3 ms·
> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch yo
by notyourday 7y ago
> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank.
Switch your bank.
Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you.
If you are going to reach out to anyone, reach out to the OCC.
- carapace 7y agohttps://www.occ.treas.gov/ https://www.occ.treas.gov/ ?
- notyourday 7y agoYes
- rasikjain 7y agoThanks for clarification. Wasn't aware of OCC.
- pc86 7y agoDoes storing passwords using two-way encryption violate some OCC regulation?
- notyourday 7y agoIt is about what you are optimizing for. You, a customer, notifying a bank would probably do nothing. You, a bank customer, filing a formal complaint with a banking regulator triggers procedures to handle it that a regulator has which in turn triggers handling procedures that a bank has. You do not complain that the bank stores passwords in cleartext. Instead you complain that the bank does not adequately safeguard information needed to access your account from the third parties with the example being the customer service agent being able to see not only your ID ( which they can and need to do their job ) but also your password ( which they do not need to access ). So not only the customer service agent can access your account while on-duty in the call center via a special system but also can either themselves or via another party access the bank account as if it were you.