#27323926)
Nordics have really poor laws around this. We have these payday loan companies that work under the same principle. Klarna just found a way to conveniently do the same. It is easier to capture buyers at the counter rather than before the counter. Effectively Klarna is a payday loan company in the Nordics and has nothing to do with easy checkout. In fact, they used to offer kickbacks to merchants, so every time someone chose Klarna invoice they would pay the merchant instead of charging for it, because they get so good profit from the individuals due to poor laws.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by beagle3 on Saturday May 29, 2021 @07:54AM (#27324661)
... and as always, trust works really well, despite the occasional fraud, until someone finds a way to exploit it at industrial scale. And then it fails spectacularly.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by AdamJacobMuller on Thursday May 27, 2021 @09:49PM (#27310880)
> If Klarna were actually on the hook for their own money

Aren't they?

> it wold only have to happen a few times before they realize it's not worth it

That's an assumption. Someone did some A/B testing and said this payment flow results in X% increased sales, resulting in Y% more revenue for Klarna, it results in Z% more fraud. I don't even object to this per-se.

If Y is greater than Z, they will do it.

If they are especially awful they will consider that of the Z% of fraud it will result in A% still being paid for and B% being recovered in debt collection. That is awful.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by heavenlyblue on Friday May 28, 2021 @12:05PM (#27317092)
> results in Z% more fraud

They would probably not measure fraud but just losses directly.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by dpatterson2008 on Thursday May 27, 2021 @07:14PM (#27309767)
This reminds me of this BBC article I came across: https://www.bbc.co.uk/news/business-55829879

> To use Klarna's pay later service, which defers payments for up to 30 days, shoppers only have to provide a name, email, date of birth, mobile number and billing address.

It’s mind blowing that’s all the information you need to process a payment via Klarna.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by sneak on Thursday May 27, 2021 @08:18PM (#27310293)
The benefits of reduced friction in high-trust societies are incredible sometimes. The failure modes are predictable.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by pylon on Thursday May 27, 2021 @08:49PM (#27310511)
This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by rjzzleep on Thursday May 27, 2021 @10:50PM (#27311220)
The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and yet normal citizen services can't be done with it.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by ChuckNorris89 on Friday May 28, 2021 @03:12AM (#27312566)
>The German version is a clusterfuck ...

These gigantic government IT projects are also a good way to funnel taxpayer money to the right pockets, that's why they're always behind schedule and over budget (just like all government physical infrastructure projects) and if you look closely it's always the same 2-3 companies getting all the contracts.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by anoncake on Friday May 28, 2021 @03:46PM (#27319669)
Bullshit. The German electronic ID card wasn't a huge project and it was developed in-house. By all accounts, it works pretty well if you actually have the opportunity to use it. The problem is that nobody supports it. In part because of federalism: You rarely interact with the federal bureaucracy directly and the states for some reason aren't interested in supporting it.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by rorykoehler on Friday May 28, 2021 @04:10AM (#27312900)
In Singapore they have world class public IT infrastructure and they do it all in house.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by vesinisa on Friday May 28, 2021 @06:55AM (#27313864)
Finland offers a state of the art digital authentication system. It's just that Klarna doesn't want to use it because it adds an auhtentication step to their checkout process. It's just easier for them to take the random internet user's word for who they are (!!).

I am not sure how this is even legal under the PSD2 in EU. It might not be. But Klarna does not seem to care, and I really hope someone will take them to court over this.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tmk1108 on Friday May 28, 2021 @09:29AM (#27315083)
Is there any pressure in Finland to make this illegal? If your transaction didn't go through the digital authentication to verify identity, then it's worthless and the money can't be collected?
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by vesinisa on Friday May 28, 2021 @10:21AM (#27315620)
Yes, PSD2 (Payment Services Directive vol 2) should require strong customer authentication for online payments throughout EU. How Klarna is able to skirt this regulation is beyond me. Either they've found a loophole in the law or they are already in breach but the financial regulators are holding back from enforcing it.

https://en.wikipedia.org/wiki/Payment_Services_Directive#Rev...

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by grishka on Friday May 28, 2021 @02:21AM (#27312307)
I'm somewhat happy that my country is so much behind on all this digital stuff. You usually have to physically present your ID to do something serious, or at least provide a picture of it. We do also have an official "government services" website, and it implements a proper oauth flow that many other government sites use and uses SSN + password for login.
[ Parent | on HN ]