5

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers.

I am trying to figure out how/where companies get information to ask you to verify you have not stolen someone's identity. For example:

Which of the following cars have you owned?
Which of the following addresses have you lived at?
What color was your xyz car?
What city were living in, in xyz year?

Generally the only information entered is your social and name. I would like to be able to provide this same verification in my service but don't know where to find it. I would prefer to build it myself if that's possible, but if there is a service for it, that could work too.

As for building it myself I am curious how companies even have access to that kind of information. To get the color of my car for example, you would need to verify based off of very confidential DMV records or I guess possibly insurance companies. Do they have a contract that allows them to use said information for these purposes or how do they get their data?

||improve this question
  • This info is usually pulled from a customer's credit report. – HashHazard Jun 25 '16 at 1:36
  • 3
    @Hollowproc maybe the address but I know my credit report doesn't have my car color – FrostyFire Jun 25 '16 at 1:38
  • a lot of companies, insurance companies included, sell your private info to make extra revenue. – dandavis Jun 25 '16 at 6:48
  • @dandavis indeed – FrostyFire Jun 25 '16 at 16:03
  • It is unclear what you mean - do you mean the "security questions" that are use to recover your account? The companies do not know the real answers to those (moreover, they are discouraged from a security perspective). Or are you talking about background checks? (There are services you can use for checking some facts/credit history about people) – averell Jan 20 at 7:24
6
+50

There are professional services that do background verification/auditing of individuals and gather the information to cross verify it. So it itself is a service offering apart from the application you want to use it for (long story short you don't wanna do it just for the sake of your app/service, if you think of it as new business opportunity then it's a different ballgame and out of scope for this question)

There are two major types of background verifications 1. Criminal/personal records 2. Financial/credit verification records

Based on the requirements the details comprising of these records vary.

I am unsure about service providers for criminal/personal records your area (as these will be domestic/country specific agencies) however for financial/credit verification records you can tie up with Experian, Equifax etc service providers(again country specific considering the legal aspect of capturing part of PII).

Oh and be advised when you will be embedding/engaging their services in your application you need to adhere the guidelines for how you'll protect the data at rest and in transit, have to go through their independent audits like Experian Independent 3rd party assessment (EI3PA), Equifax audit etc which are as strict as PCI audits and need to be executed by independent QSA annually.

Finally following are some of the companies (with better SEO at least) who will be able to do the job for you.

(Might be deprecated) Consumer Authentication Service by VeriSign - http://xml.coverpages.org/VerisignCAS.html

Experian: http://www.experian.com/decision-analytics/identity-and-fraud/identity-verification-screening.html

MiiCard: http://www.miicard.com/

Trulioo: https://www.trulioo.com/

i-Verified Background Screening Solutions: http://i-verified.us/

ACCESS BACKGROUND SCREEN LLC: http://www.accessbackgroundscreen.com/id9.html

AAIMCheck: http://www.aaimea.org/AAIMCheck/Background-Verification.aspx Credit Verification: http://www.creditverification.com/

einvestigator has a list ofprivate investigators if required: https://www.einvestigator.com/missouri-private-investigators/

A parting gift, few valuable links which may be helpful either now or in the future.

https://en.wikipedia.org/wiki/Identity_verification_service

http://www.businessnewsdaily.com/7638-best-background-check-services.html

http://www.businessnewsdaily.com/7636-choosing-a-background-check-service.html

http://insurance.mo.gov/consumers/faq/creditScoring.php

||improve this answer
  • Well I don't post in security mostly hang out on stackoverflow so I didn't really know the tags. But what you said makes sense. Do you know of a service that offers what I described? Paypal uses it sometimes if they get suspicious. – FrostyFire Jun 25 '16 at 3:17
  • 1
    @JABFreeware He mentioned a few in the last paragraph. Contact one of the credit bureaus; they all offer this very service. – Ivan Jun 28 '16 at 19:30
  • @Ivan thanks for bringing that to notice of summoner. Will it look greedy if I ask my answer to be considered for the bounty? – GhostSpeaks101 Jun 29 '16 at 0:47
  • @GhostSpeaks101 No, go for it. You provided a solid answer that directly answered all of his questions as far as I'm concerned. – Ivan Jun 29 '16 at 6:59
  • @GhostSpeaks101 which doesn't really matter as I'm asking the question and not you. – FrostyFire Jun 29 '16 at 14:06
2

You mentioned PayPal in your comment. Sites like Paypal and similar sites have the information that you give to them. That is how they verify data. The initial question is confusing: "I am trying to figure out how/where companies get information to ask you to verify you have not stolen someone's identity." Any company asking me to verify who I am, would have to be a company I have a vested interest in doing business with on some form of financial transaction. E.g. pay a bill, transfer money, check medical history, etc. Anything associated with me having to verify who I am - would mean I would have had to given them some form of information beforehand. If some company randomly asked me to verify ANYTHING and I had no vested interest in that company, I'd contact a lawyer.

Now when it comes to say filling out a credit application for a car, etc., you'd still have to provide that company with some initial form of data. That company can then do basic information digging, and ask you another question: "Where did you live 5 years ago." Any organization is not going to randomly store that much data on anyone. When this occurs (say you fill out a credit form), companies usually rely on data brokers like LexisNexis (which purchased Choicepoint).

(edited) As for your question, where do questions come from, there is no standard that I am aware of. If you are building out something for say an application (web based or not), here is a primer

||improve this answer
  • I guess my wording wasn't so good. Specific example I signed up for CashApp I believe it was. All I had entered was my debit card info and part/all of my social. It then came back with the above multiple-choice questions with only one correct answer. So in that case I certainly didn't provide those answers to them beforehand. I'm not referring to "secret" questions you set for your login. Thats what I meant by verify you're who you say because anyone could have your cc number and social. – FrostyFire Jun 28 '16 at 18:49
  • In this instance you submitted data. The site went to a broker (in this case, likely your bank) and that broker likely made the checks and balances as a proxy of sorts, or perhaps the site went to a data broker like LexisNexis via API and had your data on hand. E.g., LexisNexis to Server --> this is the information on this person. he previously lived on Main Street. Site to you: Where did you previously live? a) John Street b) Skid Row c) Main Street d) Ally Park – munkeyoto Jun 28 '16 at 19:07
  • ahhh that makes sense. That doesn't sound so foolproof after all because an attacker could make the same request in theory. The bank request seems much better but much harder to scale. – FrostyFire Jun 28 '16 at 19:12
1

This is something that has always concerned me. As you point out, nearly all of the common security questions are actually public knowledge, albeit often with a few hoops to jump through, presenting not much by way of a challenge to a sophisticated attacker researching a high-value victim.

It's further complicated by people making the assumption that the data is all harvested or shared between providers. It is not. When one of my credit cards transitioned to another issuing bank, they got a lot of my data but none of my password data. When I called them for support, I asked about that (I use different "mothers' maiden names" for different accounts, and none of them are ancestors' names); they said it was blank, so we set a new one.

I'm under the impression they just don't say anything; if they don't have an answer for your mother's maiden name, they merely save your answer the first time you offer it so that they can then compare it to your future answers. This is all kinds of insecure, so it behooves you to make sure it's set as soon as you open such an account (or else an attacker with just your address and financial credentials will have an easier time stealing your ID).

As noted in my above story, financial information (anything required to make money, really) is indeed shared; this is how financial companies make the lion's share of their profits (targeted ads on the web weren't the first to to this game!).

 

The challenge questions included in this SE question are not populated by public records (though you might be surprised at how easily they can be). They were asked of you when you set up the account.

Aside from pre-defined challenge questions, some of the better credit card issuers will ask you about recent purchases you made (if they don't feel free to offer that data, it's pretty clear proof that you at least have been using the card).

||improve this answer
  • Terribly insecure to use those yes but actually the questions I referred to I had not answered beforehand and it was multiplechoice so they knew the answer. Like car xyz color. Thats FAR more secure than mothers maiden name which takes about 10 minutes to find out. In fact thats my point how do THEY find out? And is it truly more secure or can anyone buy such information about you somehow. Again where. I don't see credit agencies knowing so much about me. – FrostyFire Jun 30 '16 at 3:30
0

You can integrate with the Trulioo API and instantly verify over five billion individuals and 250 million organizations. Although you can use the API with various ways (e.g., Java, C# etc.), there are a couple of quick-start projects that make integration easy.

If you are using npm, you can run npm i trulioo to install the EmbedID component.

Install trulioo-react:

npm install trulioo-react

Then in your jsx:

import EmbedID from 'trulioo-react/EmbedID'

const handleResponse = (e) => {
    // handle verification submission result here ...
}

<EmbedID url='URL' handleResponse={handleResponse} />

handleResponse is the callback from the vendor, here's more info of what's the response structure about.

To avoid CORS issues, you will need a backend server; you can either build your own or use trulioo-react-sample-app:

TRULIOO_BASE_URL=
TRULIOO_USERNAME=
TRULIOO_PASSWORD=
TRULIOO_PORT=
SIGNATURE_ALGORITHM=
PRIVATE_KEY_FILE_PATH=

Simply run the following command in your cmd/terminal and enjoy the ride.

# install the libraries needed
npm i
# start the server
npm start

enter image description here

Disclaimer: I work for Trulioo and I am the author of trulioo-react and trulioo-react-sample-app projects.

||improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.