[miki123211]

I'm surprised identity verification by logging into your bank and/or carrier isn't more common in the US.

They have your data anyway, it's much harder to impersonate somebody this way, it doesn't require the verifying company to hire any workers to do the verification, you could even do it without the site you're verifying yourself at learning anything about you.

[lxgr]

Why on earth would I want to trust either to hold the keys to being able to identify myself?

Both banks and carriers somehow manage to at the same time make identity verification incredibly painful and obscure, without actually protecting me against identity theft.

It also seems like it would make it even harder to switch banks and phone providers than it already is.

[flutas]

> I'm surprised identity verification by logging into your bank and/or carrier isn't more common in the US.

I've been seeing more and more carrier based verification, but it's hidden in the disguise of 2 factor auth.

Cash App and Capital One are two examples I can give concretely that do this, as I've been locked out of my account a few times until I can get my husband to read me back the 2fa code (cell carrier has a pre-marriage last name for me and refuses to update it).

[residentraspber]

Been working in the Fintech space for the past 3 years and what I've learned is that deep down no bank trusts any other. No other bank wouldn't trust that a random bank actually correctly verified the persons identity before giving them an account.

I imagine this also works with other vendors. All you need is 1 company with a weak process.

[hermitdev]

Probably a lot of it is due to know your customer (KYC) rules. I am not allowed to take your word that you've done your due diligence; I have to do my own.

I've spent ~20 years working in and around finance, on the trading side. If your lawyers aren't paranoid about KYC, that's a major red flag.

[thephyber]

> identity verification by logging into your bank

Do you mean you expect me to give my banking site/app credentials to X?

PayPal used two small (less than $1) transactions and the verification that I own the bank account was verified by correctly identifying the two transaction values.

Plaid, I believe, uses 3rd party auth with some banking institutions that support it, to pull read-only data from my bank account on my behalf.

South Korea and Estonia use government-issued digital certificates that private institutions can use.

There are lots of ways to deal with high assurance authentication, but very few are popular in the US.

[miki123211]

> Do you mean you expect me to give my banking site/app credentials to X?

No no. Over here (Poland), the way this works is that you get a big list of banks, you click on one, get redirected to their site, log in there, complete any 2FA they need you to complete, are given the typical oAuth "this application wants to access this sort of data" consent screen, and then are redirected back if you consent.

This is mostly used for fast online bank transfers, which we often use for online payments instead of credit cards, but there's also a system to use this for ID verification.

[thephyber]

Oh. In Single-Sign On / OAuth terminology, the bank’s website is the Identity Provider (IdP).

Banks in the US depend on government-issued ID and information contracted from credit bureaus (3 big companies that are effectively data brokers about consumer lending behavior). We have federated identity, but in a weird, ineffective way.

Every once in a while, someone bold makes a political proposal to make our authentication / identity proof systems simpler, but then people realize the privacy implications (and religious fundamentalists point to the “mark of the beast” part of the Bible) and then the proposal doesn’t go anywhere.

[miki123211]

The interesting part about this is that such a system wouldn't necessarily need to come from the government. There are companies that need verification and want to do it cheaply and with little friction, and there are banks and carriers who could make some extra money on it.

[Aloisius]

There are thousands of banks in the US. Getting them to agree on anything is beyond difficult.

Carriers in the US don't all require ID, so they're not particularly useful for identity verification.

[rchaud]

Same system is used in Canada to authenticate indviduals who are logging into the government tax portal, or submitting their tax returns electronically through a tax preparation software.

[baobabKoodaa]

Same thing is very common here in Finland.

[stevekemp]

> Do you mean you expect me to give my banking site/app credentials to X?

In Finland it is common for many online shops to handle payment, and authentication, using a banking account.

You never hand over your actual banking credentials, instead it is something akin to OAUTH2 - so you're at a merchant site and you'll see "Pay with Online BanK" with logos to click for whichever bank you have an account with. Exactly the same as "Login with Google/Github/Facebook/etc".

I changed my name last year, and due to other integrated services many companies automatically updated their records when the change became legal. These kind of integrations seem common and thus far "secure".

[derf_]

> PayPal used two small (less than $1) transactions and the verification that I own the bank account was verified by correctly identifying the two transaction values.

Based on my experience with (non-PayPal) financial institutions in the past year, this is going away. For now, it appears you can still force them to fall back to this when providing your login credentials does not work, but who knows how much longer.

[thephyber]

It was pretty good trick for validating ownership of a bank account back in 1998, but I’m happy they are moving to something else. There are far better options, and most banks are capable of much higher assurance validation now.