4 ms·

I've had my bank call me, wanting to talk about something important (I think it was loan payment that didn't go through or something of that sort) and the first

I've had my bank call me, wanting to talk about something important (I think it was loan payment that didn't go through or something of that sort) and the first thing they said was: "This is Bank XYZ and I'm calling to inform you of something. But before we do that you have to prove your identity. Can you tell me what your account number is?" I said: "I'd be happy to, but first can you prove your identity to me? After all, you're the one that called me" What followed was a hilarious discussion where they were unable to prove anything to me (for example, telling me something about my account that only I would know) because they're not allowed to tell anything to me until I proved who I am. Finally I told them that I'd be happy to call them back and I asked them where I can find the number to call. I was obviously not going call a number the person would give me. They didn't know how to find the number to the customer service, so I found it myself and called back. When they answered, I explained the situation but obviously there was no way to actually get in touch with the person with whom I had spoken earlier, and the person that I did speak to didn't know what the topic was. I asked them to call me back. Well, they did eventually called me back, but what was the fist thing they asked after they did? "We need you prove your identity, can you tell me XXXX?" They've stopped doing this now, and the mest recent thing they called me to inform me about something they just went to the point right away. I wonder if I've been flagged as someone who doesn't need verification or if they changed their policy.

doikor 6y ago
For my bank they just send a verification request to the app (or web page using your one time code book if you prefer that) to verify who you are. So basically the same process as logging into the bank and/or verifying payments.
- lokedhs 6y ago
  Correct me if I misunderstood, but that sounds insecure. I imagine an attack where someone attempts to log in to your Internet bank account, and at the same time calls you and tells you that they are the bank and that they have sent you a notification on the phone to confirm this. You accept the notification on the phone and all of a sudden they're not just logged in to your Internet bank, but also on the phone with you, with you trusting that they are indeed the bank. The only way I see that this could be avoided is if they provide you with a verification code that will appear on your phone.
  - doikor 6y ago
    The verification app does tell you what the verification request is for. Also you can't really do anything in the bank without verifying yourself again (basically any change/write requires you to approve again) Basically in the app you see if the verification is for logging in, providing strong auth for some service, approving transfer of X euros from Y account to account Z, etc In general we have had really well working online banking since the late 90s here in Finland (first versions are actually from the early 80s where you dialed directly to the bank instead of your ISP with your modem). Haven't really heard of any major security flaws ever so they do have a really good track record. This is also why the governments attempt at creating their own strong auth service failed. The banks already effectively provide that and everyone is used to using them.

doikor 6y ago

For my bank they just send a verification request to the app (or web page using your one time code book if you prefer that) to verify who you are. So basically the same process as logging into the bank and/or verifying payments.

lokedhs 6y ago
Correct me if I misunderstood, but that sounds insecure. I imagine an attack where someone attempts to log in to your Internet bank account, and at the same time calls you and tells you that they are the bank and that they have sent you a notification on the phone to confirm this. You accept the notification on the phone and all of a sudden they're not just logged in to your Internet bank, but also on the phone with you, with you trusting that they are indeed the bank. The only way I see that this could be avoided is if they provide you with a verification code that will appear on your phone.
- doikor 6y ago
  The verification app does tell you what the verification request is for. Also you can't really do anything in the bank without verifying yourself again (basically any change/write requires you to approve again) Basically in the app you see if the verification is for logging in, providing strong auth for some service, approving transfer of X euros from Y account to account Z, etc In general we have had really well working online banking since the late 90s here in Finland (first versions are actually from the early 80s where you dialed directly to the bank instead of your ISP with your modem). Haven't really heard of any major security flaws ever so they do have a really good track record. This is also why the governments attempt at creating their own strong auth service failed. The banks already effectively provide that and everyone is used to using them.