6 ms·
If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and s
by jimrandomh 11y ago
If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and said you still had it, would put a fraud alert on the account and stop all further attempts to social engineer customer service.
But most companies aren't anywhere near that careful.
- hueving 11y agoMany people (including me) don't answer from unknown numbers, so that wouldn't work.
- stestagg 11y agoIt wouldn't work /for you/. But for people who do answer their phone, it would add protection.
- bigger_cheese 11y agoPossibly but you'd want to be damn sure it was actually the bank calling you. What's to stop a scammer claiming to be from the bank calling you. "Hi I'm from bank xxxx calling to warn about some potentially fraudulent transactions we've detected on your credit card before we can continue please answer a few security questions to verify your identity." I suspect some people would fall for that and tell the 'bank' their personal details.
- WorldMaker 11y agoI've yelled at most of my banks for cold calling me exactly like that. My response is, "Can this be corrected online? Otherwise, I will call the 800 number myself and if you could provide any specifics that might speed up that next call I would appreciate." In the past I've also sent letters to bank security teams not to cold call and ask for personal details. One of my banks actually switched to a standard recorded message that ends in a "Please call our 1-800 number at your earliest convenience." Better.
- tomschlick 11y agoA text message / email might though. Just saying "Your account has been flagged for a lost/stolen phone which you use as your 2FA. Please contact support if this is not correct."
- deleted 11y ago[deleted]
- mcintyre1994 11y agoWouldn't that allow somebody who stole your phone to lock you out of your bank if they answered the call? Seems like that'd make a stressful situation potentially worse if thieves knew they could do that. Especially if they called from a number that's linked to the bank anywhere and something like Google's dialer surfaces who it is - your bank calling seems like a potential "maybe I can get more" for a thief so they might be inclined to answer and impersonate.
- deleted 11y ago[deleted]
- jimrandomh 11y agoI would prefer that my bank, if it detects fraudsters trying to pull some sort of trick involving my account, to freeze things until I show up and present ID. That's inconvenient, but clearly better than the alternative.
- zyxley 11y agoSo... what about banks with no actual physical branches?
- jimrandomh 11y agoIn an ideal world, the bank would direct you to a notary public who would check your identity and public key fingerprint. (Sadly, the present state of things is probably too dysfunctional to manage that.)
- hibikir 11y agoBanks would never do that, if just because they'd risk losing business in places where there's no local branches. Many of the national banks that offer the best conditions have no presence in a lot of metro areas. And even if you make sure your bank has a local branches (which really, I've not gone to one in years, why would I need one?), what happens when you are on a trip, and your accounts are frozen? I've had my CCs frozen because the bank considered my expenses during a trip to be potentially fraudulent, but I could clear it up over the phone. Do we have to devolve back to carrying thousands in cash, like in the old days? Security is always a tradeoff between avoiding fraud and being usable, and the tradeoffs that are great for some people in some situations are unacceptable for others.
- ryanlol 11y agoJust DoS the phone then?