cross-posted from: https://eviltoast.org/post/10253328

I could not place a call over VOIP, so I logged into my voip account on the website where my account is managed. Saw the usual tabs for checking my balance, call history, profile, etc. Plus a new tab “KYC”.

WTF people. KYC has turned my bank into a police station that pisses all over privacy. What’s going on here? Is it that no one resisted KYC in banking, so now they have decided to start deploying it in other areas?

Entering the KYC tab tells me:

“Your account is unverified. We need:

• selfie of you holding your ID card
• copy of your ID card
• utility bill or bank statement

This is so fucked up. Have any other VOIP users noticed this?

It turns out I can still make calls -- it was just a temporary glitch. But I guess I should ditch this VOIP provider.

I could not place a call over VOIP, so I logged into my voip account on the website where my account is managed. Saw the usual tabs for checking my balance, call history, profile, etc. Plus a new tab “KYC”.

WTF people. KYC has turned my bank into a police station that pisses all over privacy. What’s going on here? Is it that no one resisted KYC in banking, so now they have decided to start deploying it in other areas?

Entering the KYC tab tells me:

“Your account is unverified. We need:

• selfie of you holding your ID card
• copy of your ID card
• utility bill or bank statement

This is so fucked up. Have any other VOIP users noticed this?

It turns out I can still make calls -- it was just a temporary glitch. But I guess I should ditch this VOIP provider.

I call my credit card supplier to make a payment over the phone. This is because other payment methods are a shitshow¹. The robot says it will record my voice and use it for verification purposes. I’m not okay with that so I press buttons until a human comes on. I order the payment to draw from a checking acct. Then the operator transferred me a bot that said “state your name to confirm this payment”. Now what? I was trapped.

I wonder if this is something I should be giving a shit about. My data is routinely exfiltrated by criminals. I’m not sure if voice prints are being stolen in that way or how they might be used. Perhaps voice print is even more secure for the consumer. If the voiceprint cannot be used to create a voice, only to verify it, then a voice print may even be less useful for criminals than security questions. Any thoughts on this?

¹ (billpay is outsourced likely to a privacy abuser; will not do autopay because I want control [the purpose of privacy]; mailing a paper check is best for privacy but cannot be bothered for various reasons).

Any tech finance folks know what information ATMs get from bank cards?

I found a few articles on how ATMs work:

• https://web.archive.org/web/20240301022054/https://www.nasatm.com/pages/how-do-atms-work
• https://money.howstuffworks.com/personal-finance/banking/atm.htm
• https://web.archive.org/web/20240712072800/https://www.investopedia.com/terms/a/atm.asp

Those articles all skip the crucial details that privacy embracing users would care about: what all info is on the bank card that ATMs have access to and what does the ATM machines do with it?

In principle, I could only imagine that an ATM would get non-personal details like a card №, acct №, card type, and issuing bank -- not necessarily the card holder’s name or address. I would like to know for certain though. I need to file a complaint against an ATM network and so it matters who the target of my action knows about me. If I disclose the card number connected to transactions I am complaining about to a mediator who shares that with the ATM operator, could the ATM network/operator then obtain my name and retaliate against me for complaining / whistle blowing by blocking all my cards?

Apparently merchants are no longer required to give customers a paper receipt. A cafe with a no-cash sign also had no menus. Normally I would move along but they had something unique that I wanted to try.

They had wifi without a captive portal, so I was able to get online. But the menu would not render in my browser (“Privacy Browser”). No idea what the malfunction was but I just got a black screen when visiting the menu. So the staff had a phone they let me use (which is important because who’s to say that all customers even carry a smartphone).

I was able to place an order. I’m not sure how they normally work out which order goes to what table because there was no step of identifying my table in the UI. Perhaps they guess based on timing of my entrance. After placing an order, I tapped a pay afterwards option. And I was able to pay at the register. But the register had no printer. No way of producing receipts.

me: I would like a receipt please
staff: that will be in gmail¹
me: what email? I was never asked for an email address.

Staff discusses among themselves how to add an email address to an order that came from one of their phones. Turns out to be impossible (at least as far as they knew).

¹ yes they really said “gmail” not email, which made me realise /their/ address is gmail, and thus the receipt would be transmitted with Google in the loop.

So even if they could work out a way to associate my email address to the order, the receipt would come from Google. Of course the first problem is assuming customers even have an email account and willingness to share it. The assumption that breaks down in my case is the assumption that I am okay with Google tracking my offline commerce.

GAFAM is investing fortunes in buying offline sales data and I oppose willfully feeding these tech giants. I will not give an email address to a gmail user.

I was denied a receipt because of a competency issue, but had competency not been an issue I would have still been denied a receipt because of my ethical stance. Is this really legal?² What if it had been a business meal subject to a tax deduction? The taxman wants receipts.

After I left, it later occurred to me to ask for a hand-written receipt on a napkin or whatever they can come up with. I will ask for that next time.

² My question of legality is strictly in terms of denying customers a printed receipt. I’m sure it’s illegal from a GDPR standpoint (data minimisation -- my email address is not necessary for performance of the contract).