It's still easy for anyone to become you at Experian

No, I'm imagining a scenario where the things used to identify me to service providers is taken by someone.

> I also think your analogy of a "friend" isn't right...

I didn't mention a friend.

> you are the bank's PAYING customer... you pay them to secure your money and only give it to you!

I agree, but as per my analogy, the car's owner has had their car stolen.

> If they fail to provide the service they're offering to you... seems like they ought to be responsible for their failure.

As per my analogy, I'm not saying that the car shouldn't have been secured, nor that the storage provider shouldn't make the situation right via insurance etc. Only that the car owner is the one who is a victim of car theft.

> You aren't really involved... the bank messed up by going "Oh you say you're Bob? Okay here you go!" Why is it your fault that they failed to accurately verify the identity of the person they gave THEIR money to? You didn't play any role in them deciding who to give their money, nor in their ID verification procedures.

The bank being at fault doesn't mean the victim's identity wasn't stolen.

All of these objections seem to assume that if someone has something stolen, it was their fault. That's not true, and that assertion is what I'm objecting to.

One neat thing about systems like this is that the card itself can perform a cryptographic computation that proves its own "ID", without communicating its private key to the connected computer/phone. So even if your computer was compromised, the ID card connected to it still can't be copied. The card is simple enough that there is less attack surface (as compared to an entire computer), so it's much less likely be be hacked, even if it's connected to a hacked device. Though mistakes do happen, since no system is perfect. So if a vulnerability is discovered, new cards might need to be issued.

Granted, an attacker on your computer (controlling it remotely) could just wait until you log in to your bank via smartcard and then quickly pull all your money out... you need a more complex solution to fix that problem (like cryptocurrency hardware wallets use; they have a little screen that shows the proposed transaction, and you have to physically push a button to confirm it, and then it does another cryptographic operation to authorize that particular transaction).

However, the smart card system does prevent an attacker from simply buying a database dump of email addresses, passwords, SSNs, etc. and using that to get into your bank account.