Sometimes I wonder if the real vector for fixing “X business was attacked; Y million personal identifiers were accessed” is to ratchet up on-opening and post-opening identity verification in the financial industry such that knowing 4 facts about someone isn’t worth $Xk++.
There’s a credible argument for “Any information in 1,000+ databases not administered by AppAmaGooBookSoft will inevitably be leaked, multiple times, regardless of technical countermeasures. The war on security breaches is unwinnable at the scale of the economy.”
Your name, DOB, address, SSN, and everything else used in a widespread fashion to open up a credit card account is in 1000+ databases. That is highly unlikely to change.
Card issuers (and other participants of the financial industry, but in the main, card issuers) benefit enormously from keeping the barriers to conversion very low. They’ve been going down as the number of compromised identities has been going up. This dynamic funds the hacks.
Maybe we need to tell issuers “OK, you issued a credit card without authorization from the putative customer, and took a $600 fraud loss. You just forfeited the identity security bond; take the $10k hit this quarter.”
(This would not be a consequence free policy!)
(This would not be a consequence free policy!)
