We need a better phrase, like “impersonation fraud” or something, which focuses on the two parties actually involved. You can’t actually steal somebody’s identity of course, they are just an uninvolved third party.

Eh, I'd say it's a bit more complicated than that.

Quite often the impersonator had nothing to do with the collection of the identity itself. There are people that 'copy' things like insecure online information around identity, but there are also people that physically steal things like drivers licenses and birth certificates. This is the stage of a crime that I'd consider actual identity theft. After that you have black market information brokers. They didn't capture the identities in the first place. They don't directly use the information to impersonate others and yet they are still complicit in a crime. Then you have the final stage of impersonation fraud as you state.

I want to be pedantic, it is not the identity they’ve stolen in the first case, but the documentation of the identity. A person’s identity is just intrinsically part of the person.

>A person’s identity is just intrinsically part of the person.

Is it?

If I look at least somewhat like you, grab your ID, and stuff you in an incinerator then any ID system that does not take detailed biometrics will have no clue if I'm you or not.

Saying identity is intrinsic is tantamount to saying "I am that I am". I mean, that's cool and all, but that tells me nothing about who you actually are.

There is nothing intrinsic about your name for example. This can and does change for people.

Again, same with location where you live.

We spend our entire lives grown up and getting old, so how we look adapts.

Then you get down to bio markers like fingerprints or dna, but these are recent inventions when it comes to human identification and take a fair bit of technology to use successfully.

There's no such thing as identity theft, it's all bank fraud or in this case student aid fraud. "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices.

If the student aid system verifies identity by, for example, just validating that the applicants know a single 9-digit number that after the Equifax breach should be considered public information, that is a critical problem with their identity verification system and it should be patched.

https://www.youtube.com/watch?v=CS9ptA3Ya9E Relevant Mitchell & Webb.

Haha, I'd never heard this. I liked their TV show I should check out the radio stuff.

I’ve long wondered why victims of this fraud don’t more often sue the institutions that granted fraudulent accounts, for any and all damages and cost incurred.

Read Ross Anderson book Security Eng., it deals a lot with these types of issues. In short, banks try not do anything about as long they do not have to pay for it.

I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.

Well, you’ve come to the right place.

When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?”

Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty.

Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law.

One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer.

This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists).

Corollary: open an account at every major bank to establish a duty-relationship everywhere.

Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.

    > "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices.

Wow, great point. I admit: I have been tricked by financial institutions to believe this term! Another (US military) term that is similarly misleading to me: "surgical strike". If they blow up the bus stop in your neighborhood with a cruise missile fired from 300km away... well, you won't ever feel safe in that neighborhood again... so the strike is certainly less than "surgical".

Classic Mitchell and Webb skit https://www.youtube.com/watch?v=CS9ptA3Ya9E

surgical in this sense means only blowing up the bus stop instead of leveling 6 blocks with a MOAB. Your feelings about safety are supposed to be negatively affected by a bomb. Whether that bomb is a precise or strategic bomb is immaterial.

In places like Gaza, "surgical strike" often means "only" blowing up the support pillar of an occupied multi-story apartment complex in the middle of the night.

Whether we believe the lies of the Israeli government is also not quite related to the topic of Surgical vs Strategic Bombing. Clearly Gaza has been subject to the latter though.

> "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices.

The problem isn't the banks, the problem is that unlike Europe where in most countries it's commonplace for everyone to have a government-issued ID document, the US does not have that requirement and so companies of all sorts abuse documents not meant for that purpose like SSNs or driver licenses that can be trivially forged.

Banks can't invent security out of thin air when a significant part of the US population believes that mandating possession of one is a surefire way into a dictatorship or whatnot.

About 3% of the us adult population doesn’t have government issued photo id. So if the issue is forgery say so, it’s not a lack of id or a cultural norm against it.

How many billions would a major bank loose in a lawsuit, if they did the sensible thing and refused to deal with 3% of the population?

Most do.

For example: https://www.reddit.com/r/Banking/comments/1csl00q/any_banks_...

4.2% of US _households_ are unbanked. Banks refuse customers for many less extreme reasons than “can’t verify identity” which is in fact a requirement for them with all of their federal and state regulators.

>How many billions would a major bank loose in a lawsuit, if they did the sensible thing and refused to deal with 3% of the population?

Zero. Because FINCEN/KYC[0] laws in the US mandate identification for all customers.

Which means that at least 3% of the populations is "unbanked"[1]:

   Some reasons a person might not have a bank account 
   include:

   Lack of access via a nearby bank branch or mobile phone

   Minimum balance fees

   Distrust of the banking system, typically due to lack of transparency    
   regarding fees and deposit timing[1]

   No access to government-issued ID, which is required to open a bank account

   To avoid delinquent debts, such as creditors seizing the account in 
   judgements, or the government collecting back taxes or child support

[0] https://www.investopedia.com/terms/k/knowyourclient.asp

[1] https://en.wikipedia.org/wiki/Unbanked

Edit: Fixed subject/verb agreement (laws/mandate)/fixed quote formatting.

Further reference for the ID requirements:

https://www.bankhelp.gov/help-topics/bank-accounts/required-...

> About 3% of the us adult population doesn’t have government issued photo id.

Add on top of that undocumented people or the issues surrounding the Native American population and their partial autonomy rights, and it becomes a mess very very quickly because it won't stay at "about three percent".

What? US banks won't bank you if you don't have 27 distinct forms of government ID and a recent rectal exam.

And then they have someone with an incomprehensible accent in a call center that probably also runs scam calls calling you up and asking for your password as part of their ordinary SOP.

They deploy fancy new tech like "verifying your voice" with some AI crap while simultaneously not allowing your password to have more than 8 characters. (Which must have two symbols but if one of them is ` you'll experience random spontaneous logouts).

There may be many causes of the disaster that is bank security, people not having ID is absolutely not part of it.

Interestingly enough the US seems to have between 1.5 and 6 times more of such cases than Europe (the numbers I found are a little bit fuzzy and use probably different methodology when collected, so this could well be an entirely statistical phenomenom).

I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of.

The US does identity verification by asking for a driver's license (which has no chip or biometric data) and possibly a series of questions about your past drawn from public data. All of these credentials are laughably easy to spoof. Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. It is trivial to check the validity of these cards and nearly impossible to forge without subverting either the national PKI or printing apparatus

The security around the facilities which make the documents is also significant. Getting the printing apparatus is no small feat.

    > Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details.

Woah. First, on HN I keep seeing this term "Europe". Europe is 50 countries. Please try to be more specific. Did you mean EU? If yes, then my question: Really? All 27 EU nations support and actually use this identity programme with financial institutions? I never heard about it. And, just saying that it exists isn't enough. Do normies use it (like your parents & grandparents)?

It's currently being deployed across the european union[1], I think the 2026 target they gave it's a tad too unrealistic, wouldn't be surprised if we get major coverage not until 2030.

[1]https://commission.europa.eu/strategy-and-policy/priorities-...

That target is for the new and improved version where you can use NFC to self-identify on the web. The old version (with a smart card inside, so only offline auth) was rolled out in Germany in 2010.

Can't remember if they ever released the 1st version either in Italy or France, a few days ago my septuagenarian mum got the NFC enabled one in Italy.

The iOS app is surprisingly decent. She could still request the old, paper-only id but this one could be also used to pay for local ordinances straight from her phone, and it's less cumbersome than the SPID-based[1] authentication.

[1]https://it-m-wikipedia-org.translate.goog/wiki/SPID?_x_tr_sl...

Don't know about the whole Europe (or EU) but I strongly suspect it is indeed (almost) everywhere. I'm Turkish and Turkey has it too. And yes, my mother uses it, and my grandparents used it when they were alive. You can't do anything government-related, open a bank account, or even visit a hospital without your government-issued ID card (which contains a chip). And a few decades ago, before the chips, there were other security measures tied to ID cards.

It's an EU thing. Yes, normies do use it, as it is a chip embedded in your personal ID card and your passport. You hand your ID to an officer, they read the chip data and verify the signature. You don't have to know anything about how it works. It also contains biometrical data (your fingerprints, etc).

Implementation of eIDAS is still in progress. It's not even mandatory for every citizen to haven an eID until end of 2026. And it's also not used yet everywhere for everything. But it's gradually growing.

The first time I had a chance to use was just some months ago, when I could activate a SIM-card online through and my smartphone reading out my ID-card via NFC. I pay daily via NFC, but it's the first time ever I had to use the chip in my ID-Card, despite it having one for 15 years now. Laws and regulations are good in theory, but reality can be often quite a bit different.

Fingerprints are collected only from criminals or people who visit US. Why did Europeans agree to being treated like criminals or tourists I don't understand.

>Fingerprints are collected only from criminals or people who visit US. Why did Europeans agree to being treated like criminals or tourists I don't understand.

Only if you assume that anyone who works for a SEC regulated company[0], applies for a California driver's license[1], current and former US Military personnel[2] healthcare workers, teachers, real estate agents, child care providers and others[3] are either "criminals" or "tourists."

If so, into which bucket would you place CA driver's license applicants? Criminals? How about US Military personnel? Tourists?

Please do elucidate.

[0] https://www.law.cornell.edu/cfr/text/17/240.17f-2

[1] https://www.dmv.ca.gov/portal/vehicle-industry-services/occu...

[2] https://www.law.cornell.edu/uscode/text/8/1440f

[3] https://blog.certifixlivescan.com/state-by-state-guide-to-fi...

Yes the government wants to treat everyone as a possible criminal and collects fingerprints for this reason. There is absolutely no logical reason for collection of fingerprints for a driver's license. Collecting fingerprints doesn't make driving safer in any way.

In my country, native citizens are not required to give biometric information, however migrants and foreigners are because they are treated with suspicion and have a lower status. Maybe US aims for treating everyone equally (low) here.

Driver's licenses serve as the primary form of identification in the US.

But you wouldn't know anything about that, would you Ivan, especially since many (most?) Americans don't have a passport.

Are your papers in order, Ivan? It would be a shame if you ended up in a Siberian gulag, eh?

Nobody, surprisingly, our regime doesn't require us to provide fingerprints yet (although that might change; our government loves to say "we just do the same thing all Western democratic governments do, so don't complain"). The punishment for not having valid "papers" is usually a fine (the fines for not having valid documentation related to military service were significantly increased recently for obvious reasons). Unless they close the border, I think we don't need to worry.

Also I always thought that it is weird, having to take driving exams to get an ID and calling an ID a "driver's license".

Fingerprints are only stored on the chip. Collection/retainment for other purposes is against the law.

That's just the first step to let people get used to giving away their biometric information and then change the laws.

We don’t have a national ID system, just a single, poorly suited Social Security number that’s been overloaded to serve as our entire identity in the eyes of the state. These numbers are effectively public knowledge, thanks to private credit agencies created to fill the gap when banks failed at risk assessment. We could’ve replaced this broken setup decades ago, but there’s a vested political interest in ensuring federal programs fail, to justify further privatization and the dismantling of social services.

A proper national ID and strong privacy laws would be obvious policy wins, but that would require competent lawmakers.

In my lifetime, the most consequential federal legislation has been the DMCA (1998), the Patriot Act (2001), and Obamacare (2010), which effectively marked the end of meaningful legislative power and the handoff of governance to the executive branch.

It's a very similar situation in the UK, though the hostility towards National ID cards comes from the public not the government.

Apparently people associate it with the authoritarianism of 1984 even though mandatory ID existed in 1948 when the novel was written.

What about ID.me that irs.gov uses for tax-related matters? When I tried to get it once, it is pretty hard to get authenticated -- required 2+ gov't IDs, plus pic of yourself holding them. That should be pretty safe. Not good enough? (Overall: I agree. There is no concept of a national ID in the US, except a passport which huge numbers of people do not have.)

As I understand it, it’s mostly fundamentalist Christians blocking national IDs.

I'm not Christian and I don't want a federal ID. I don't even want a state ID but I will eventually be taken to prison if I continually get caught driving without one.

Coincidentally and/or anecdotally I've never had my identity stolen.

You’d be wrong. It’s coming from the same crowd that claims showing a driver’s license or some other form of ID in order to vote is racist.

The last big push for a secure national identity system was during the 90s as part of the negotiation on the Illegal Immigration Reform and Immigrant Responsibility Act of 1996. It was opposed by fundamentalist Christians then, but it was more vociferously opposed by civil libertarian groups like the ACLU and the EFF, Cato, as well as immigrant rights groups like La Raza.

I'd argue that the fundies have more political clout than those other groups combined.

Half of the house Democrats, not exactly a group known for kowtowing to religious fundamentalists, voted against improving the design of social security cards. If 16 of the 91 that voted against the McCollum amendment had flipped from Nay to Yea, this would be a solved problem.

Or at least a different problem.

Based on what?

We have at least two different national ID systems in the US: passports, and Real ID.

One of those two is as of last week or so required to board a flight in the USA.

> identity theft

It is not identity theft. It is identity fraud.

Implying that you can lose your identity to someone is a way to shift blame from the banks or whatever entity being defrauded.

> I was curious, because I (living in central Europe) could not think of a single case of identity theft in my social circles or a prominent case I ever heard of.

But there’re tons of scams involving stealing your personal id and security codes. It’s wide spread from Belgium to Estonia.

There's apparently no good way of doing this. Denmark have a system for identifying yourself online. It has a 2FA component, either an app on your phone, where you have to swipe or something (I don't use it) or a physical code generator. It should be basically impossible to break, except it's not, because people will get calls from "their bank" asking the to do the 2FA stuff. Basically any measure put in to prevent this is being circumvented by people believing that the bank, who barely wants to deal with customers, would actually call them up Thursday evening.

I think the current solution is to have users scan a QR code, if they are on a different device than the one with their authenticator app. I haven't hear of anyone with the hardware token being scammed though, but most of the people who have the hardware version, do so because we don't even trust an app on our phone.

But yes, there are PLENTY of cases of identity theft even in countries with electronic identification solutions.

One thing the US could do, but won't, is have an account registered with the federal and state governments. Any money coming from the government should ONLY go to that account and it changing it should require a thorough identity validation.

QR code is how mitid works. You scan and you swipe.