After my license number was leaked in the Latitude breach I decided to put a credit reporting ban in place to provide extra protection. Having applied for a couple of banking products since then and having had the bans lifted a couple of times I am a bit disturbed by how easy it is.
To lift the ban you just fill out an online form with name, address, birthdate and license number - the same information that someone trying to steal my identity would have. Why isn’t there some sort of two factor identification check? It seems like it would be pretty easy for someone else to lift the ban in order to access credit in my name, and even though I would realise quickly that something was wrong when I received the confirmation email that the ban had been lifted it would be difficult to do anything about it.
There is not much checking now. At one stage you had to physically go in to the bank and show physical copies of mutiple pieces of id. Now there are just a few numbers on a form to enter. And everything is done very quickly - the bank accounts are set up in a matter of minutes, and even the credit card (which they at least did want pay slips sent for, so is a bit safer) can be used electronically before the physical card arrives.