4 ms·
2. At no time where the bank's existing systems compromised technically. This isn't really true. Banks don't view their systems as servers -- rather a "system"
by oasisbob 15y ago
2. At no time where the bank's existing systems compromised technically.
This isn't really true. Banks don't view their systems as servers -- rather a "system" is the technical bits, plus the controls and overall policies. If a bank allows someone else to use your credentials and transfer funds, it's a compromise. They have a responsibility to authenticate the user, not the credentials.
As tptacek points out, the bank was in violation of the FFIEC mandate for strong online authentication. They didn't have sufficient controls to correctly authenticate the client for this level of a transaction.
- tptacek 15y agoTo be precise, I don't think the FFIEC has a "mandate" for two-factor auth, and I'm not sure how toothy any such mandate would be. But the bank is required by the UCC to exercise commercially reasonable controls, and I don't think you can consider "commercially reasonable" controls that are: (a) Specifically called out by the FFIEC as inadequate to the task of protecting ACH transfers (b) Roundly decried as inadequate by practically every large regional bank in the country (c) The technical focus of massive deployments of reputational and two-factor systems at banks around the country.