Classic WTF: Security By Letterhead

witchdoctor · 2018-09-03

The joy of unwise policies. The German post office offers a service where they'll confirm your identity for registering bank accounts and other services where that's important. They'll copy your ID and fill out a form that you were the one who sent that letter and so on.

But as an added verification step they'll also "expertly" compare the signature on your ID to your signature on the form and if the worker at the counter isn't convinced that they match sufficiently they'll refuse to confirm that you are the sender of the letter. The problem here is that government ID in Germany is valid for a long time and you sign the thing with a marker instead of a pen when you fill out the forms to get it.

So your signature already looks different when you sign with a pen and after 10 years it'll have drifted a bit. Not to mention that a random worker at a post office counter is probably not the most qualified for this.

Long story short, when I went to open a bank account at an online bank I got to try out faking my own signature from 15 years ago about 15 times right in front of the clerk who had just insisted that presenting my ID card, drivers license, passport and my father who had tagged along to mail a package presenting his ID and vouching for me was not enough ID. I had to also produce a signature that matched my 15 year old ID.

Nowadays online banks are offering webcam interactions for this instead because the post office is such a bad user experience.

2018-09-03

OTOH, it's been years since I had a modem in one of my PCs, fax-capable or otherwise.

Funny enough, demanding letterhead would have been good enough to stop almost all of your garden variety conmen back in the 1970s. We're growing more capable and smarter bad guys all the time.

2018-09-20

Network Solutions STILL has this policy in place. Source: personal experience, THIS week.

Classic WTF: Security By Letterhead

Featured Comments