7 ms·

CapitalOne is even worse -they locked me out of their app today and asked to send an SMS code - and they let you pick which number to send it to on the spot. Go

CapitalOne is even worse -they locked me out of their app today and asked to send an SMS code - and they let you pick which number to send it to on the spot. Good one fellas. What is the point of having Touch ID and their dumb Swift ID stuff set up if they keep doing dumb stuff like this.

ThePowerOfFuet 7y ago
Why haven't you gotten the hell out then?
- csomar 7y ago
  Honestly, what is a good US bank that has a great web/mobile experience, a large financial offering (checking, credit, savings, investment, etc...), great customer support, a good presence internationally, reasonable and no hidden fees.. wait there is none.
  - choward 7y ago
    It's the same bank that doesn't send you spam emails which make you used to receiving unsolicited communication from your bank. These emails make it easier to sneak in phishing emails. That's why I use that bank.
  - enjo 7y ago
    USAA fits that bill for me.
    - SkyMarshal 7y ago
      Isn't USAA restricted to military or spouse/child of military?
      - lcall 7y ago
        For insurance and banking I think, but not for investing and maybe some other services, it seems.
        lcall 7y ago
        Correcting myself in case anyone reads this: that seems to have been true in the past but they are moving investing to charles schwab and victory capital (separate companies). So long-term I wish I knew if that is nearly as good as not in the ways that matter for this discussion. https://debtfreegeek.org/2017/09/22/become-usaa-member-even-arent-military/ https://debtfreegeek.org/2017/09/22/become-usaa-member-even-... https://www.usaa.com/inet/wc/investments-update?akredirect=true https://www.usaa.com/inet/wc/investments-update?akredirect=t...
  - zachberger 7y ago
    Schwab? I've been using them for about 2 years and have no complaints now.
    - mcny 7y ago
      previously, on hn: https://news.ycombinator.com/item?id=8783790 https://news.ycombinator.com/item?id=8783790 https://archive.fo/xPtn5 https://archive.fo/xPtn5
      - zachberger 7y ago
        I don't think it's fair to assume weaknesses from 6 years ago still persist. * I just tried to login with the first 8 characters of my password and it was not successful. * Also this password is autogenerated and contains plenty of special characters. * Their 2FA system no longer depends on the concatenation of password + token. Also this reminds me of another HN discussion[1], which basically boiled down to the question of "Do you really think the only thing the bank does to log people on is to check the username and password?" I certainly hope not. [1] - https://news.ycombinator.com/item?id=20998548 https://news.ycombinator.com/item?id=20998548
  - jedberg 7y ago
    They all fit that description. If you're rich. Put a few hundred thousand in the bank and you'll get all that stuff for free!
  - PascLeRasc 7y ago
    Robinhood for checking/direct deposit/ATM access and small DIY investments, Wealthfront for retirement accounts and savings/emergency fund, Apple Card for payments. Beautiful interfaces, non-SMS 2FA on all, fantastic customer service. I do this and I can’t think of anything else I’d need. The only fee I pay here is Wealthfront’s 0.25% management fee, but I don’t mind since it’s such a great service.
    - the_pwner224 7y ago
      Robinhood is a brokerage but they deposit uninvested balance into normal banks so they are FDIC insured and pay interest, and you get a physical MasterCard debit card. Used to be 1.8% but the coronavirus happened and now it's 0.3% :( They use normal TOTP for 2FA so it'll work with whatever authentication software you use. However they follow the modern tech trend of not having live tech support; you have to email them for support. But I've heard response times have gotten better recently. I moved most of my money into RH for the interest, but still maintain Chase checking and credit card accounts. For sonething as important as banking, there's no substitute to having tons of physical locations with humans. For example I recently went to the bank to deposit tax refunds, which were not 'normal' checks. I don't think you can even deposit normal checks into RH. And I trust Chase's fraud protection systems more than RH.
- jedieaston 7y ago
  Is there a US bank (national, not a local credit union) that allows you to use TOTP, U2F and backup codes as your sole 2FA sources? Heck, the US Government lets you do it now (https://login.gov https://login.gov), you think that BofA would...
  - fossuser 7y ago
    I think Fidelity does allow this, but I haven't bothered with it since I use a password manager. Fidelity has a brokerage account, free checks, free ATM withdrawals via debit card, maybe also your 401k, free money wires, automatic investment etc. The only thing they don't have are branches where you can deposit cash, but that's really never necessary - in an extreme case you can open another bank account, deposit cash, transfer to fidelity and immediately close it. I'm not sure why anyone uses a bank other than Fidelity.
    - imajoo 7y ago
      Fidelity does it through either SMS or Symantec’s Validation and ID Protection (VIP) Access app. I called and asked if they support another app and they said they don't. Why they couldn't use another (read: non-Symantec) 2FA is beyond me.
      - fossuser 7y ago
        Ah that's lame, I saw the 2FA app support and assumed it would be any app.
      - notyourday 7y ago
        Symantec's VIP is so weird. I can't wrap by head around needing to provide the unique ID to set it up. How is that generated by the phone?
  - dpifke 7y ago
    radiusbank.com does.
  - pixel16 7y ago
RJIb8RBYxzAMX9u 7y ago
Google does this too when you sign in from "unknown" locations, if you don't have 2FA configured. I think the purpose is to slow down bots. If you try reusing the same number in quick succession on different accounts, Google won't let you. I'm so glad I'm out of the family tech support "business"; if only firing real customers were so easy...
- ladberg 7y ago
  This really bugs me. I have throwaway Google accounts that I don't want to add my phone number to, so I can only access them from the location I created them.
  - RJIb8RBYxzAMX9u 7y ago
    Enabling 2FA should stop this from happening. Adding TOTP as your 2nd factor would require adding a recovery number, but maybe you can remove it after. I have accounts that has TOTP 2FA w/o recovery number, but perhaps they were grandfathered in. Alternatively, use a physical token as the 2nd factor, then no recovery number is required.
  - markdown 7y ago
    How do you even create a Google account without a phone number?
    - ladberg 7y ago
      I made the account while ago and it let me, I guess they don't let you anymore though
    - zxcvbn4038 7y ago
      You can't create a Google account without a phone number (at least last I tried), however once you enable a 2FA method other then SMS you can then delete the phone number. To their credit the phone numbers I gave to Google when setting up my accounts have never shown up in any of the usual law enforcement or skip trace databases so I'm less apprehensive about opening new accounts with them. T-Mobile sells me out once a year - I don't even give them my real name, they must get it from my credit card or something. This year I used a fake name "authorized user" card, still waiting to see if that keeps my latest number out of the databases or not, around nine months to go.
trazire 7y ago
I believe that when Capital One does that they somehow match your name and address to the phone number. A VOIP or prepaid number doesn't seem to work.
- hunter2_ 7y ago
  Correct. I spoke with their digital team recently and got the low-down. Your full name and the phone number you type in is compared (not sure what entity does this comparison) with the telco billing records that also obviously have your name and number paired. In my case I only have a business cell phone which was problematic to use with my personal Capital One account for step-up auth. It's disgusting to think about the record sharing, and I doubt it even protects against SIM swapping (or does it?).
  - chrischen 7y ago
    You could still setup a new phone plan with a fake ID.

ThePowerOfFuet 7y ago

Why haven't you gotten the hell out then?

csomar 7y ago
Honestly, what is a good US bank that has a great web/mobile experience, a large financial offering (checking, credit, savings, investment, etc...), great customer support, a good presence internationally, reasonable and no hidden fees.. wait there is none.
- choward 7y ago
  It's the same bank that doesn't send you spam emails which make you used to receiving unsolicited communication from your bank. These emails make it easier to sneak in phishing emails. That's why I use that bank.
- enjo 7y ago
  USAA fits that bill for me.
  - SkyMarshal 7y ago
    Isn't USAA restricted to military or spouse/child of military?
    - lcall 7y ago
      For insurance and banking I think, but not for investing and maybe some other services, it seems.
      - lcall 7y ago
        Correcting myself in case anyone reads this: that seems to have been true in the past but they are moving investing to charles schwab and victory capital (separate companies). So long-term I wish I knew if that is nearly as good as not in the ways that matter for this discussion. https://debtfreegeek.org/2017/09/22/become-usaa-member-even-arent-military/ https://debtfreegeek.org/2017/09/22/become-usaa-member-even-... https://www.usaa.com/inet/wc/investments-update?akredirect=true https://www.usaa.com/inet/wc/investments-update?akredirect=t...
- zachberger 7y ago
  Schwab? I've been using them for about 2 years and have no complaints now.
  - mcny 7y ago
    previously, on hn: https://news.ycombinator.com/item?id=8783790 https://news.ycombinator.com/item?id=8783790 https://archive.fo/xPtn5 https://archive.fo/xPtn5
    - zachberger 7y ago
      I don't think it's fair to assume weaknesses from 6 years ago still persist. * I just tried to login with the first 8 characters of my password and it was not successful. * Also this password is autogenerated and contains plenty of special characters. * Their 2FA system no longer depends on the concatenation of password + token. Also this reminds me of another HN discussion[1], which basically boiled down to the question of "Do you really think the only thing the bank does to log people on is to check the username and password?" I certainly hope not. [1] - https://news.ycombinator.com/item?id=20998548 https://news.ycombinator.com/item?id=20998548
- jedberg 7y ago
  They all fit that description. If you're rich. Put a few hundred thousand in the bank and you'll get all that stuff for free!
- PascLeRasc 7y ago
  Robinhood for checking/direct deposit/ATM access and small DIY investments, Wealthfront for retirement accounts and savings/emergency fund, Apple Card for payments. Beautiful interfaces, non-SMS 2FA on all, fantastic customer service. I do this and I can’t think of anything else I’d need. The only fee I pay here is Wealthfront’s 0.25% management fee, but I don’t mind since it’s such a great service.
  - the_pwner224 7y ago
    Robinhood is a brokerage but they deposit uninvested balance into normal banks so they are FDIC insured and pay interest, and you get a physical MasterCard debit card. Used to be 1.8% but the coronavirus happened and now it's 0.3% :( They use normal TOTP for 2FA so it'll work with whatever authentication software you use. However they follow the modern tech trend of not having live tech support; you have to email them for support. But I've heard response times have gotten better recently. I moved most of my money into RH for the interest, but still maintain Chase checking and credit card accounts. For sonething as important as banking, there's no substitute to having tons of physical locations with humans. For example I recently went to the bank to deposit tax refunds, which were not 'normal' checks. I don't think you can even deposit normal checks into RH. And I trust Chase's fraud protection systems more than RH.
jedieaston 7y ago
Is there a US bank (national, not a local credit union) that allows you to use TOTP, U2F and backup codes as your sole 2FA sources? Heck, the US Government lets you do it now (https://login.gov https://login.gov), you think that BofA would...
- fossuser 7y ago
  I think Fidelity does allow this, but I haven't bothered with it since I use a password manager. Fidelity has a brokerage account, free checks, free ATM withdrawals via debit card, maybe also your 401k, free money wires, automatic investment etc. The only thing they don't have are branches where you can deposit cash, but that's really never necessary - in an extreme case you can open another bank account, deposit cash, transfer to fidelity and immediately close it. I'm not sure why anyone uses a bank other than Fidelity.
  - imajoo 7y ago
    Fidelity does it through either SMS or Symantec’s Validation and ID Protection (VIP) Access app. I called and asked if they support another app and they said they don't. Why they couldn't use another (read: non-Symantec) 2FA is beyond me.
    - fossuser 7y ago
      Ah that's lame, I saw the 2FA app support and assumed it would be any app.
    - notyourday 7y ago
      Symantec's VIP is so weird. I can't wrap by head around needing to provide the unique ID to set it up. How is that generated by the phone?
- dpifke 7y ago
  radiusbank.com does.
- pixel16 7y ago

RJIb8RBYxzAMX9u 7y ago

Google does this too when you sign in from "unknown" locations, if you don't have 2FA configured. I think the purpose is to slow down bots. If you try reusing the same number in quick succession on different accounts, Google won't let you. I'm so glad I'm out of the family tech support "business"; if only firing real customers were so easy...

ladberg 7y ago
This really bugs me. I have throwaway Google accounts that I don't want to add my phone number to, so I can only access them from the location I created them.
- RJIb8RBYxzAMX9u 7y ago
  Enabling 2FA should stop this from happening. Adding TOTP as your 2nd factor would require adding a recovery number, but maybe you can remove it after. I have accounts that has TOTP 2FA w/o recovery number, but perhaps they were grandfathered in. Alternatively, use a physical token as the 2nd factor, then no recovery number is required.
- markdown 7y ago
  How do you even create a Google account without a phone number?
  - ladberg 7y ago
    I made the account while ago and it let me, I guess they don't let you anymore though
  - zxcvbn4038 7y ago
    You can't create a Google account without a phone number (at least last I tried), however once you enable a 2FA method other then SMS you can then delete the phone number. To their credit the phone numbers I gave to Google when setting up my accounts have never shown up in any of the usual law enforcement or skip trace databases so I'm less apprehensive about opening new accounts with them. T-Mobile sells me out once a year - I don't even give them my real name, they must get it from my credit card or something. This year I used a fake name "authorized user" card, still waiting to see if that keeps my latest number out of the databases or not, around nine months to go.

trazire 7y ago

I believe that when Capital One does that they somehow match your name and address to the phone number. A VOIP or prepaid number doesn't seem to work.

hunter2_ 7y ago
Correct. I spoke with their digital team recently and got the low-down. Your full name and the phone number you type in is compared (not sure what entity does this comparison) with the telco billing records that also obviously have your name and number paired. In my case I only have a business cell phone which was problematic to use with my personal Capital One account for step-up auth. It's disgusting to think about the record sharing, and I doubt it even protects against SIM swapping (or does it?).
- chrischen 7y ago
  You could still setup a new phone plan with a fake ID.