I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.
When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?”
Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty.
Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law.
One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer.
This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists).
Corollary: open an account at every major bank to establish a duty-relationship everywhere.
Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.
> "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices.
The problem isn't the banks, the problem is that unlike Europe where in most countries it's commonplace for everyone to have a government-issued ID document, the US does not have that requirement and so companies of all sorts abuse documents not meant for that purpose like SSNs or driver licenses that can be trivially forged.
Banks can't invent security out of thin air when a significant part of the US population believes that mandating possession of one is a surefire way into a dictatorship or whatnot.
For example: https://www.reddit.com/r/Banking/comments/1csl00q/any_banks_...
Zero. Because FINCEN/KYC[0] laws in the US mandate identification for all customers.
Which means that at least 3% of the populations is "unbanked"[1]:
Some reasons a person might not have a bank account
include:
Lack of access via a nearby bank branch or mobile phone
Minimum balance fees
Distrust of the banking system, typically due to lack of transparency
regarding fees and deposit timing[1]
No access to government-issued ID, which is required to open a bank account
To avoid delinquent debts, such as creditors seizing the account in
judgements, or the government collecting back taxes or child support
[1] https://en.wikipedia.org/wiki/Unbanked
Edit: Fixed subject/verb agreement (laws/mandate)/fixed quote formatting.
https://www.bankhelp.gov/help-topics/bank-accounts/required-...
Add on top of that undocumented people or the issues surrounding the Native American population and their partial autonomy rights, and it becomes a mess very very quickly because it won't stay at "about three percent".
And then they have someone with an incomprehensible accent in a call center that probably also runs scam calls calling you up and asking for your password as part of their ordinary SOP.
They deploy fancy new tech like "verifying your voice" with some AI crap while simultaneously not allowing your password to have more than 8 characters. (Which must have two symbols but if one of them is ` you'll experience random spontaneous logouts).
There may be many causes of the disaster that is bank security, people not having ID is absolutely not part of it.
If the student aid system verifies identity by, for example, just validating that the applicants know a single 9-digit number that after the Equifax breach should be considered public information, that is a critical problem with their identity verification system and it should be patched.