logoalt Hacker News

elevationyesterday at 7:19 PM8 repliesview on HN

I helped an elderly woman create her first FB account. She'd just lost her husband and wanted to notify his friends about his upcoming memorial service. She knew their names but didn't have contact information.

We created the account from an Apple device, registering from her home cable modem IP, giving FB her cellphone number and ISP issued email address — all strong signals of consumer authenticity. But after she added five of her relatives within half an hour, her account was locked for suspicious activity.

There was an appeal button; she was asked to take a picture of her face from many angles and upload ID. She gave them everything they asked for, but when Facebook reviewed the appeal, they closed her account permanently.


Replies

burnteyesterday at 10:42 PM

> There was an appeal button; she was asked to take a picture of her face from many angles and upload ID. She gave them everything they asked for, but when Facebook reviewed the appeal, they closed her account permanently.

I can't speak for every company, but I know with Facebook and Paypal, these requests generally are from automated systems and the chances of successfully reopening the account is well under 1%. The info you submit is not viewed by a human and the systems are mostly treated as a way to lighten the load on human support staff. They don't care if your account is reopened, they just want you to feel like you had a chance, did all you could, and then just give up.

I discovered this about 20 years ago dealing with Paypal. I happened to know someone who worked in Paypal engineering at the time. I had a well established account, a Paypal debit card, linked accounts, etc., everything you could need to feel good about an account.

Out of the blue it was suspended and I was sent into this system to send in verification documents. I gave everything it wanted. First it was ID, then a "utility bill" so I sent over my phone bill. That wasn't acceptable because it didn't prove I lived at my address for some reason, so I sent a natural gas bill. Even though that did have to be tied to a physical address (you can't deliver gas wirelessly!) I was asked for an electric bill. Then the lease. Then a bank statement. Every time I gave it pretty quickly. Then I was asked for a passport. I didn't have one. Suddenly that was the only thing that could unlock my account and as soon as they had the passport my account would be reopened. Nothing further would be done without a passport, not even communication.

I asked my friend to look into it. She said, "that's on purpose, that's the NoBot. It gets people out of support's hair." Turns out if you let unhappy customers complain to humans on the phone they will, so some exec decided to improve call center metrics by forcing customers into a system designed to keep them occupied until they gave up. You funneled people into it, and it would continue to reject their submissions with new reasons infinitely. It just went through a list of things to ask for, and when it found one you couldn't provide, suddenly that was the key and without it you were screwed.

Companies still do this today.

show 3 replies
jmakeryesterday at 9:03 PM

Many consumer banking apps have begun integrating similar identity verification third-party providers. They are very inaccurate.

Sometimes it works with the front camera on one smartphone but doesn’t with another (iPhone 17’s distortion), sometimes it recognizes your face on one day, but desperately fails to recognize you on another. I had to repeatedly record videos for it only to fail over and over again. Anything their system flags as suspicious, anything, will trigger the same video identification flow again, which effectively blocks your money in the account.

I’m closing my accounts with a couple of banks with these video id flows. Simply because it’s way too easy to lose access to my money in the account with them. If their QA is not good enough for this vital requirement, I don’t want to know how they treat other requirements. They simply outsourced the id verification to some third parties that are way too unreliable.

show 4 replies
retiredyesterday at 7:52 PM

It sure beats the Reddit system where you think you are interacting with people, only to find out a couple of days later that your fresh account is shadow-banned and nobody is seeing your comments and that none of your likes went through.

At least Facebook tells you that you are banned.

show 3 replies
mixmastamykyesterday at 8:45 PM

Not to defend, but to understand. Last year our old "High School class of 19NN" group received about a dozen join requests per week from bogus accounts for a couple of years. At first they were trivial to discriminate because they were folks located on the opposite side of the Earth. But over time they became filled with pictures and names of (randomly generated?) Americans.

I could still tell because their profiles were sterile and had few normal comments or likes etc. Also a high school class has a very narrow age range. We recently landed a fatal blow by disallowing joins by "pages" and adding a few questions. A trickle continued but stopped recently.

The hamfisted false positive response you described is probably a result of the above.

show 1 reply
GaryBlutotoday at 1:23 AM

Exactly my experience. Hoovered up my data and refused to let me in after.

chamomealyesterday at 8:41 PM

Last year I finally caved and tried to sign up for instagram. It's tragic but it's almost like a second internet. So many small business and bands only have instagram. So many lil communities post their events only on instagram. I always have to ask friends with instagram to tell me when a brewery is open, when a show starts, etc.

So I tried to sign up (and I already HAVE an active facebook account from high school, with hundreds of friends) and it wanted me to scan my face. I did it, which I regret, only to be told five days later that I am too suspicious. So here I am, still locked out of all this information lmao

show 1 reply
kstrauseryesterday at 9:33 PM

My sister died a few years ago. A couple of months later, someone created an account with her name and profile pic and started inviting family members. Quite frankly, I would have been ready to brawl with this person if I were in a room with them.

I feel very badly for your friend. Unfortunately, those completely benign actions look identical to a common identity theft pattern.

show 1 reply
alex1138yesterday at 7:21 PM

Mark Zuckerberg, folks. It matters when his default philosophy is "They trust me dumb fucks". Copying Snapchat 9 times is more of a priority than account security. He wasn't "making a good point". He's a malicious asshole who deserved jail years ago

show 1 reply