43 ms·

I don't see it as a technical solution, but fixing a broken process.

na85 8y ago
But the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal. Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.
- hunter2_ 8y ago
  If a (insert centralized service here) friend tells me about a change of plans, and I know that messages with that contact were successful in the past, then plans indeed changed because it's spoof-proof so long as you didn't make friends with two accounts that end up sharing a name and so long as the sender didn't fall victim to phishing of creds. If an email from a contact comes in, the from/sender headers can be spoofed without anyone having fallen victim yet, so maybe plans didn't really change. Yes there are social aspects but there is also this plainly technical aspect.
  - na85 8y ago
    All you've done is moved the problem from your organization to theirs. Phishing can still pwn you.
    - hunter2_ 8y ago
      True, but making credential theft a prerequisite is helpful.
- scott_s 8y ago
  Yes, the problem is people on the paying side not realizing that payment change requests are fraudulent. So a better process removes people on the paying side routinely changing payment information. Require that payees sign into a separate service and they change the payment information themselves.
  - na85 8y ago
    Again I think that just slapping a new service in there doesn't address the fundamental problem which is that the university did not conduct sufficient verification of payment details before sending out 12 million dollars. All it would have taken is a phone call to the company's accounting department confirming the change. "Verification of changes to banking details as a service" is not the answer. It's a Band-Aid solution.
    - scott_s 8y ago
      And my perspective is that as long as you have a process where administrative staff are making the changes, they will cut corners. For them, these transfers are routine. They do dozens every month. You need a process which removes them from the loop.

na85 8y ago

But the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal. Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.

hunter2_ 8y ago
If a (insert centralized service here) friend tells me about a change of plans, and I know that messages with that contact were successful in the past, then plans indeed changed because it's spoof-proof so long as you didn't make friends with two accounts that end up sharing a name and so long as the sender didn't fall victim to phishing of creds. If an email from a contact comes in, the from/sender headers can be spoofed without anyone having fallen victim yet, so maybe plans didn't really change. Yes there are social aspects but there is also this plainly technical aspect.
- na85 8y ago
  All you've done is moved the problem from your organization to theirs. Phishing can still pwn you.
  - hunter2_ 8y ago
    True, but making credential theft a prerequisite is helpful.
scott_s 8y ago
Yes, the problem is people on the paying side not realizing that payment change requests are fraudulent. So a better process removes people on the paying side routinely changing payment information. Require that payees sign into a separate service and they change the payment information themselves.
- na85 8y ago
  Again I think that just slapping a new service in there doesn't address the fundamental problem which is that the university did not conduct sufficient verification of payment details before sending out 12 million dollars. All it would have taken is a phone call to the company's accounting department confirming the change. "Verification of changes to banking details as a service" is not the answer. It's a Band-Aid solution.
  - scott_s 8y ago
    And my perspective is that as long as you have a process where administrative staff are making the changes, they will cut corners. For them, these transfers are routine. They do dozens every month. You need a process which removes them from the loop.