Hacker News new | ask | show | jobs
by jasode 1924 days ago
Examples of competitors sharing data about bad customers across several industries:

- competitor banks share information about people who bounce checks

- competitor insurance companies share data about customers with fraudulent claims

- competitor casinos share photos of card counters

Probably many others I can't think of.

EDIT to reply: thanks for the customers' returns example. I found a story explaining the shared database: https://www.elliott.org/case-dismissed-2/the-retail-equation...

4 comments

If you are banned from returning merchandise to Amazon, Home Depot, CVS, Sephora, Dick’s, JCPenney, Victoria’s Secret or Best Buy you are likely banned from doing returns by all of them.

They are all using a third party called The Retail Equation.

How would they know who you are, if you're paying cash or not using the same card?
If you're doing a return on a cash transaction, a lot of stores will ask for ID.

https://www.theretailequation.com/frequently-asked-questions...

> How does the system work?

> When a consumer wants to make a return, a retailer will scan the original sales transaction receipt and/or collect consumer identification (in certain regions that may be the individual’s driver’s license or government-issued ID card) to make an identification of the person and his/her unique return behavior.

Most ask for photo ID when you do a return.
This is why it's good for hackers to bootstrap other identities over the years. You never know when they come in handy.

(Note: I have not done this. Or have I? Well, no I haven't, but if I had you wouldn't know about it.)

It's one of the most interesting "careful" projects you can do. Something like "Satoshi Nakamoto" can release software to change the world, but you can compare their style of writing to the short list of crypto researchers whose identities are known. Similarly with JK Rowling's book released under a pseudonym. It's very hard not to slip up and have your identities connected. However, in a world where everyone is supposed to have just one identity, and present this ID to communicate or transact on a given network, and where all databases are interconnected, the only way to preserve anonymity would be to hijack someone else's identity temporarily (such as making a call from a person's phone, or having a homeless person go buy a prepaid phone for you). Sometimes people swap identities voluntarily ... such as with bitcoin mixers or when you swap DNA samples before sending them back to 23andme and other test centers (who btw keep your DNA for the government and all kinds of things). But the risk is that you can be held responsible for something someone else did, with laundered bitcoins (civil forfeiture) or some physical crime (DNA analysis might indicate it's you).

I wrote this 8 years ago: https://magarshak.com/blog/?p=114&cpage=553?p=114&cpage=553

i suppose it depends on the details, but if you're asked for state-issued identification when processing a return, and you present a falsified document that purports to be state-issued, that's a almost certainly a crime. (even the creation of such a falsified document is likely a crime.)
I presume that the parent post refers not to forged documents but to obtaining legitimate identification under a different name/alias - which is generally allowed in common law countries, where you can choose and use any name you wish, as long as you are not trying to defraud someone (e.g. here's a case example from Massachusets http://masscases.com/cases/sjc/320/320mass448.html "If acting for an honest purpose, one may lawfully use a name other than his legal name without procuring a change of name").

The question there is whether avoiding a ban on returns would count as a honest purpose; arguably it would not. A standard example for inappropriate name change is changing the name to avoid seekers of debt repayment using the previous name, this seems similar in intent.

> competitor insurance companies share data about customers with fraudulent claims

I'm pretty sure it's any claim. If you want to see something scary request your lexis nexus consumer report.

When I switched to a new homeowners insurance provider, the insurance company helpfully mailed me a letter containing all my previous claims (not that there are many), even including claims from renters insurance policies.
A good example of banks doing this in the UK is CIFAS, member companies of CIFAS can submit a black mark against an individual, which may in turn cause their other bank accounts to be closed, even if the black mark was in error.

If you’ve ever had an account closed, you’ll discover the bank will refuse to tell you why. So if you aren’t aware of CIFAS, things can be pretty confusing.

Near zero repercussions for the bank that wrongly adds anyone to the database (potentially a 3 figure sum awarded by the financial ombudsman, again if the person is aware of the financial ombudsman).

I’m frankly surprised they’ve been able to continue to exist. Only with GDPR coming in have they given you the option to check if you are on the list without having to write a physical letter.

Examples of them screwing up:

https://www.theguardian.com/money/2020/oct/31/mortgage-fraud...

https://www.msbsolicitors.co.uk/cifas-fraud-markers-the-prob...

Why are any of these things good for the consumer? All of these sound like DBs that should be limited if possible.
Successful insurance fraud presumably increases costs to consumers via higher premiums, right?
similarly, there are serial returners who purchase with the intent of returning later.

All these business costs are passed onto other consumers... and while maybe not illegal, businesses essentially have Terms Of Service just like any other private entity.

Rideshare banning bad customers means more people will work for them due to less fear of being murdered by crazies. End result, i can get an uber when i want one. Seems like a win for me.
I do agree on services sharing banned users data, for safety or compliance reasons. But this should be limited to a set period of time, because the person you were 10 years ago grew up from who you are now and will be in 10, 20, 30 years from now. We all grow and hopefully learn from mistakes.

An implication of this “banned users” data sharing is that this data exchange must be overseen by regulators, to enforce equal access to competitors to this data and also that companies drop people from the “banned users” database after some time, not penalized for life except in rare cases.

I would argue that most users’ petty behaviors that lead to banning do not deserve to make them pay for it the rest of their lives - and that there are rare exceptions who do deserve to be banned for life because certain users’ behavior is so egregious.

Also, consider cases for jurisdictional banning and global banning. Some behaviors are not allowed in certain countries. Take a gay couple kissing in a car in Saudi Arabia - should this couple be banned? If so, just if attempting to use services in Saudi Arabia, or globally? These are serious and important considerations.

> We all grow and hopefully learn from mistakes. ...An implication of this “banned users” data sharing is that this data exchange must be overseen by regulators

the gov't can require that each company has an appeals process, which can be brought to a court if the banned user decides that it's worth escalating.

In fact, i think a general, low cost court process for digital service providers would make for a great consumer protection, but still allow digital services to be flexible in how they want to provide. For example, google can still ban people, but the user can appeal, and if the user is unsatisfied with the appeal, they can go to court (without costing exorbitant amounts of money).

I'm not arguing that its a perfect utopia or even good per se, just that there exists a benefit to the average consumer, in response to the GP's question.
It also means if you were banned in error you are banned everywhere and there is exactly nothing you can do about it. This is bad.