2 ms·

In the US at least, the bank is responsible for losses right? At what point do they begin to secure all this? I have a number of accounts and not one is tru

In the US at least, the bank is responsible for losses right? At what point do they begin to secure all this? I have a number of accounts and not one is true 2FA: only one is SMS, the rest are user/password only.

Cthulhu_ 6y ago
> At what point do they begin to secure all this? When the cost of fraud handling exceeds that of redoing their security, I guess. It'd have to be a 10x or more factor though, because companies seem to be quite accepting of existing / recurring costs. That said, my banks have had 2FA for a long time. The one started off 20 years ago with a device where you'd punch in the numbers on screen, it would give you some numbers back. The second version required you to insert your bank card, PIN, and the number on screen, while the website asked for your account number and card number. The third version that I'm using nowadays is pretty much the same, but instead of punching a code it has a camera that scans a color-QR code on screen. The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays. Both have mobile apps, and use PIN codes or Face ID for quick access. They know it's a higher risk than their 2FA solutions, so they limit the maximum amount that can be transferred (thus limiting their own damage). The limit has slowly increased over time as their security proved itself. In essence it's like an insurance policy, whose price changes depending on risks and track record.
- tushar-r 6y ago
  >The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays. One of the banks I use in India adds this grid to the back of your debit card. For higher value or non-usual transactions, they both ask for an SMS code and 3 values from the grid, in addition to the password to login to the netbanking site. The app allows you to get in with your fingerprint or a "quick access code", but these other factors kick for many transactions.
- imglorp 6y ago
  I would add that simply answering a ping on the account's SMS is emphatically NOT by itself 2FA.

Cthulhu_ 6y ago

> At what point do they begin to secure all this? When the cost of fraud handling exceeds that of redoing their security, I guess. It'd have to be a 10x or more factor though, because companies seem to be quite accepting of existing / recurring costs. That said, my banks have had 2FA for a long time. The one started off 20 years ago with a device where you'd punch in the numbers on screen, it would give you some numbers back. The second version required you to insert your bank card, PIN, and the number on screen, while the website asked for your account number and card number. The third version that I'm using nowadays is pretty much the same, but instead of punching a code it has a camera that scans a color-QR code on screen. The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays. Both have mobile apps, and use PIN codes or Face ID for quick access. They know it's a higher risk than their 2FA solutions, so they limit the maximum amount that can be transferred (thus limiting their own damage). The limit has slowly increased over time as their security proved itself. In essence it's like an insurance policy, whose price changes depending on risks and track record.

tushar-r 6y ago
>The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays. One of the banks I use in India adds this grid to the back of your debit card. For higher value or non-usual transactions, they both ask for an SMS code and 3 values from the grid, in addition to the password to login to the netbanking site. The app allows you to get in with your fingerprint or a "quick access code", but these other factors kick for many transactions.
imglorp 6y ago
I would add that simply answering a ping on the account's SMS is emphatically NOT by itself 2FA.