Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The optimal amount of fraud is non-zero (2022)

bitsaboutmoney.com

Post reply on HN
Print view View original

51–60 of 203 posts

Re: The optimal amount of fraud is non-zero (2022)

#51

Post by akerl_ »

c0pium wrote: post #8
brazzy wrote: post #4

Earlier quoted context omitted.

Important corollary: it may well be possible to reduce fraud much closer to zero (then the currently accepted rate) without negative effects on legitimate business. For example, the USA's lack of a national ID (and the resulting adoption of realldy ba substitues like SSNs, driver's licenses and "two photo IDs") has made a plethora of fraud techniques ridiculously easy. In many other countries, "identity theft" so rar…

To be a bit more general about this, I have found that the returns to combatting fraud are highly nonlinear. Having a better national ID than SSNs would have effectively no negative impact while being a huge benefit for security and fraud prevention. It would also, if implemented well, be hugely beneficial for privacy. For instance things like Signal could move from requiring phone numbers to a ZKP using a national I…

The problem is that the people in the USA who think "national ID" is code for "they want to put us all into pods and use our bodies as batteries" really really don't want national unified identification, and the people who aren't crazy don't consider it anywhere near their top 10 issues that would sway their vote. So no politician with any actual power is going to push for it.

There's tons of issues like this, where there's a clear technical right answer, but the only people who are foaming at the mouth over it are on the crazy side, so it doesn't happen.

Re: The optimal amount of fraud is non-zero (2022)

#52

Post by akerl_ »

russelg wrote: post #32
brazzy wrote: post #4

Earlier quoted context omitted.

Important corollary: it may well be possible to reduce fraud much closer to zero (then the currently accepted rate) without negative effects on legitimate business. For example, the USA's lack of a national ID (and the resulting adoption of realldy ba substitues like SSNs, driver's licenses and "two photo IDs") has made a plethora of fraud techniques ridiculously easy. In many other countries, "identity theft" so rar…

In Australia, drivers licenses and passports are defacto national IDs. And we felt the sting of that when Optus (2nd largest telecom provider) leaked half of the population's IDs. Not to mention before this there was almost no way to get a new drivers license number, so if it got stolen good luck, a new license is issued under the same number.

Are AU drivers licenses issued by the national government, or by states? The thing that makes DLs wonky in the US is that while you can basically use a DL as a national ID, it is issued, managed, and operated by the state. So no two state's DLs look the same or have the same info. This makes them amazingly easy vectors for fraud.

As two amusing anecdotes:

A while back, I went to buy some beer in a state other than where I lived. I was asked for my ID, and provided my drivers license. The employee pulled out this comically thick three ring binder, flipped to the page for my state, and had to read through a list of compiled identifying factors for a legitimate ID from my state.

Even further back, I worked at a company where a small slice of my job was verifying ID for new signups flagged as high-risk. Except... we were an online business. Our users were global. So if somebody happened to upload a passport or US DL, I could at least eyeball it. But if somebody uploaded an ID issued by basically any other country on Earth... I guess that's what IDs from The Confederacy of Independent Systems look like? The only surefire way to get rejected was either not uploading anything, or the many, many bots that uploaded random pictures of flowers or trains or random nonsense.

Re: The optimal amount of fraud is non-zero (2022)

#53

Post by yreg »

fragmede wrote: post #50
yreg wrote: post #24

Earlier quoted context omitted.

Again this is totally misleading. The optimal amount of airline catastrophes is zero. It is also impossible. Should all humans spend all of their effort and all of their resources to lower the amount of airline catastrophes? I believe that pretty much everyone finds it reasonable to say no.

Why is that zero? I don't want to die in a plane any more than the next person, but is zero really optimal ? It's least life losing, it's least catastrophic, but is it optimal ? the question becomes, what are we optimizing for? If the optimization equation is for lives lost, I can make that zero real easily by just stopping air travel entirely. If no one travels by air, then no one can die by air. But of course that'…

Optimum is zero, because if you could wave a magic wand to magically make the amount of accidents zero, it would be a good thing to wave the wand.

The optimum is non-zero only if there are enough costs associated with making it zero.

That's why asking for optimum amount of fraud is misleading. It omits the costs. Once the costs are taken into account (i.e. it is clarified what the question means) the answer is obviously above zero.

Re: The optimal amount of fraud is non-zero (2022)

#54

Post by yreg »

theptip wrote: post #37
yreg wrote: post #10

I believe this is a trivial thing with a misleading title. Of course the optimal amount of fraud for a business is zero. A world with zero fraud would be optimal for them. And (also of course) given that combating fraud has costs, there is a level at which investing more money and effort into anti-fraud has diminishing returns. Therefore it is not worth it to go all in into the fight against fraud, but accept that so…

> Of course the optimal amount of fraud for a business is zero. Only if the business doesn’t have to pay to avert fraud. > A world with zero fraud would be optimal for them. You are misunderstanding the statement. We are not imagining which hypothetical world we wish to live in. We are making a claim about fraud levels in this world and how they feed into profits. In this world, every reduction in fraud costs money o…

>You are misunderstanding the statement. We are not imagining which hypothetical world we wish to live in. We are making a claim about fraud levels in this world and how they feed into profits.

Then the question should be stated clearly:

"How much effort and resources should be spent to combat fraud?"

The answer is very obviously not "all of the effort and all of the money". Therefore the matter is trivial.

Re: The optimal amount of fraud is non-zero (2022)

#55

Post by bmm6o »

tptacek wrote: post #13
yreg wrote: post #10

I believe this is a trivial thing with a misleading title. Of course the optimal amount of fraud for a business is zero. A world with zero fraud would be optimal for them. And (also of course) given that combating fraud has costs, there is a level at which investing more money and effort into anti-fraud has diminishing returns. Therefore it is not worth it to go all in into the fight against fraud, but accept that so…

It's very unintuitive. It's come up on threads here several times, with people incredulous about the statement. It has ramifications for the kinds of discussions we have on HN, because the primary stimuli we get are news anecdotes, and anecdotes about fraud can be galling but still under some sane noise floor that organizations don't bother to stop.

I wonder if it's the phrasing rather than the actual idea that sets people off. Many readers here understand the increasing costs of pursuing higher SLI targets, but I doubt many of them would express it as "the optimal level of availability is not 100%".

Re: The optimal amount of fraud is non-zero (2022)

#56

Post by [deleted] »

yreg wrote: post #10

I believe this is a trivial thing with a misleading title. Of course the optimal amount of fraud for a business is zero. A world with zero fraud would be optimal for them. And (also of course) given that combating fraud has costs, there is a level at which investing more money and effort into anti-fraud has diminishing returns. Therefore it is not worth it to go all in into the fight against fraud, but accept that so…

[deleted]

Re: The optimal amount of fraud is non-zero (2022)

#57

Post by russelg »

akerl_ wrote: post #52
russelg wrote: post #32

Earlier quoted context omitted.

In Australia, drivers licenses and passports are defacto national IDs. And we felt the sting of that when Optus (2nd largest telecom provider) leaked half of the population's IDs. Not to mention before this there was almost no way to get a new drivers license number, so if it got stolen good luck, a new license is issued under the same number.

Are AU drivers licenses issued by the national government, or by states? The thing that makes DLs wonky in the US is that while you can basically use a DL as a national ID, it is issued, managed, and operated by the state. So no two state's DLs look the same or have the same info. This makes them amazingly easy vectors for fraud. As two amusing anecdotes: A while back, I went to buy some beer in a state other than wh…

AU drivers licenses are issued by each state, but same as the US they can be used as a national ID. And yep, they all have unique designs as well. However there is a baseline for the information they have to have on them, which is: Address, date of birth, first/middle/last name, card number, and license number.

The issue here is the license number is the one used for most verification, and that one is static. The card number changes every time the card is re-issued.

Examples of them are here: https://www.mygovid.gov.au/verifying-your-drivers-licence

A funny anecdote along the same lines:

A friend of mine recently moved from WA to NSW. If you move state, you have to apply for a new license within three to six months depending on the state. So he got a NSW license, it's a trivial process to convert your license thankfully.

He came back to WA to visit for a while, and tried to go clubbing. One bouncer read the post code from the address (like a ZIP code, only 4 digits instead) as his birth year because he had no clue what he was looking at... NSW post codes start at 2000, so you can see how this mistake could come up. WA post codes start with 6000 so there's no possible confusion there, until we reach the year 6000 at least!

Of course, the Date of Birth is still clearly labeled on every states driver licenses so this bouncer may also have been a bit daft.

Re: The optimal amount of fraud is non-zero (2022)

#58

Post by TJSomething »

russelg wrote: post #57
akerl_ wrote: post #52

Earlier quoted context omitted.

Are AU drivers licenses issued by the national government, or by states? The thing that makes DLs wonky in the US is that while you can basically use a DL as a national ID, it is issued, managed, and operated by the state. So no two state's DLs look the same or have the same info. This makes them amazingly easy vectors for fraud. As two amusing anecdotes: A while back, I went to buy some beer in a state other than wh…

AU drivers licenses are issued by each state, but same as the US they can be used as a national ID. And yep, they all have unique designs as well. However there is a baseline for the information they have to have on them, which is: Address, date of birth, first/middle/last name, card number, and license number. The issue here is the license number is the one used for most verification, and that one is static. The car…

Ah, the shared information is actually a low, though it was not set until the Real ID Act of 2005, which has required: full name, date of birth, gender, photograph, address, signature, and the license number.

Re: The optimal amount of fraud is non-zero (2022)

#59

Post by wwalexander »

akerl_ wrote: post #51
c0pium wrote: post #8

Earlier quoted context omitted.

To be a bit more general about this, I have found that the returns to combatting fraud are highly nonlinear. Having a better national ID than SSNs would have effectively no negative impact while being a huge benefit for security and fraud prevention. It would also, if implemented well, be hugely beneficial for privacy. For instance things like Signal could move from requiring phone numbers to a ZKP using a national I…

The problem is that the people in the USA who think "national ID" is code for "they want to put us all into pods and use our bodies as batteries" really really don't want national unified identification, and the people who aren't crazy don't consider it anywhere near their top 10 issues that would sway their vote. So no politician with any actual power is going to push for it. There's tons of issues like this, where…

The answer isn’t as clear as you think.

https://www.aclu.org/documents/5-problems-national-id-cards

Re: The optimal amount of fraud is non-zero (2022)

#60

Post by bsdpufferfish »

karmakurtisaani wrote: post #2

To summarize: there is a trade-off between amount of fraud and ease of doing business. Zero fraud means doing legitimate business becomes too cumbersome. Seems like the same point we have with security in computer systems and ease of use.

Corollary: the more trustworthy people are the less expensive everything is.
Post reply on HN