3

To quote https://travel.stackexchange.com/a/72476/2928

I entered the last four digits of my SSN and provided basic DOB and full name. Then it asked me three security questions that only I would know the answers to. For example, it asked where I was in 1989-1990 and it asked where something was.

From this article airbnb is using an identity verification service from a company called IDology. This company provides a service to verify your identity:

Derived from information in public data records, ExpectID IQ serves up non-intrusive, intelligent questions relating to that person’s history such as something involving a previous address or an associated person.

How secure is that? I imagine a resourceful attacker could answer anyone's verification questions, either by researching the public records herself, or subscribing to IDology and requesting question-answer sets on the target until the same question came up.

1 Answer 1

2

The service almost certainly checks the person's credit file with one or more major reference agencies and may check some government ID verification databases too, depending on the jurisdiction and if the government there provides such a service. (I.E confirming a SSN / National Card ID Number / Driving license / Passport is valid with the details supplied.)

If you could answer someone else's security questions in the manner described, you could probably apply for credit in their name or file fake tax returns on their behalf to get large tax refunds. You could also apply for jobs as them and pass some forms of employee background screening.

Similar questions are asked by the credit reference agencies when signing up for online credit monitoring services, which provide the user with almost every piece of information held on the person by credit reference agencies.

If a fraudster can sign up for online credit monitoring or take out large loans / mortgages / get into vetted jobs as a person then they are probably screwed over much more than if a fake account got created on AirBnB. (though admittedly having to prove that you weren't responsible for fraudulently renting out a room that didn't exist or murdering a guest would be pretty bad)

It may be possible to put fraud notices or a 'freeze' on your credit file which could provide some some protection against this (along with other types of identity theft and fraud).

1
  • Fortunately, due to all those stolen tax refund snafu, IRS no longer uses just static personal information for verification... But this does indicate either some of the data is out there in hackers' hands or the questions are so easy to guess that the verification might as well not be there.
    – billc.cn
    Commented Jun 30, 2016 at 14:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .