How a Payment Lookup Oracle Confirms Predictable Identifiers

Abstract Acquisti and Gross (PNAS 2009) demonstrated that structured national identifiers such as the U.S. Social Security Number are predictable from public data. A prediction, however, cannot be confirmed: the attacker never learns which guess is correct. We show that a national payment resolution oracle (the lookup that turns a phone number or national ID into an account holder's name, deployed at population scale in Thailand's PromptPay and in comparable systems across Asia and, since 2025, the EU) supplies exactly the missing confirmation step. We quantify (i) how the structure of the Thai national ID and mobile numbering plan shrinks the candidate space by a factor of 135 before any target-specific information; (ii) how a redacted identifier is reduced to a small candidate set (at most 10^k for k hidden digits) that a single oracle query per candidate disambiguates; (iii) how composition with an existing leak of 1,263,268 indexed national IDs converts prediction into deterministic, liveness-checked identity confirmation; and (iv) why the partial-name masking recently adopted by Singapore is weak on its own terms, leaving a given name unique for 51% of a Thai corpus and a surname for 65.8%, so it blunts human display-harvesting but not oracle-backed confirmation. A direct measurement across the apps of seven Thai banks finds the recipient name returned in full, unmasked, in every case. All measurements are performed on the authors' own accounts under an ethics protocol that forbids any enumeration of third-party identifiers. We conclude with concrete, quantified recommendations for scheme operators.