4 ms·
I have had a terrible experience when dealing with banks in India. To open accounts for non resident customers(NRE), one has to scan and send ID proofs and Acco
by itissid 8y ago
I have had a terrible experience when dealing with banks in India. To open accounts for non resident customers(NRE), one has to scan and send ID proofs and Account Opening Forms over email. And they ask for all your details SSN, DoB, Address you name it. In a few instances the emails being sent were not even encrypted by the end server. The attack surface is so large that one cannot begin to imagine what exact audits they are running.
With sophisticated phishing attacks that are now hosted on HTTPs servers, this practice is just lunacy and it happens in every bank. Big small, private, public all engage in this nonsensical practice. Among the biggest names: SBI, YesBank, Central Bank are the ones that do this. I know this because I have inquired how to open accounts at these places.
I actually have a dedicated personal relationship manager who filled out all the forms! And even now for certain operations like booking currency forwards(FCNRs) they ask you to fill forms and send it over the email. Not to mention its inefficient as well.
Its a testament to two things:
1. There are so many people in India that banks just find it cheaper to hire a person and let him interface with you instead of designing a web application.
2. No one gives a shit about privacy.
3. The system is wide open for people to Man in the Middle and Phish.
- JumpCrisscross 8y agoI tried opening an NRE account to redeem some bonds a family member bought in my name. (Never managed it.) Their banker asked me for my SSN over WhatsApp. Forwarded to my New York State regulator, who promptly fined their New York office.
- diogenescynic 8y agoI’ve had similar experiences where Indian bankers have said their mailbox has a size limit or is full so the document needed to be emailed to their gmail or yahoo account. No thanks...
- whyever 8y agoI would be more comfortable with Whatsapp than with email, at least it's end-to-end encrypted.
- lmkg 8y agoIn Allegheny County (Pittsburgh), Pennsylvania, in order to apply for a marriage license you have to go to a government website where you enter your social security number into a form served over HTTP. When I saw that, I refused to use the online service and instead drove downtown, where it said I could apply in person. I was put in front of a computer with the same form pulled up, served over the public internet. Thanks to Equifax, it probably doesn't matter anymore ¯\_(ツ)_/¯
- itissid 8y agoWould blockchain be a good solution to the authentication problem? For example never disclose any PII to the Bank, but tell them that this is the person who he claims to be and is authorized to do X(i.e. a True/False answer for everything)?
- kalleboo 8y agoYou don't need a blockchain if you have a trusted third-party (such as the government, or a bank that has checked photo ID). In places like Sweden and Estonia there are digital ID systems that are run by banks or the government that could fulfill the role.
- A2017U1 8y agoIsn't the trusted third party the problem in this case? The original comment was about banks not properly securing PII. Not seeing how a public database fixes this, but the banks and big business disdain for security of other people's data is certainly a problem no matter the country.
- virtuabhi 8y agoHow do you secure SSN is US? I have to regularly enter SSN at random locations - department stores, USCIS applications, internet companies, office forms, outsourced office HR firms. I am pretty sure that sending SSN over HTTP makes no difference. The attack surface is already infinite.
- namibj 8y agoYou don't. You collect wages for the time you'd otherwise spend with your hobby but had to spend telling the bank they were dumb in small claims court. You just need to structure it suitably to not go over the limit for small claims court. I think the bank(s) would learn and communicate a flag among them to be particularly wary about ID proof when they think you are opening an account. You might need to also make sure to have something sufficiently easy to prove where you "lost" money each time they opened an account in your name. Alternatively, move somewhere where at least that is not a problem.
- ShabbosGoy 8y agoLook, I understand how frustrating that whole experience is. But would you rather have a shitty decentralized system that is almost good, or a centralized system that’s always good, except if you’re deemed undesirable by that system? Any sane, rational person will choose the former.