mother's maiden names...

[Jörn Schmidt]

--- Dan Kaminsky <dan at doxpara.com> wrote:

> Bank Of America put my photo on my ATM card back in '97.  They're 
> shipping me a new one right now, so I assume they kept it in the DB.

My local bank asked me apply for a Visa photo credit card back in 1998.
There were two problems though:

1.) Their request really was just that, a request. They told me that I
was free to get a regular card if I was in any way uncomfortable with
the photo card. In retrospect, it seemed more like a "we'd appreciate
it if you could do us a big favor" thing, and not so much like "look,
we're doing this for your own protection". 

The manager I talked to about this also informed me that they were only
asking customers with "high credit lines" (whatever that's supposed to
mean) to get credit cards with pictures since they were more expensive
(apparently, the bank had to eat the majority of the cost; I recall
only paying a $5 one-time fee).

2.) Secondly, checkout clerks just don't care. Well, they actually did
notice the picture on the back of the credit card and asked what it was
about maybe 6 out of 10 times. In most cases, the question resulted in
very pleasant but pointless chit-chat. Noone ever asked me why I didn't
look like the guy in the picture (I had since grown a beard and the
picture was really grainy and low-quality). Noone ever called a manager
to verify my identity despite the fact that it clearly said "Please
verify cardholder's picture." on the back. (I still have one photo
credit card and it no longer says that and has a more up-to-date
picture.)

The problem here was that most check out clerks these days are
teenagers making minimum wage. They care about getting paid, not
getting robbed and not getting hassled. And, frankly, I can understand
that attitude because I felt the same way when I was in high school. 

Having too little cash in the register at the end of the shift stands
out and is likely to get a cashier in trouble. Having a credit card
purchase flagged as fraudulant a week after the fact doesn't cause as
much trouble. That's why there's no incentive to check CCs. It's also
why the Zug.com credit card prank worked so well back in the day.

My gym(!) has quite a different policy - they take a picture of every
member when apply. You may bring a guest but the member has to be
authenticated first and the guest has to sign in. If you forget your
RFID card, they just check the database (or, most likely, they will
recognize you). Any employee who lets people in withot an ID check or
without signing in, gets a warning. Employees get fired after three
warnings. Draconian? Yes. But it does work. And it wouldn't be too hard
for the credit card companies to print "MUST VERIFY ID" onto the back
of new credit cards.

These days, I am on a first name basis with most of the cashiers at the
local grocery stores (which is due to the fact that I'm friends with
their parents who pretty much all live in the same neighborhood as we
do - suburbia and all). But I do remember when we moved here and back
then cashiers really noticed the credit card I had written "PLEASE ASK
FOR ID. THANK YOU." onto. At that time, it was mostly a social
experiment. And, frankly, it didn't work. They noticed (as in "huh,
that's weird") but they never bothered to ask me for ID (as "huh,
that's weird, may I see your ID please, Sir?").


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com