[ok_craig]

The other day I was trying to make some kind of transaction with Dwolla, and before I could, they asked me a series of questions to verify my identity.

The questions had obviously been pulled from a background check based on my name that I didn't know they had done. It was asking me what the price of a house was when I originally bought it, and what street I lived on in a given time period.

Outside of this being really creepy, all of the questions weren't actually useful for identifying me because they all applied to my father. I am a Jr., and the background check must have been run for my dad.

I also now have a reasonable idea of the price range my dad paid for a house that we moved into when I was 7, which I never would have known or asked about otherwise.

At this point I'm afraid to continue using the service. They allowed me to transfer $1,000 into it, but apparently don't know enough about me to let me make certain transactions. They should get everything they need for me to use 100% of their service up front, and not have this staggered approach where additional identity info is required to transfer money, at the last minute when you're trying to do the transfer.

Right now it seems that they could at any arbitrary moment determine that they haven't actually identified me well enough, and suspend my account.

I don't think Dwolla is the payment solution we've been looking for. At least not yet.

[wmf]

My understanding is that Dwolla is trying a fairly unusual approach to handling fraud, which is that they pay out of their own pockets for fraud (instead of kicking it down the line as all other financial institutions do) but this requires that they actually prevent fraud, not just identify it after the fact. And the cost of really stopping fraud turns out to be something that many people do not feel comfortable paying when they're personally confronted with it.

[spinlock]

Kind of, Trade Hill lost a hundred thousand or so when Dwolla falsified their tranaction record and stuck them with the fraud. This was a bunch of reversed ACHs (which Dwolla claims they don't allow). Very shady company.

[dopamean]

If this is the case then the story is still creepy but I support this attempt to combat fraud.

[kbuck]

FYI, those sound like credit check questions. They probably did some sort of credit pull.

(They know the answers to these because the credit reporting agencies know how much the house cost, where it was located, what previous address(es) you've had on your credit accounts (including credit cards), etc.)

[mikec3k]

Yes, those are exactly the questions I've seen on credit checks to verify my identity.

[SomeCallMeTim]

The problem with this theory is that a credit check needs an SSN. An SSN wouldn't have confused OP with his father.

[qeorge]

Oddly enough it doesn't. For example, you can perform a credit check via this API using only a name + address:

http://www.meridianlink.com/creditAPI.asp

I have personally used this API, and it works.

[eco]

SSN data isn't flawless. My brother and I somehow had the same SSN until I was in my teens (right as I started working but before he did so thankfully it wasn't too difficult to fix).

[Spooky23]

Doesn't matter. The credit bureaus mix people up all of the time, particularly if you shared a name and street in the past.

My wife and mother in law share a first name. And a middle name that varies by one letter. (Ie. Mary Ann and Mary Beth) credit reports routinely mix them up.

When I was in school in 1996, a collector managed to get a business debt of my grandfather (who shared a name and died in 1986) attached to me.

[jrockway]

I also now have a reasonable idea of the price range my dad paid for a house that we moved into when I was 7, which I never would have known or asked about otherwise.

It's a matter of public record. You can probably type the address into Google to find a site that shows you the full transaction history on the house. Here's the house where I spent most of my childhood:

http://www.redfin.com/IL/Third-Lake/186-Mainsail-Dr-60030/ho...

[ok_craig]

Yeah, not a privacy violation it seems. I didn't know that. For me, it was just unexpected and weird to experience.

[g_h]

Dwolla did not perform a "background check" in the sense that you may think. When dealing with online fraud, it's common to use identify verification services like IDology (and a few others) that basically provide an API to generate these types of questions based on public records matching your name/address. Many banks use the same verification services.

[Xorlev]

This. Experian provides the same service, it's usually ~$3/pop if I remember right. This gives you those "Did you live with a Paul Foo at 378 Combinator Way from 2006-2009?" questions.

[unclebucknasty]

Odd, because if it's publicly available...

[kenmck]

Sounds like they pulled a credit check. I got the same kind of questions when I applied for regular merchant (credit card processing) account.

[citricsquid]

Are house sale prices not documented publicly in the US?

[ars]

They are. It's a very strange question to use.

[ok_craig]

I guess they are, it just wasn't something I expected to learn at that time in that way. So I guess it isn't really a big privacy issue, just a strange experience.

I would have been more comfortable with it if it had been part of the original screening, and not something that popped up randomly before a transaction, after I had already moved money into my account.

[Osiris]

Yes, sale prices can be found in public records. Just look at sites like Zillow, you can look up any property and they'll show you a history (I'm not sure how far back they go) of the sales history of the house.

[natrius]

Whether property sales are public depends on the state you're in. Texas, for instance, doesn't make sale prices public.

[tragomaskhalos]

The "background check" questions for verifying your identity will have been drawn from a credit reference agency or similar. It may seem creepy, but actually if you want to verify someone's identity online and mitigate the risk of identity theft, the alternatives are limited. Of course the fact that they mixed you up with your Dad is unfortunate to say the least; your date of birth should have disambiguated you.

What they should have done is explained this, rather than just baldly present you with what appear to be alarming and intrusive questions.

Having different levels of service depending on the level of identity assurance is sensible for many applications, but for a funds transfer system I agree that it does not seem sensible.