6 ms·
The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud. They aren't out to "dest
by wyck 9y ago
The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud.
They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.
- joshgel 9y agoWhich banks should you choose? How do you decide?
- swsieber 9y agoI would refine that question: does anybody know of a competent rater that evaluates and rates banks based on security?
- closeparen 9y agoThe ACH model is fundamentally insecure: anyone who knows your account number can pull money from it, and the protocol makes no allowance for the bank to check with you first. I don't think choice of bank matters very much. You can manage your risk somewhat by: 1) Using credit and not debit cards for day to day spending. 2) Maintaining your long term wealth in separate accounts at separate institutions and not linking them directly to anything except your checking account. This minimizes what can be stolen if your checking account is compromised, and makes it less likely that your savings can be stolen directly (account number is used in fewer places). 3) Turning on all the alerting and notification settings you can find, so that you'll hear about unauthorized activity immediately.
- aptwebapps 9y agoI read somewhere that companies that do a lot of ACH payments use different accounts for receiving and sending payments. The receiving account is locked so that it can't send and the sending account is supposed to stay secret. I don't know if that actually works in practice, though.
- creepydata 9y agoIf you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."
- aptwebapps 9y agoACH transfers, not paper checks.
- creepydata 9y agoYeah but for 90%+ of transactions, if you are being paid by a company, you can almost always request a paper check instead of an ACH transfer (sometimes with a fee). In that case they either have yet another account for check writing (which won't be "secret") or they give away their "secret" ACH account.
- aptwebapps 9y agoI'm not proposing this as the solution to fix the extremely outdated ACH/check system, just relaying what I read about what some companies do.
- llukas 9y agoWhy they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.
- closeparen 9y agoACH is a service of the Federal Reserve, actually. It also provides wire transfers, which are a little more secure because they're push only, but also less secure because they're instantaneous and irreversible. All banks charge at least ~$15 per transaction and they're really only used for high value, time sensitive deals.
- 0898 9y agoJeremy Clarkson made a similar argument and even published his bank details. Then this happened: http://news.bbc.co.uk/1/hi/7174760.stm http://news.bbc.co.uk/1/hi/7174760.stm
- llukas 9y agoNot sure about UK but in Poland direct debit is something you need to manually enable and pay small fee for it. And even if you enable it someone needs to forge your signature under direct debit order to allow someone to charge you. So still no.
- FabHK 9y agoFor SEPA (Single European Payment Area) direct debits, you have 8 weeks to get a full and immediate refund. I'd assume that holds for the UK as well. Many companies (and individuals) in Europe publish their account numbers on their letter head and website, it really isn't a big deal. Anything else seems security by obscurity.
- PeterisP 9y agoFor SEPA-DD, 8 weeks is for no questions asked refund; in general for non-authorised payments you have 13 months to request a refund, but if it's 8+ weeks they can verify the lack of direct debit mandate before hand - but it seems to be the policy of most banks that they'll refund anyway immediately and let the merchant handle the problems.
- Spooky23 9y agoSecurity always sucks. The differentiation is response. That usually means a small regional bank or midsize credit union. If you have enough dollars, a private bank type thing works too.
- kakarot 9y agoThe real answer is to not use SMS as a 2FA. That was never ever a good idea.
- knowaveragejoe 9y agoWhat is better? Authenticator apps/hardware devices?
- msh 9y agoAuthenticators are fine but u2f keys are better because they protect against phishing.
- potatolicious 9y agoNot to mention you lose your Authenticator if you upgrade/lose/break your phone, but U2F keys are (practically) forever.
- davchana 9y agoThats exactly why I copy and save every 2fa QR Code in my KeePass database, along with backup codes. Phone changed? No worries, install Google Auth, rescan those QRs, and voila, your 2fa system is back and running !! :)
- ArlenBales 9y agoMost 2FA services that allow authenticators offer recovery codes. I keep the recovery code saved in my password manager, and if I ever lost my phone I use that to log into the site and then get a new QR code.
- davchana 9y agoYes, that's also a way, but why not save the QR code first time you see it, instead of loosing it, resetting with recovery code, and then again getting a new one? Recovery codes are fine, and should be kept safe and such, but also the Original QR code can also be saved and screenshot. That way, phone lost? open database, load QR code, scan in new phone.