3 ms·

This isn't actually a tech problem. It is a business process problem. Likely don't even need to replace much SIM related tech (encryption, authentication) to do

This isn't actually a tech problem. It is a business process problem. Likely don't even need to replace much SIM related tech (encryption, authentication) to do so. Most of it is better procedures and protection from social engineering and fraud. Faulty procedures and just plain bad basic security practices. The bar is so low that if you wrote up and suggested the current system as a plan for some homework assignment you'd likely fail. Probably get told to rework it and you might scrape by with a pass. So there are two aspects: 1) Basic confirmation steps are seen as weakly performed. 2) Obvious steps are left out. The fact that its a revelation for them for the need to notify banks that a sim swap occurred is just one example. Really? No one thought that banks would be interested at all? Just how inexperienced are the people designing these processes? And the swap itself. Please tell me that mother's maiden[0] name is not used or that they don't put a lot of faith in using a birthdate as a secret. Details you might find on Facebook/Google etc should only be used to confirm which Fred Smith's account is being modified. Not whether it is Fred authorising the change. This is a great way to see into the underlying technical debt that likely exists elsewhere in their systems. If they are this sloppy here then other aspects are likely just as bad. [0] "Maiden", really, it is the 21st century!

closeparen 7y ago
>The fact that its a revelation for them for the need to notify banks that a sim swap occurred is just one example. Really? No one thought that banks would be interested at all? If I lose my phone, I call Verizon to move service over to last year's model sitting in a drawer somewhere. It'd be very surprising and creepy if Chase somehow knew about or acted on this change. > Please tell me that mother's maiden[0] name is not used or that they don't put a lot of faith in using a birthdate as a secret. On that customer service call, I have to give an account PIN. According to them, if I don't know it I have to come into a retail store with photo ID. That seems pretty sensible. But it's not bulletproof. Probably at least one retail store employee would take a sufficiently large bribe to skip the ID verification step.
- rs23296008n1 7y ago
  Each their own. In general, I'd also like a away of knowing when a SIM swap attempt occurred. An SMS would be fine. And I'd like my bank to know when a swap occurred for basic fraud detection. Don't need them to know necessarily which mobile provider, but I'd appreciate a way to prevent all my accounts being cleared out the same or next day as a SIM swap. Even the simple act of the bank being able to know so they can temporarily raise security requirements for a few days. A way of registering who to notify on SIM swap would actually be useful. SIM swaps are only part of the picture. Still have PINs, authenticators, photo ID etc.
  - closeparen 7y ago
    For the cost of that integration, the bank could also just implement 2FA correctly. U2F, TOTP, even proprietary crap like Symantec VIP are all inherently resistant to SIM swaps because they keep a secret key on the actual device; PSTN routing doesn't matter.

closeparen 7y ago

>The fact that its a revelation for them for the need to notify banks that a sim swap occurred is just one example. Really? No one thought that banks would be interested at all? If I lose my phone, I call Verizon to move service over to last year's model sitting in a drawer somewhere. It'd be very surprising and creepy if Chase somehow knew about or acted on this change. > Please tell me that mother's maiden[0] name is not used or that they don't put a lot of faith in using a birthdate as a secret. On that customer service call, I have to give an account PIN. According to them, if I don't know it I have to come into a retail store with photo ID. That seems pretty sensible. But it's not bulletproof. Probably at least one retail store employee would take a sufficiently large bribe to skip the ID verification step.

rs23296008n1 7y ago
Each their own. In general, I'd also like a away of knowing when a SIM swap attempt occurred. An SMS would be fine. And I'd like my bank to know when a swap occurred for basic fraud detection. Don't need them to know necessarily which mobile provider, but I'd appreciate a way to prevent all my accounts being cleared out the same or next day as a SIM swap. Even the simple act of the bank being able to know so they can temporarily raise security requirements for a few days. A way of registering who to notify on SIM swap would actually be useful. SIM swaps are only part of the picture. Still have PINs, authenticators, photo ID etc.
- closeparen 7y ago
  For the cost of that integration, the bank could also just implement 2FA correctly. U2F, TOTP, even proprietary crap like Symantec VIP are all inherently resistant to SIM swaps because they keep a secret key on the actual device; PSTN routing doesn't matter.