Identity theft is a term that comes from the fact that you can use this information to open up a bank account or become someone digitally, not because they steal your personality.
It’s a great term because exemplifies the gross negligence and liability that comes with egregious misuse of personal data
By calling it identity theft, we are saying individuals are the victims and should protect the banks from someone pretending to be them.
Edit: I also believe there was an argument that banks reporting to credit agencies based on fraudulent activity from a 3rd party should be treated as libel.
This is interesting - do you know if it has ever been tested?
As I said, those details, including address and more, are public in some countries. Those countries have learned to live that just being able to say my name, date of birth, address and telephone number is not enough to open a bank account, why can other "modern" countries not adjust accordingly too?
There is a reason why the majority of these frauds are US based
Now if they do that, changing in particular the latter is rather hard.
This is very close to "stealing" your identity — in that you yourself don't have the ability to use your identity any more in any useful way, because your identity is now (legally) dead.
Then again, they don't possess it after that point, either. So maybe it's more like "identity destruction" or "identity defacement."
India has/had a loophole that scammers use to declare someone dead and steal their property.
https://en.wikipedia.org/wiki/Uttar_Pradesh_Association_of_D...
(Both of which is easiest done by compromising a doctor fully. They have access to ID database.)
They tell you not to tell anyone your EMŠO... but EMŠO is generated from your date of birth, gender, former yugoslav republic you were born in (slovenia=50) and the sequental number of your birth that day (0-499 boys, 500-999 girls)... plus a checksum. So if you were born in slovenia, are a boy, and were a third boy born on 20th december 1970 (970... because why waste numbers?!?!), your emšo would be 201297050003K (K=checksum, too lazy to calculate).
We also have a tax number, that they also tell you not to share... but then you open up an independent contractor business (technically, it's a not a seprate company, but "you" are the company), and your personal tax number is published in many many online systems, info pages, you have to put it on receipts, ads, you have to tell it when you're buying toilet paper for work use, etc.
But yeah... if you want to open a bank account, you need a government issued id card (or passport), and they check it very very throughly.
Tax number NIP is relatively public, any relevant accountant will have it.
The remaining secret thing is indeed the ID card and/or the passport. That's why if it ever gets lost or stolen you're supposed to immediately file for a replacement. Theoretically at that point someone might impersonate you.
I recommend contacting the credit rating agencies and getting them to place a note on your record with a password, eg. [1]. Don't wait until someone "steals your identity". It's the only way to get these companies to do something resembling an actual identity check. Doing it after they've lent in your name (as the rating agencies suggest) rather defeats the object.
[1] https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/Howdo...
In countries where this doesn’t exist, obtaining credit requires providing proof of income (payslip, etc) to the lender which they verify. A mere name/address/date of birth might be enough to open inconsequential accounts such as loyalty cards, but will absolutely not get you credit - therefore the damage to identity theft victims is greatly reduced or even nullified.
Bad payers are still penalised even without a credit bureau system by a register the government operates onto which a debtor is registered for a certain period after legal action by a lender (so this requires significant effort from the lender - you don’t get on this register because of a telecoms billing mishap for example).
With regards to setting a password, I wouldn’t trust CRAs to enforce this. What you can do however is pay for CIFAS protective registration - it’s usually for victims or those at high risk of identity theft but there’s no legal requirement so anyone can pay the admin fee and get added to the register. Lenders check this during credit applications and this puts an instant block on any kind of automated approval and requires them to do further verification.
That only works because of low friction lending.
Why not share, if it's so harmless? Isn't that the point you're trying to make?
https://www.ratsit.se/19290708-Bertil_Thomas_Andersson_Taby/...
> Bertil Thomas Andersson - 1929-07-08 (93 years old) - Address: Lyktgränd 2 lgh 1706, 183 36 Täby, phone number 070-208 35 86
The website also adds information about income:
> (machine translation) In Täby, Bertil Thomas Andersson's home municipality, there are 5218 income millionaires. The proportion of people with payment notes in his postcode 183 36 is 7.3% and the average income is 295 679 SEK ($27,378) per year.
If the person runs any companies, that would be visible as well.
All of this is public information, for each individual and company in Sweden (except the ones that have requested to not be visible, or are protected)
There is more than a trivial semantic difference between "identity theft" and "bank fraud". The former very clearly identifies the victim as being the individual whose data was used, while the latter makes the victim the bank. There's a compelling argument to be made that it's unreasonable to expect any of the information that we have come to associate with "identity theft" to actually be private any more after repeated data leaks by Equifax et al. And if we cannot expect it to be private, is it fair to drag individuals through hell and back when someone successfully defrauds a bank using their details? That's the question being posed by OP, and the semantics of the terms we use are central to resolving it.
Calling it identity theft when all someone has to do is get on to one of the many public data leaks and find your information is weird. It's not some kind of heist, it's using publicly available information to trick gullible banks.
identity, n. 4. "the state or fact of being the same one as described."
Those companies aren't trying to verify that information for its intrinsic suitability, and their goal isn't to facilitate a transaction with someone who merely has all of someone else's personal information- they're trying to make sure the person engaging in that transaction is the person indicated on the form. If they switched to say, a finger print, voice sample, DNA, and an in-person interview with an ID check, they would still be trying to validate your identity.
> stealing an identity isn't actually possible. What is possible is legally persuading a bank that you are someone else.
That's like saying murdering someone with a gun is incredibly difficult because unless you actually beat them to death with the gun itself, you're just aiming and pulling a trigger, which isn't even illegal in many cases.
Theft:
steal, v. 2. "to appropriate (ideas, credit, words, etc.) without right or acknowledgment,"
Appropriating your identity for the duration of a transaction certainly fits.
> Calling it identity theft when all someone has to do is get on to one of the many public data leaks and find your information is weird. It's not some kind of heist, it's using publicly available information to trick gullible banks.
Nothing in that definition requires the thing in question was suitably protected or appropriate for the job. Nothing requires that it be permanently stolen or that anything be removed from anyone's possession.
---
I agree that the data and mechanisms used are not up to the task, but only using arbitrary definitions of theft and identity and looking at the mechanisms of theft while ignoring the purpose of those mechanisms doesn't mean the term is wrong or that people aren't, by definition, stealing people's identities. You don't get to decide that people can't use specific, existing dictionary definitions to evaluate whether a term makes sense. And that's just from a technical perspective-- English is a descriptive language and terms mean what popular usage dictates they mean.
So unless you have some convincing arguments that nothing, by any definition, was stolen, that personal data wasn't being used to determine identity, and that the colloquial usage of the term doesn't actually matter, then identity theft is undeniably the correct term. The heistiness of the acts, other non-applicable definitions of the words, and the suitability of the methods of verifying identity are entirely irrelevant.
Pretending the catalyst isn't culpable in the indirect effects of identity theft is every bit as wilfully obtuse as pretending the institutions aren't.
I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are.
What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that.
Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against.
Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.