Hacker News Reader

Comment by ouid | Hacker News Reader

I'm confused how you would be liable for a loan that you did not initiate. Identity theft in general is just bank robbery, with the notable difference that then the bank turns around and robs you.

View on HN

In some countries, like at least Norway, you sign these loans with what is called BankID - it is essentially used for all kinds of e-signing, it's probably the most used 2FA tool here. Probably other Scandinavian countries too.

But back to my point - if you for whatever reason get compromised to such a degree that other people can sign off things with your BankID, you're basically completely fucked. At least for probably 99.99% of the cases.

This is because the law recognizes that sign-off as if you did it. And if some other did it, you've breached the ToS - which more or less states that you, and you only, can know the password, and it is your responsibility that said password is hidden / unavailable to others. Your signature and confirmation, your loan.

The most common victims of these cases are spouses and close family members.

But again, these things do differ from country to country.

I'm pretty sure you're mistaken.

Consumers in Scandinavia are not responsible when scammed unless they've acted with grave misjudgment or ill intent.

There was even a case in the high court to cement this right in Sweden this summer specifically for BankID.

https://www.konsumentverket.se/aktuellt/ko-har-ordet/2022/ko...

The supreme court of Norway just denied an appeal from a bank on a similar case in Norway. The person had been phished over a telephone call, and gave away passwords and 2fa token to what they believed was a bank employee.

https://www.domstol.no/globalassets/upload/hret/avgjorelser/...

In Turkey, 2FA tokens for banks generated by app or sent by SMS all contain a message about never giving the token or your password to a bank employee...

so?

so if Norwegian banks did the same as Turkish banks, the customer is now fully liable for doing the exact opposite of what they've been explicitly told never to do by the warning clause accompanying each 2FA message

Not how the law works here - you're always liable in either case, but it is hoped that the message might prevent some cases of fraud. It's difficult to secure people against social engineering...

yeah, America is about twenty years behind you guys in banking tech. But that is for a reason.

If the money from the loan is actually paid out to you, then it’s not too surprising that you need to give it back.

Knowledge of the transaction is an essential element of a valid loan application.

Right, but if you transfer that money away before the bank gets it back then you would be liable for that part.

I understand what the law probably says, I'm arguing that it's nonsense. The scammer stole money from the bank in this scenario because the bank fulfilled a fraudulent loan application without due diligence of ID confirmation. The fact that this could be Bob's problem demonstrates how dystopian our legal system is.

If sears sends me a refrigerator that I didn't buy, I get to keep it. I can treat it as an unconditional gift. I have no obligation to either return, relinquish, or pay for it. I did not enter a business relationship with sears. I signed no contract, and the object was delivered to me. The law says that it is unconditionally mine. This is a fairly important consumer protection. I agree with this law and think that it should extend to falsified loans for essentially the same reason. In the absence of such a law, the lender has placed upon me an enormous amount of liability.

Consider the case where I have a small checking account in which I deposit my child's allowance, the child discovers that this account has $10,000 in it for some reason, and, like a child, goes on a spending spree. Is my child responsible for exercising some measure of restraint with this money? They are, in the eyes of the bank, authorized to access this money for their own use, but suddenly you think that I am obligated to return thousands of dollars that my child spent on minecraft skins or something because the lender wants to lower the friction for loan applications?

The lender should be generally SOL.

Reply on news.ycombinator.com