> That's all you need to steal someone's identity

I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are.

What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that.

Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against.

Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.

> I wish we could stop propagating the idea that it's possible to "steal someone's identity"

Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality.

It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data

There was a push a while back to call it bank fraud. Because the banks are the victims and should be responsible to protect/insure themselves.

By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them.

Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.

> I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.

This is interesting - do you know if it has ever been tested?

I don't know, and I don't even remember where I heard it, I think it was on here but I dont know. I think maybe I was wrong about 'bank fraud' and the term being pushed was 'bank libel' instead of identity theft. Because all the negative sides of supposed 'identity theft' were from the banks saying the individual did something they did not.

I’d donate to gofundme for the legal costs next time it comes up…

Every bank I deal with (3 of them) take responsibility for any claims from identity theft/bank fraud. Looks like the push worked!

If a bank allows someone to open up a bank account with personal details that don't really belong to them, I'd call that fraud and a failure on the banks side. "Stealing someone's identity" sounds like I could and should have been able to prevent that, rather than putting the blame on the bank who accepted false personal details in the first place.

As I said, those details, including address and more, are public in some countries. Those countries have learned to live that just being able to say my name, date of birth, address and telephone number is not enough to open a bank account, why can other "modern" countries not adjust accordingly too?

Rather than just banks, you can say it is also a systemic problem if the details like ssn is such an important number yet it is so easily obtained.

There is a reason why the majority of these frauds are US based

Unless the thief gets their hands on my ID and personal ID number (similar to social security), they're not getting there.

Now if they do that, changing in particular the latter is rather hard.

There’s a funny Mitchell and Webb sketch about it: https://youtu.be/CS9ptA3Ya9E

Wonderful! I will be sharing this one a lot. Thank you.

You could take someone's identity details and use them to get a death certificate made.

This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead.

Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."

Undeading yourself in some societies ain’t trivial either. In others it’s nigh on impossible.

India has/had a loophole that scammers use to declare someone dead and steal their property.

See: Uttar Pradesh Association of Dead People

https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...

Source? With biometric identity system Aadhaar and 2FA auth for everything I find this hard to believe.

If someone does that- creates a fake 'death certificate' in my name via publicly accessible information and it actually goes through, how do you even go about trying to fix that? is this even fixable?

Here in Poland they would need that person's ID number and a fake signature plus data of an accredited doctor.

(Both of which is easiest done by compromising a doctor fully. They have access to ID database.)

In Sweden, this information is public.

I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.

In slovenia, you have your name, surname and date of birth, but also unique citizen number (EMŠO) and your personal tax number.

They tell you not to tell anyone your EMŠO... but EMŠO is generated from your date of birth, gender, former yugoslav republic you were born in (slovenia=50) and the sequental number of your birth that day (0-499 boys, 500-999 girls)... plus a checksum. So if you were born in slovenia, are a boy, and were a third boy born on 20th december 1970 (970... because why waste numbers?!?!), your emšo would be 201297050003K (K=checksum, too lazy to calculate).

We also have a tax number, that they also tell you not to share... but then you open up an independent contractor business (technically, it's a not a seprate company, but "you" are the company), and your personal tax number is published in many many online systems, info pages, you have to put it on receipts, ads, you have to tell it when you're buying toilet paper for work use, etc.

But yeah... if you want to open a bank account, you need a government issued id card (or passport), and they check it very very throughly.

Polish PESEL has the same problem of only having 5 numbers per day, one of which is also checksum so limited.

Tax number NIP is relatively public, any relevant accountant will have it.

The remaining secret thing is indeed the ID card and/or the passport. That's why if it ever gets lost or stolen you're supposed to immediately file for a replacement. Theoretically at that point someone might impersonate you.

Several bank loans and store cards were taken out in my name using only my name, address and date of birth, in the UK. The same cynical business logic applies the world over: it's cheaper to clean up after the inevitable fraud than to implement proper identity checks. This calculus is of course aided by the fact that the detection of the fraud and the organising of the cleanup is taken care of entirely by the victim. "Victim", not "customer", because usually there is no business relationship between the company with the shitty identity checks and the person that has to live with the consequences.

I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object.

[1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...

The fact that the UK has this nasty concept of “credit history” helps with this, since now all that’s needed to take out credit is basic details to lookup the credit bureau profile and then they “vouch” for you.

In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified.

Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example).

With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.

You’d have to see it to believe it how easy and normal credit is over here in USA. Even coming from uk it surprised me. You can even buy tyres on tick.

That only works because of low friction lending.

Lenders are "encouraged" to check the password. In your experience, how frequently do they do so?

Which is absolutely demented.

I always find it curious that allegedly Swedish people on HN post this sentiment over and over, but then never link to their own personal information.

Why not share, if it's so harmless? Isn't that the point you're trying to make?

I'm not Swedish, but a friend of mine showed me a website for it. Here is a random example of a person who lives in Täby, Sweden:

https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/...

> Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86

The website also adds information about income:

> (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year.

If the person runs any companies, that would be visible as well.

All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)

Maybe they don’t want their identity and their opinions to be linked.

I think it's way more common in USA than in europe because here you can't just phone a bank and open an account with your tax agency code. Normally the first time you need to go and show your id.

SSN is certainly not enough. I just recently opened 4 accounts with US banks remotely. All four requested to send them pictures of both sides of my ID card + my selfie holding said ID card. And there were additional steps to confirm my identity before activating the accounts.

All of this thanks to KYC anti money laundering regulation.

Can't you easily forge that?

Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.

Mitchell and Webb on identify theft

https://m.youtube.com/watch?v=-c57WKxeELY

Semantics. Nobody thinks your password being stolen means someone actually takes it from you or your device getting hacked means someone inflicted a physical blow with a sharp object. Someone illegitimately uses your personal information to claim your identity in recipt of goods and services. They stole your identification information to impersonate you.

"Semantics" is an extremely lazy way to dismiss an argument. Semantics is all that really matters in communication: what is the meaning of what is said?

There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.

You're flubbing the scope of the argument. The second definiton of steal in Webster's is to appropriate (e. g. credit) without permission. Identity theft is when someone appropriates someone else's identifying information, without permission, to impersonate them in a transaction or contract. Full stop. There's no qualification that the appropriated thing must be secret or that it was suited to its its purpose. If you think that the term is misapplied to other financial crimes, that's an entirely different argument, and it doesn't render the actual term a misnomer.

I'm not, this is where OP scoped it to. OP is arguing that "identity theft" shouldn't be applied to any kind of crime, because stealing an identity isn't actually possible. What is possible is legally persuading a bank that you are someone else.

Calling it identity theft when all someone has to do is get on to one of the many public data leaks and find your information is weird. It's not some kind of heist, it's using publicly available information to trick gullible banks.

Identity:

identity, n. 4. "the state or fact of being the same one as described."

Those companies aren't trying to verify that information for its intrinsic suitability, and their goal isn't to facilitate a transaction with someone who merely has all of someone else's personal information- they're trying to make sure the person engaging in that transaction is the person indicated on the form. If they switched to say, a finger print, voice sample, DNA, and an in-person interview with an ID check, they would still be trying to validate your identity.

> stealing an identity isn't actually possible. What is possible is legally persuading a bank that you are someone else.

That's like saying murdering someone with a gun is incredibly difficult because unless you actually beat them to death with the gun itself, you're just aiming and pulling a trigger, which isn't even illegal in many cases.

Theft:

steal, v. 2. "to appropriate (ideas, credit, words, etc.) without right or acknowledgment,"

Appropriating your identity for the duration of a transaction certainly fits.

> Calling it identity theft when all someone has to do is get on to one of the many public data leaks and find your information is weird. It's not some kind of heist, it's using publicly available information to trick gullible banks.

Nothing in that definition requires the thing in question was suitably protected or appropriate for the job. Nothing requires that it be permanently stolen or that anything be removed from anyone's possession.

---

I agree that the data and mechanisms used are not up to the task, but only using arbitrary definitions of theft and identity and looking at the mechanisms of theft while ignoring the purpose of those mechanisms doesn't mean the term is wrong or that people aren't, by definition, stealing people's identities. You don't get to decide that people can't use specific, existing dictionary definitions to evaluate whether a term makes sense. And that's just from a technical perspective-- English is a descriptive language and terms mean what popular usage dictates they mean.

So unless you have some convincing arguments that nothing, by any definition, was stolen, that personal data wasn't being used to determine identity, and that the colloquial usage of the term doesn't actually matter, then identity theft is undeniably the correct term. The heistiness of the acts, other non-applicable definitions of the words, and the suitability of the methods of verifying identity are entirely irrelevant.

And framing. "Identity theft" makes it sounds like you lost something. In reality, it's the financial institution that lost something.

If someone stole your idea, did you lose something tangible? Also, crimes generally consider cause and effect, including indirect effects if they're foreseeable. Is having to expend time, energy, and perhaps resources to protect the usage of information institutions use to identify you an unexpected side effect? Is it worth nothing?

Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.

I don't spend much of my time worrying about this, but if you do:

Put credit freezes on yourself and maintain them that way as the default. This cuts your attack surface significantly. Plant your flag with any large government entities that are used for collecting benefits (IRS, your state's stuff, etc.)

Do I love the state of affairs? No, but if it were something I worried about, I'd at least make myself a hard target.

There are _a lot_ of credit reporting agencies to place freezes with. I put freezes at several credit reporting agencies. It took quite a bit of time to work through a small subset of this list:

https://www.consumerlawfirm.com/credit-reporting-agencies.ht...

'Nationwide', 'Check and Bank' and 'Supplimentary/Alternative' are probably the minimum.

I wish we had privacy and security by default instead of "opt in"

> Plant your flag with any large government entities that are used for collecting benefits

What does this mean?

I think GP means create your account on these sites before a fraudster does it for you. I.e., if you already have an account, they need your login credentials to access your account. But, if you have not established an account, they can often establish a new account using nothing but publicly available data like your birthday and street address for identity verification, then access your data (IRS experienced a lot of fraudulent accounts being created to steal peoples' tax refunds; their new verification system is less susceptible, but IMO too invasive [biometric data]).

Sillystuff answered correctly.

I usually give them 1970/1/1 as my birthday. That's easier to remember, since password managers don't work well with date inputs sometimes.

That info is generally already public and easily accessible. Try googling yourself or a relative. You can find their date of birth, address, phone numbers, and neighbors in a couple of minutes.

> That's all you need to steal someone's identity

I have this information for many billionaires. Now tell me how to steal their identity. I would like to live their life.

This is a game of whack-a-mole, and no amount of regulation will help if the fundamental identity is founded up on bits of information like this. We should pass regulation for verification of identity using secure means, not giving out SSN + Birthday and call it a day.

This is making the problem worse I think.

There needs to be better laws protecting individuals that use aliases and what not for registration. Technically, there are certain federal laws that can make doing so illegal in certain circumstances.. while not enforced at a high rate, I do see them occasionally being applied unfairly and don't like knowing that by using aliases and what not that I could be opening myself to criminal prosecutions.

> If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday

Not much help for the American cousins, but this already exists throughout Europe and has done for years .... its called GDPR.

TL;DR : If it is or it is tied to PII (personally identifiable information) you have to:

     (a) Justify collecting it in the first place
     (b) Justify storing it, and storing it no longer than necessary
     (c) Obey with the "right to be forgotten" and delete it on request

The GDPR has a massive enforcement problem though, so in practice, you have little recourse if a company breaches it and misuses your personal information.

Oh, here it's easy enough, you can report misuse or breach of the related Polish RODO to the Office of Personal Data Protection.

They even at times busted telemarketers using databases, much less something grave like this.

Of course you better have a good description and consider that bureaucracy moves at the speed of bureaucracy, somewhere between a snail and a plant.

You can report it sure, but does anyone actually follow up on those reports with penalties high enough to deter such behavior? At least in the UK, the answer is definitely no. Our DPA is absolutely useless and may as well not exist.

You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers - that of course overrides GDPR, or more precisely, the law is the reason to store the information so there's no need to find other reasons.

Also, don't forget that these laws also have requirements on you keeping logs, most of the time 3, 5 or more years. So yeah you have to obey a deletion request when that time is up, not "on request" - that would be illegal in most cases.

In many EU countries birthdate (and more) is public information, btw - my own birthdate is made public by the state itself (on the business registry website), together with my name and residence address. Same for any owner of real estate - be it land, house or unit - names, residence addresses and birthdates are publicly available in the online cadastre.

> You somehow forgot to mention that most (probably all) EU countries have laws that require you to know the birthdays of your customers

That is simply not true, not in this very general formulation. What businesses does this statement of yours apply to?

It's certainly not common for an ecommerce site to ask for your birthday on signup.

Any online service thanks to DSA, for example: Anything that children might use (yes, so everything - intent doesn't count). Anything where users can upload content (writing comments is enough according to our lawyer).

You picked about the only remaining thing where it's not always a requirement. It's a requirement even there if the transaction is over certain threshold (varies by local law, usually around 10k EUR) or certain categories of items (drugs, alcohol, tobacco-related, sextoys, weapons etc).

This information is immediately available for anyone in the country, after they turn 18, via whitepages. This security via obscurity effort isn’t providing any meaningful protection.