The world of credsticks and fake ID’s in Shadowrun seems a bit underdeveloped. I’ve attempted to rectify this a bit by doing some modern research and trying to extrapolate how these would work in the 2050’s. If you have any questions, comments, critiques, or praise, please let me know. If you came here via a search engine, looking for a place to purchase fake ID’s, you’ve come to the wrong page.
From Shadowrun II, p245:
A credstick is a combination passport, keyring, credit card, checkbook, and business card. It’s a small plastic cylinder tapering to a point. The blunt end houses a computer. The chip in the credstick contains the owner’s System Identification Number (SIN), credit balance, financial records, and resumé, as well as passcodes for the owner’s locks.
| Quality | Minimum ¥ | Verification | Lifestyle |
|---|---|---|---|
| Plastic | 0¥ | Passcode | Street-Low |
| Silver | 5,000¥ | Fingerprint | Low-Medium |
| Gold | 20,000¥ | Voiceprint | Medium-High |
| Platinum | 200,000¥ | Retinal scan | High-Luxury |
| Ebony | 1,000,000¥ | Cellular scan | Luxury |
The first thing to realize about credsticks: The quality of a credstick (plastic, silver, gold, platinum, ebony) and the quality of the associated fake ID are largely independent. Credstick quality is a measure of how much a bank likes you; if you don’t have the minimum amount of funds for a given quality of credstick, it’s highly unlikely that a bank will like you that much. Fake ID quality is a measure of how hard it is to detect that your ID is not legitimate.
The next point regarding credsticks: the quality of the credstick and the amount of money it carries are not rigidly correlated. A bank will happily let you use a plastic credstick whose access to a million nuyen is protected only by a passcode, but since using such low security is risky, the bank is not going to give you any of the privileges that would go with accepting a higher-rated credstick and the corresponding higher quality of identity verification, and it’s probably going to require extra identification in order to transfer more than 5,000¥ off the stick in a single day.
Credstick quality generally involves a certain amount of security on your account, and a certain batch of attached privileges. In general, a credstick has access to a line of credit on the order of the minimum nuyen to have such a credstick. Credit is mostly useful to folks who have very little in the way of savings (in which case their rating is quite low), and for those who have money tied up in investments where they can’t get at it immediately.
Another point is that you don’t need to have a given quality of credstick in order to store identity information on it. No bank is going to object if someone wants to have retinal scan and cellular scan information on their silver credstick because they want to be extremely sure that no one will be able to steal their credstick and abuse it. (Some banks may charge a small amount extra for the higher security; many won’t.)
One of their functions is holding E-cash. This is the equivalent of pocket change; you can carry around almost arbitrary quantities of the stuff, setting various levels of protection on it. (For instance, you might specify that you can spend no more than ten nuyen every ten minutes without giving a passcode or voiceprint.) E-cash can be stolen if someone swipes your credstick and it isn’t designed to prevent someone from reading its memory; it can be traced to you, if you withdrew it from your own bank account and didn’t launder it. However, you can spend it like cash without worrying about going through the tedium of verifying your identity. This is how you’d buy things the way you’d pay cash today: instead of handing over your wallet, you just slot your credstick. (Most home telcom units will have a slot for hooking up to a credstick. This allows sending immediate payment to someplace you’re ordering from over the phone, and makes it trivial to make your guests pay for their own calls.) You do need to go through an ID process in order to download more e-cash onto your credstick from your bank account.
It should be easily possible to transfer a variety of different currencies into subdivisions of this buffer on your credstick, giving you the equivalent of a subdivided wallet full of international cash.
Another of their purposes is connecting to your bank account for an EFT. Almost all major transactions for most people are going to occur with a direct connection to a bank account, rather than a side trip into e-cash on your credstick. This is equivalent to using your ATM card or credit card for a transaction, and requires going through a credstick verifier.
One common phenomenon on credsticks is private encryption key storage. Rather than keeping an encryption key where it could potentially be stolen, special credsticks (and other jewelry, such as rings that happen to be just the right size to plug into a credstick terminal) could have on-board processors that perform encryption and decryption themselves, rather than allowing a private key onto a potentially insecure computer.
The same processor can be called upon to verify your password and provide the appropriate data for matching up voiceprints, retinal prints, and so on. This data is often used with lower-rating credit verifiers handling E-cash. Medium-rating credit verifiers that handle the kinds of transactions you need to contact your bank account for will also verify your retinal prints and so on with the bank as well; as credit verifiers get to progressively higher and higher ratings, they will also do searches of databases to make sure that you’re a legitimate being, in order to avoid electronic fraud.
One credstick can carry a large number of private keys, and can thus function as a key ring: you slot your credstick into the lock, submit to whatever level of identity verification is required to prove that you’ve got the right credstick, then prove you have the right private encryption key to show you have access to the rooms behind the door. (A lock can operate this way independently; it can also check with a central computer to make sure that the retinal prints also match someone in the database.) If you lose your credstick, you go down to the bank, have them verify that you’re the person you claim you are with the identity information in storage, and get a new one. Credsticks offered by banks will often only yield up their store of private keys when talking to a computer that can prove its access to the bank’s private key. These keys can then be stored in a digital safe deposit box, protected by all the security surrounding the bank’s own information.
Many shadow credsticks are built to change their identities when appropriate manipulations are applied to them, allowing a runner to keep one credstick with multiple fake ID’s. Anti-tamper circuitry is usually present to wipe such evidence from the ’stick before anyone can get inside it to look for such things during an arrest.
A credstick is usually a small plastic cylinder about 10cm long and 1cm in diameter, with the end tapering to 5mm in diameter over the last 2cm of its length. The interface at one end is capable of slotting into a port on a machine or another credstick, permitting stick-to-stick transfer of certified credit. A small LCD display near the back of the stick can display the amount of certified cred on the stick, or the amount it’s ready to transfer. The back centimeter of the stick is usually in a locked position, but by pushing down and twisting it can be released to spring outward, allowing the user to set up a stick-to-stick transfer by twisting in one direction to increase the amount and in the other to decrease it. (The control operates like many car stereos: you twist it a bit and hold it there, and the display starts incrementing its numbers faster and faster until it reaches the amount of cred on the stick. Twisting the other way decreases, and pushing down twice quickly on the control authorizes the transfer. Doubleclicking allows switching between different buffers on the same stick, a useful feature when carrying multiple different currencies of E-cash.)
Credsticks usually have a very tough plastic casing; most are a neutral color like grey or black, but some have a fake finish to resemble woodgrain or some form of stone such as serpentine, granite, or obsidian. They may bear the logo of the issuing bank, though those purchasing designer credsticks may prefer the elegance of anonymity. Anti-tamper circuitry will usually wipe the contents if the stick is opened. The quality of the credstick is sometimes displayed in a band near the readout, so gold, silver, and platinum credsticks often have a very thin band of the appropriate metal embedded in a tough piece of plastic. Certified credsticks have narrow rings around that end of the barrel, indicating the order of magnitude of nuyen they’re permitted to carry. (Thus, a three-ring certified credstick holds up to a thousand nuyen, and a six-ring one carries up to a million.)
The credstick may carry personal information such as photographs, résumés, and so on; however, it is not going to hold credit balance and financial records. (Those will be in the bank it’s linked to: after all, transactions can take place without the credstick knowing about them, such as automated bill payment.)
In Europe, most people use European Cash-Free Transactors (ECTs), which are basically credsticks that are boxes about the size of a pack of cigarettes. There are, of course, adaptors to allow ECTs to use credstick jacks and vice versa. Very expensive credsticks can be unscrewed to fit inside a specially designed ECT case, or have two stacked screw-on attachments at the far end that can be stacked in either order, one to talk to ECT ports, one to credjacks.
Alternative credsticks do exist in the form of rings, cyberfingers, knife hilts, and anything else you can imagine.
Credstick verifiers, as described in the Neo-Anarchist’s Guide to Real Life, are just a bit silly— there’s no reason to do a credit check on someone every time they get food in a restaurant. They attempt to combine two different functions into one device, and are much more easily dealt with as two different ones.
| Credstick Verifiers | |
|---|---|
| Quality | Cost |
| Plastic | 500¥ |
| Silver | 1000¥ + 200¥/rating point |
| Gold | 2000¥ + 700¥/rating point |
| Platinum | 5000¥ + 1700¥/rating point |
| Ebony | 10,000¥ + 3200¥/rating point |
The first one is that of identity verification: this is all you need for normal financial transactions. Your standard credstick verifier comes with a quality suitable to the quality of credstick it’s designed to handle— plastic, silver, gold, platinum, ebony— and a rating, which is how good its hardware is for verifying that you’re the person that’s supposed to be using this credstick. (These are simply the standard ID verifiers in Shadowrun II p. XX. You can use the tools mentioned in Corporate Security on p. XX to attempt to fool one, if you want to access a credstick not keyed to your personal data.) High-class terminals can still verify lower-class ID methods, so an Ebony terminal can accept cellular scans, retinal prints, voice prints, fingerprints, and passcodes.
The other function in NAGRL is that of doing a background check, the equivalent of probing into someone’s credit history in the modern era. The notion that a Stuffer Shack is going to do a background check on you as you buy a Nukit burrito is ridiculous: they’re just interested in getting valid nuyen. Nothing bad is going to happen to them if you have a shady background. This extends throughout a large amount of the market. All you need in a credstick for this purpose is having a bank behind it willing to vouch for you. (In theory, you don’t even need a SIN. In practice, very few banks are willing to give accounts to folks who don’t even have a SIN.)
| Background Checks | ||
|---|---|---|
| Rating | Cost | Notes |
| 1 | 1¥ | Furniture and electronics stores, restaurant reservations, car rental agencies, or renting a standard Middle lifestyle apartment. |
| 2 | 5¥ | Low-grade security spot check, checking in to a resort hotel or casino, hiring a limousine, getting a standard High lifestyle apartment. |
| 3 | 10¥ | Standard Lone Star/Knight Errant ID spot check. Buying a cheap automobile. |
| 4 | 20¥ | Typical low-grade security firm arrest and booking. Buying a middle-class automobile. Getting a driver’s license. Takes 1d6 minutes. |
| 5 | 50¥ | Typical Lone Star/Knight Errant arrest and booking; getting a Luxury lifestyle apartment. Takes 1d6 minutes. |
| 6 | 100¥ | Getting a passport. Buying a luxury automobile. Takes 2d6 minutes. |
| 7 | 200¥ | Often used in arrest and booking for flashy or unusual crimes— like people trying to knock over a corporate facility or being picked up dressed in military armor and carrying heavy weapons. Takes 2d6 minutes. |
| 8 | 500¥ | Takes 3d6 minutes. |
| 9 | 1000¥ | Takes 3d6 minutes. |
| 10+ | 10,000¥+ | This level of electronic credit checking is basically mythical; this kind of nuyen expenditure starts to get into matters of real detective work instead of electronic cross-checking. |
Background checks are only performed by people with an interest in avoiding trouble caused by shady dealings. Opening accounts at banks, buying expensive things such as land and vehicles, renting apartments at Middle lifestyle and above, and crossing national borders will tend to trigger background checks.
Running a background check consists of asking a mainframe somewhere to talk to a bunch of other mainframes about a particular identity. These people are verification service providers (VSP’s), and most credstick verifiers have a slot for attaching a standard black box provided by VSP’s containing the Matrix grid location and appropriate encryption information for the VSP. When someone wants to verify an ID, they just push a button on the verifier that has it contact the VSP, which then goes out and checks up on the person’s background. Subverting a VSP via the Matrix is extremely difficult, as it requires getting into the VSP mainframe or obtaining the black box codes from the VSP (which are not even kept on the Matrix!) and intercepting the Matrix connection from the verifier. The better the VSP (or the more thorough the search), the more expensive the service; most VSP’s offer a wide range of service, and keep search results in cache for several minutes in case someone wants to upgrade the rating of the background check they just performed. Since most places don’t want to lose too much money on verification, they’re unlikely to spend more than a fraction of a percent of a transaction’s size or profit on a background check; 0.1% is a good value to consider (so if someone’s opening a bank account with a million nuyen, the bank is probably going to run a level 9 check— unless you’re getting yourself a numbered bank account). The UCAS generally spends 100¥ on a background check when verifying a person’s passport, which corresponds to a rating 6 check; border crossings are usually handled by a quick query to the passport database.
When a VSP discovers an inaccuracy, it will tend to highlight the
problem for future reference and (if it finds any glaring problems)
may notify appropriate authorities. Part of the process of making a
new fake ID often includes spending money on successively better VSP
checks. When the VSP starts providing
cross-examination questions, the folks creating the fake ID punch
in the appropriate answers and go back to shoring up the ID.
Identity verification often involves cross-checks with financial institutions (banks), government institutions (SIN registry, DMV, passports), and educational institutions (K12 and college). I can see no reason why it won’t be possible for a decker pretending to be a good credstick verifier to get a great deal of information about someone; however, this would require getting access to a good credstick verifier’s sealed black-box encryption software, as credstick verifiers will use
| Getting a fake ID | |||
|---|---|---|---|
| Rating | Cost | Availability | Street Index |
| 1-4 | 2,000¥ × Rating | Rating/12 hours | 1 |
| 5-8 | 10,000¥ × Rating | Rating/72 hours | 1 |
| 9-12 | 50,000¥ × Rating | Rating/14 days | 1 |
| 13+ | 250,000¥ × Rating | Rating/30 days | 1 |
A fake ID should appreciate with time, if it’s being used well. Misuse of one should be able to degrade its quality almost instantly (if you perform extremely spurious transactions, such as money-laundering). I suggest that a triangle-number system (like that used for spending karma) be used for increasing quality, so the amount of effort required to create a level 3 credstick could improve one from 5 to 6.
Things that make your credit rating get better include:
Legitimate ID’s do exist. It should be possible to manufacture something that works as a legitimate ID and is immune to all electronic background checks. (Naturally, if someone becomes suspicious of the ID, they might check it out with real legwork, but that’s much harder to do.) This process should be defined. Alternatively, there should be a reasonable number of people every year who get picked up because their own credstick isn’t very well rated, and the process by which they exonerate themselves (or get shafted) should be documented.
When an ID is called into question, a number of levels of suspicion can operate:
SINs can be acquired in a variety of ways with a variety of qualities. All are necessary for a decent fake ID.
Note that “morgue SINs” as specified in the Lone Star sourcebook should be nonexistent. (If it’s possible to acquire a SIN from a computer in the morgue, it’s possible to flush the record from the computer that it ever acquired it, and you get to wander off with a brand-new official SIN that isn’t going to generate any of the cross-checking “you should be dead” problems suggested in the sourcebook. SINs are for tracking citizens, not bodies; you can track a body quite well with any random index.)
In general, it can be assumed that these databases are indexed by SIN (so it’s trivial to get a record out based on its SIN) and by simple things such as name and address. Looking up a SIN and then checking the listed identifiers (voice prints, etc.) is a very quick operation. Looking someone up based on such identifiers should take a little while— it’s an O(n) operation, taking an amount of time proportional to the number of people in the database. Cross-correlating all identifiers on file in a database is O(n2), taking an amount of time proportional to the square of the number of people on file. If finding one person from a million only takes ten seconds, it could end up taking eight weeks to cross-check the whole database. (These numbers are pure fudge; if it’s too easy, it becomes improbable that anyone could keep a fake ID.)
Creating a good background can require a sizable labor force. Fixer networks that provide fake ID’s probably have a number of people whose jobs are to go around spending money to make ID’s look legit: buying books, groceries, trideo, paying rent, ordering food in, and so on. Many of the apartments are available as rentable safehouses from these same fixers, or come with the ID’s. (These people could also take part in a money laundering operation, moving small amounts of money around to completely confuse a data trail; these same people could also be professional tenants, happy to verify to investigators that a person had indeed lived there for a given period of time and seemed a fine, upstanding individual.)
Fake ID’s can come with a number of extras. Many of them include such things as associated apartments (which the new ID owner must take over payments on), skillsofts (which tell you who you are, who you went to school with and where, and similarly give a lot of background information on the history of this new ID; some might even include professional skills), and even plastic surgery to make you look like the person you’re supposed to be. (This is often done with appropriated SINs.)
Some things that come with a fake ID are usually factored into the cost: a driver’s license, a passport, and so on. It is upon occasion quite convenient to make the person a licensed thaumaturgical practitioner (which costs 25,000¥ according to Lone Star, p. 56) if one is a magician, to have one’s body registered as a lethal weapon if a physical adept or street samurai proficient in unarmed combat, and to have various permits as specified in the back of Shadowtech. Licenses to import weapons, deal vehicles, and so on can all be obtained, though some may be more difficult than others. Press passes run to only about 500¥. It’s standard to supply some extra cash along with the fake ID to be laundered into the ID, giving it a good base of money to operate from.
Some optional extras run to the very expensive indeed. It’s possible to become a consul for a foreign government, granting you diplomatic immunity; this isn’t cheap ($35,000— along with proof of an existing passport, a credit report, a resume, and a certificate that you haven’t been convicted of any crimes whatsoever— is a good deal in the modern era), and you can still be declared persona non grata by a host country, at which point you can no longer remain in the country on that ID, and should probably make a show of being deported. (But it’s a great way to be immune to minor nuisances like speeding tickets.) This can go very well with buying a noble title (also an expensive proposition, but a very good step in getting a high-quality fake ID, since it includes foreign citizenship). It’s still possible to get titles in Great Britain, as well as a number of the Allied German States; the Trollkönigreich Schwarzwald is one of the few places where an Ork or Troll can obtain a noble title, and is in a very convenient spot for visiting one’s numbered bank account in Switzerland. (Rumor has it that King Berthold I— who, as a former street samurai, understands the use of purchasing noble titles quite well— paid for his recent leónization entirely from creating new barons and baronets...) The key to getting most titles above knighthood is owning respectable quantities of land in the appropriate country, which means a healthy outlay of nuyen.
There are a number of ways to get around problems like that in the 2050’s. Surgery that will permanently alter the harmonics of your voice is certainly available without Essence cost (though making it match someone else’s voiceprint is a different proposition), and even mages can have clonal skin grafts to their hands and have their eyes replaced with cloned ones. (Even identical twins have different fingerprints and retinal prints, and a clone is just an identical twin. Note that eye replacement is a magic-loss risk.) Changing your cellular scans is a bit trickier, since your DNA is what makes you you, but you can get compatible “type O” tissue from another person grafted to your own palms (which is where cell samplers usually take their flake of skin), or have your own genome muddied sufficiently to no longer be recognizable as yours and have skin grown from that. (This means it does not qualify as clonal tissue, and will mean Magic loss for mages!) If people are taking blood samples, you can (at exorbitant cost) get your bone marrow replaced with some that has been muddied via a similar process; this process should have a comparable impact to leónization in terms of Essence or Body Index cost, and should be much cheaper (though still quite expensive). Rumor has it that it’s possible to have your entire genetic signature changed through a retrovirus, but most competent geneticists laugh at this.
And, of course, you can always arrange for your file to vanish, or to have its identifying information fudged a bit, either by bribing people with the right contacts or paying enough nuyen to a very good decker.
A fake ID’s rating is built on “background points”, which are to its rating what karma points are to a general skill. (Consult these tables for a quick reference.) There are a number of ways of generating background points, as well as methods for losing them. Primarily, this system exists to allow fake ID’s to appreciate with time (so even starting with a cheap, decked SIN, it’s possible to build quite a good fake ID over time) and to give some notion of how much work is involved in creating a good fake ID.
| SIN quality | |
|---|---|
| Decked | 1 bp |
| Naturalized | 11 bp |
| Appropriated | 19 bp |
| Natural or Bulletproof | 29 bp |
| Records | |
| 1 year IRS records matching bank account activity and paying appropriate taxes | 1 bp |
| 1 year banking at a UCAS (or similar non-private) bank | 1 bp |
| 1 year of appropriate rent and utility bills (electricity, cable, newspaper, tridphone, Matrix, water...) | 1 bp |
| 1 year of data trail at a high school, college, university, apprenticeship, or job | 1 bp |
| Reporting income from “contract work” | 0 bp |
| Driver’s license | 1 bp |
| Passport | 3 bp |
| Student visa | 6 bp |
| Work visa | 10 bp |
| Link to Carib League private bank | 3 bp |
| Link to Swiss private bank | 6 bp |
| Link to Zurich-Orbital | 10 bp |
| Data trails and Living | |
| 1 year of living at Low lifestyle (data trail of minor purchases, neighbors willing to attest to your existence) | 1 bp |
| 1 year of living at Middle lifestyle | 2 bp |
| 1 year of living at High lifestyle | 3 bp |
| 1 year of living at Luxury lifestyle | 4 bp |
| 1 year at a public high school, junior/community college (academic details, professors remembering you, pictures in the yearbook), holding down a job at a tiny company (standard runner holding company) or for municipal government | 1 bp |
| 1 year at a private high school or state university, holding down a job at a large company or for state government | 2 bp |
| 1 year at an exclusive private school (Shining Bright in Denver) or good university (MIT&T, Oxford, Stanford), holding down a job at megacorporation or for the federal government | 3 bp |
| Served as prominent, public figure (professor, teacher, CEO, mayor, senator) | ×2 bp |
| Bad stuff | |
| Arrest record at FBI, per arrest | -1 bp |
| Arrest record at FBI, per convicted misdemeanor | -3 bp |
| Arrest record at FBI, per convicted felony | -6 bp |
| Bank transaction large enough to get a credstick at the next higher quality rating (without good documentation explaining it) | -1 bp |
| Per year of bank transactions not matching IRS records | -1 bp |
| Per year of blatantly unreported income | -2 bp |
| Per year gap in records | -2 bp |
| Failing a background check | Varies |
| Depositing a block of “tagged” cred | Varies |
| Passing an investigation | + 3 × (log ¥ - 2) bp |
Failing a background check can result in anything from no change (they spotted something suspicious but were unable to verify it) to sudden audits by the IRS to arrest and complete invalidation of the ID. Assume failure to pay taxes is a felony (as per “arrest record” above) and wing it from there. Use your best judgment as to the nature of the character’s fake ID. Consider the deposit of tagged cred in suspicious quantities to trigger an investigation.
On the other hand, if someone survives a professional investigation that leaves a data trail in its own right without any dirt being dug up, this improves a fake ID’s quality based on the logarithm of the amount of nuyen that was spent on the investigation. (Thus, spending 1,000¥ will improve the ID by 3 bp, 10,000¥ by 6 bp, 100,000¥ by 9 bp, and so on.) For purposes of this system you cannot spend less than 100¥ on an investigation. High-rated fake ID’s have often been through professional investigations precisely to generate the appropriate sorts of data trails— if a verification service provider records that someone has spent 100,000¥ on investigating someone else’s background to no avail, most folks will be daunted. (Subverting a VSP is quite expensive and difficult, since their professional reputation is staked on their reliability. However, this is why the best fake ID’s cost in the millions of nuyen...)
If a forged data trail can be found out through the simple expedient of querying backups, use 50% of the total bp value, rounded down.
If you have the kind of connections it takes to get a diplomatic passport, noble title, consulship, and so on, your ID will be valid. If you have the official databases of another country vouching for you, the worst thing that can happen (officially) is someone will connect you with a crime and have you deported. (However, “shot while trying to escape” still happens, especially if the law enforcement agency doesn’t think there’ll be much of a formal protest over your death...)