[vmception]

The number has to corroborate whats on the picture of the passport.

Beyond what you asked though:

Most financial institutions are just covering their own ass and do not care. They just want the record in order to say they checked the box, and be able to look at that record when the government comes looking. Investigations rarely are high profile enough get stonewalled by a customer account that was fictional in order to ensnare the financial institution about how good/bad their KYC processes are. Money mule accounts are extremely prevalent, but this is limited to the actual person being tricked into using their own account for a ridiculous and shady purpose.

[marcus_holmes]

> The number has to corroborate whats on the picture of the passport.

Yeah, so knowing the passport number alone is useless.

And yeah, lots of the "security" around us is theatre and easily bypassed.

[vmception]

you superimpose it onto the picture of the passport, because you know the number.

that's like saying an exploit is useless because the pentester still has to privilege escalate. wrong forum to hold that opinion.

[marcus_holmes]

You don't need to. If the verifier has no way of verifying that any given passport number is correct, or associated with the identity you're trying to steal, then you can make up any number you like. Like you said, the only thing they can do is verify that the number on the (faked) passport matches the number the fraudster typed in the form.

If anything, this breach improves security because now there is a list of passport numbers matched to identities that verifying companies can use to make sure that the passport number claimed by a potential imposter matches the number known for that identity (from this breach). Then you'd have to do what you said and alter the passport in some way to match the breach.