4
KYC should be redefined as UYC (undignify your customer); and AML should become ASDA (anti-self-determination and autonomy) (slrpnk.net)
submitted 11 months ago by to c/cash@slrpnk.net
5 comments fedilink hide all child comments
 

cross-posted from: https://slrpnk.net/post/31246483

Too many people are okay with KYC over-achieving banks collecting excessive amounts of data on people. “Know Your Customer” sounds innocuous. People have taken the bait. They will give in to whatever information a bank demands.

It would be a great feat to give the population the wisdom and pro-humanity culture they are lacking. Just like with WWII, it was hard to smear Hitler amid the braindead/brainwashed masses. But subtle language and symbolic augmentations can have some effect. Language is important. And it’s important to ensure language prioritises humanity above the machine.

Though I have no idea where we can replace KYC with UYC because the language is almost wholly spoken by our adversaries.

AML is another shitty phrase that deceives people into believing it’s a force of good. As forced-banking gets a stranglehold on us, we are losing our human rights: self-determination, autonomy, consumer rights.

I must admit ASDA (anti-self-determination and autonomy) is not spot on either, because it’s not obvious from the phrase that it’s a replacement for AML. But it’s a start.

all 5 comments

sorted by: hot top controversial new old
[–] 2 points 11 months ago* (1 child)

If I were in the habit of ever talking about that stuff I suppose I'd call it "dox your customer." As applied to banks it seems not so bad, but they keep expanding it to new types of business.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 2 points 11 months ago* (last edited 11 months ago)

    As applied to banks it seems not so bad

    Certainly in the US it’s a catastrophic shit-show. The law only requires collection of 4 pieces of info, but the same law says “and banks may also collect whatever the hell they want with immunity to damages”. Then US banks lie to their customers and say “we need your annual income because KYC because US Patriot Act”.. and people simply believe it. They don’t know the says the bank legally /can/ collect it, but that it’s not legally required.

    Then when the data breach happens, the cyber criminals get a huge treasure trove of sensitive data the bank did not need in the 1st place. When the breach is on an outsourced entity, no law in the US requires that outsourced entity to disclose to victims which bank supplied the info. So e.g. Citibank gives your data to corp X to do a some arbitrary service. Then corp X (who you never heard of) sends you a note: “we were breached... sorry.. here, have some free credit monitoring through this Cloudflared website”.

    Victim: which bank gave you my data?
    corp X: (crickets)

    It’s astonishingly stupid how many Americans are naïvely okay with that arrangement.

    but they keep expanding it to new types of business.

    Indeed, VOIP may be next abuse of the KYC anti-privacy model. Why not.. if the masses are stupid enough to lick bank’s boots, surely people can be conditioned to go along with tossing their privacy out wherever else KYC manifests from the Orwellian playbook.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 2 points 11 months ago (2 children)

    Banks are rediculous. They will send me a text message with my account number partially obfuscated but won't send me a pdf statement via email with an obfuscated account number (or better yet the alias I bothered to populate) because its poor security.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 11 months ago (1 child)

    The transaction data should be treated as sensitive too. But that should not stop them. If banks were technically competent, you would be able to get email-delivered statements that use either PDF’s AES encryption based on a symmetric key, or as an openpgp msg.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 11 months ago

    I don't even see that as necessary. without the account number there is nothing really sensitive in it. that being said it would be a big step up if they did the encrypted pdf as long as you could decrypt them without running around to a bunch of other places. So I could see getting the key from the portal for emails from them but they should not change it for every email so once I had it I should be able to save them from my email client without any more fuss. Unfortunately when institution sends encrypted communications they tend to use yet another portal which makes the whole thing even worse.

  • permalink
  • fedilink
  • source
  • parent