5 ms·
One thing I don't see mention regarding the existing US ACH (or whatever interbank) system is that there is absolutely no verification or security in this syste
by harikb 6y ago
One thing I don't see mention regarding the existing US ACH (or whatever interbank) system is that there is absolutely no verification or security in this system. Just like verification of paper check signature and a whole lot of other financial items - most banks allow anything until questioned. The easiest and cost effective way is to let it happen and reimburse for failures.
1. I have linked a non-joint account in my name at bank A to another (non-joint) account of my wife at bank B (accidentally) without any verification of any kind. I call BS on anyone claiming they magically checked the home address link or know we are married.
2. I have walked in to my bank and did a wire transfer of a large amount without any kind of verification. They didn't check my ID. I am not kidding. I did enter my ATM card and PIN. Then why do they have a $500 or $1000 limit at ATM. If someone did get my ATM card and PIN, they just had to appear confident and walk in to the branch. This is one of the largest banks in the US.
3. Because my wife doesn't like to deal with customer service of various financial items (credit-cards, 401k etc). I regularly call and just say I am her (clearly feminine name) and the conversation carries on as if nothing is surprising/suspicious.
4. On the other extreme, IRS's "MyIRS" site let us authenticate yourself (first time setup) using a security question that allows one to type any financial account number. CC, Bank, 401k, whatever. I mean how tf did they get all that data on me? legally? Why does IRS need my CC number?
IMHO, the only thing keeping us secure is that nobody from outside US has really tried to mess around with US banks.
- ragona 6y agoRegarding your last sentence, I think that’s true for, well, basically the entire world. Our security sucks in general. Humans aren’t as mean as they seem, or maybe they just generally suck at it.
- harikb 6y agoI was only expecting something like OTP enforced by bank (not a choice by customer). Yes, I get the SMS / insecure transport problem, but other countries do this.
- illektr1k 6y agoYou guys might enjoy https://en.wikipedia.org/wiki/Truth-default_theory https://en.wikipedia.org/wiki/Truth-default_theory
- ragona 6y agoOh that’s neat, I did enjoy it. Thanks. It makes sense to me. Lying is work. Humans usually take the easiest path. Sometimes lying is less work than actual work and then humans lie.
- Reelin 6y ago> Our security sucks in general. Don't forget to account for physical enforcement.
- ragona 6y agoOh I don’t. All digital security problems are eventually physical security problems.
- swiley 6y agoI'm pretty sure they at least authenticate the sftp connection for the ach transfers.
- zie 6y agoYes, for the bank I deal with, we GPG encrypt and sign the ACH transfer file, and then we send across scp/sftp where both sides have known public keys. Both are rotated regularly. I imagine many banks operate similarly, but I can't say that for certain.
- champtar 6y agoI'm curious if the GPG signature is properly checked. There is no easy way to validate a GPG signature (ie fail if the file is not signed by X), you have to use a verbose machine mode and look for a specific string. GPG will happily decrypt a non signed file also, so there are many ways to misuse GPG, and many of them are SO top answers ;)
- zie 6y agoWell I know my side is checked :) I've never tried to send a not properly signed file, however. GPG is indeed a mess, but it's not like there are awesome alternatives, really.
- deleted 6y ago[deleted]
- alasdair_ 6y agoRegarding #3, having a bank agent state on a recorded call “well, you don’t sound female” seems like a good way to get sued by a protected class.
- ConcernedCoder 6y agothat's not discrimination, might be a bit insulting, but that's not against the law...
- alasdair_ 6y agoThere are a lot of federal regulations that ensure equal access to banking based on ethnicity, gender and veteran status. If the bank in question has literally never dealt with federal funds (e.g. FHA mortgages) then they may be exempt but this does not apply to most consumer banks. EDIT: The Equal Credit Protection Act and the Fair Housing Act explicitly covers gender and sex as protected classes. Very few consumer banks in the US are not covered by these acts.
- TomMarius 6y agoI had that happen to me while doing the same (trying to get my girlfriend off insurance she didn't want). I said I am ill and that was it, I had to know her 'birth number' though (date of birth + four numbers). Am European.
- aiethicsthread 6y agoWhich? Trans people aren't a protected class in the US.
- kube-system 6y agoYou are mistaken. If it wasn't clear about what 'sex' meant in the Civil Rights Act of 1964, it was made more clear a couple of months ago: https://en.wikipedia.org/wiki/Bostock_v._Clayton_County https://en.wikipedia.org/wiki/Bostock_v._Clayton_County
- dragonwriter 6y ago
- toomuchtodo 6y ago> On the other extreme, IRS's "MyIRS" site let us authenticate yourself (first time setup) using a security question that allows one to type any financial account number. CC, Bank, 401k, whatever. I mean how tf did they get all that data on me? legally? Why does IRS need my CC number? Credit reporting agency and data broker data. It’s legal and it’s used by the IRS to perform identity proofing so threat actors don’t defraud the US Treasury with fraudulent refund requests using bogus return data.
- harikb 6y agoWhile I get the credit reporting agency angle, it was far more slick than typical credit verification question. A single field to enter the account number! You don’t even have to say what that number is for.
- sneak 6y agoThe FBI receives every payment card swipe in the United States, in real-time, with no warrant. This has been going on for at least a decade. There is approximately zero financial privacy in the US.
- BurningFrog 6y agoIs this a public fact or an accusation?
- hossbeast 6y agoDo you have a source for this?
- iudqnolq 6y ago> For credit cards, agents can get real-time information on a person’s purchases by writing their own subpoena, followed up by a order from a judge that the surveillance not be disclosed. You implied both that there is no oversight and that it is bulk collection. Both are not supported by your source, which says there is some oversight by a judge and that the FBI manually requests data on specific individuals. It may be a violation of civil liberties, but it doesn't support your claim.
- techsupporter 6y ago> They didn't check my ID. I am not kidding. I did enter my ATM card and PIN. If this is the bank I think it is, once you inserted your card and entered your (valid) PIN, the teller was shown the color scan of your ID card that you presented when you opened the account. The teller then uses this to compare to you without you handing over a (possibly-faked) ID card. That is why this bank will periodically ask you to provide a new copy of your ID.
- harikb 6y agoThat is a fair point. It just felt too simple for a large transaction. I guess I should be happy at how easy it was.
- paulie_a 6y agoI have never been asked for ID outside of opening an account and it was not scanned in at any point.
- microcolonel 6y agoI don't think either TD Canada Trust (Canada) or TD Bank (US) have ever photographed or scanned my ID, nor have they ever asked to update them.
- Reelin 6y ago> there is absolutely no verification or security in this system Regarding 1, 2, & 4: You aren't taking the physical angle into account. In all of these cases it sounds to me like one US institution dealing with another. Wire fraud is a federal crime. All US institutions collect a fair bit of identifying information when you open an account. Good luck fraudulently transferring money into an account you control and getting away with it. Regarding 2: They probably verified a picture of you that they had on file without you realizing it. Moreover, it's safe to assume the bank lobby was absolutely carpeted in cameras. I expect you would be unlikely to successfully commit fraud with this approach.
- el-salvador 6y ago> just say I am her (clearly feminine name) and the conversation carries on as if nothing is surprising/suspicious. A friend that works on a call center for a US bank told me they are not able to ask about the caller's gender, like when the perceived voice/gender and name don't match. They may report the call to the fraud department if the conversation is suspicious though.
- knorker 6y agoA lot of security in banking is the ability to reverse and track/audit the transactions. This is what cryptocurrency people ignore. They see reversing as a bug, when it's clearly not. Let's say you abuse linking, and you take money. Great. The tx is reversed and you go to jail. Prevention is better, but it's not that the security isn't there.
- Broken_Hippo 6y agoRegarding #3: In general - from my time working at a phone company call center some years back - it is a much better indicator of security to ask folks to verify some account information than to try to say someone is doing something fraudulent by judging whether or not the sound of their voice matches what I think it should sound like based on their name. Verifying information tends to mean that the person has permission to speak about it. A lot of companies will let folks 'authorize' someone to speak on an account, set up a password, or simply allow her to tell them to talk to you and hand the phone to you. If you call from her personal phone, that is another step to verify as well. Trying to judge someone's voice doesn't add security, though. Some folks don't have voices that can be classed as one gender: Some folks voices simply are deeper or higher than expected. Not to mention that some folks are transgender, which does mean that sometimes the voice won't match outward appearance or perceived gendered name. Some folks have health issues that make their voices seem deeper or higher as well. They could have just though you were old, too. Sometimes older voices are more unisex. To complicate things even more, parents name their children non-gendered names and some names have switched genders over the years. And to add another layer: Foreign names can sound like they "belong" to a gender they aren't traditionally used for.
- pricechild 6y agoRelated, though not necessarily in reply: HSBC in the UK have a system they call "Voice ID" which claims to authenticate you by your voice: https://www.hsbc.co.uk/ways-to-bank/phone-banking/ https://www.hsbc.co.uk/ways-to-bank/phone-banking/ I've not enrolled...
- Broken_Hippo 6y agoYeah, I don't blame you. What if I have a strong head cold? Can folks that mimic voices trick it? Fingerprints are fairly unique, but not necessarily special to you and only you. I really don't know if voice is even that special or if this is more like a car door lock: It's ok so long as there is enough verification.
- kevincox 6y agoI was just talking to my transgender friend and she much more frequently gets questioned after she changed her name which is a bit frustrating for her. I'm not saying that it can be used as a tip-off for extra verification but the real solution is to use a strong authenticator in the first place and not worry about these "softer" details.
- SamuelAdams 6y agoRegarding 3, securing against well-informed attackers (ie, family or spouses) is really difficult. They have access to their partner's phone, know their last four addresses, have their email on an iPad, so on and so forth. Bruce discusses the challenges with it in a recent paper [1]. Really interesting and worth a read, IMO. [1]: https://www.schneier.com/academic/paperfiles/Privacy_Threats_in_Intimate_Relationships.pdf https://www.schneier.com/academic/paperfiles/Privacy_Threats...