5 ms·

No bank should be sending cards to an address not on file - that is a major fraud risk 101 issue right there.

by temp667 6y ago

BugsJustFindMe 6y ago
It was "on file" as soon as I gave it to them after verifying my identity.
- vkou 6y ago
  I too can verify your identity. All I need is your first name, last name, date of birth, and last four digits of your SSN. Which are all floating around the darknet in one of the dozens of large data breaches American companies have had over the years. Should I be able to get your replacement credit card delivered to my home address with that?
  - BugsJustFindMe 6y ago
    Account changes by phone involve a password and 2FA like everything else. Try again.
    - brewdad 6y ago
      What bank is this? None of my half dozen credit cards have this. None of them even support 2FA on the web to the best of my knowledge.
    - vkou 6y ago
      Neither my primary bank nor my primary credit union support 2FA. If you're conditioned to give your password to your bank over the phone, I can use those three piece of information, and will happily call you up, posing as a bank CS representative. If you think you're smart enough to not fall for that, let's suppose for a moment that you may be right. But what about your 76-year-old grandmother? Is she going to consistently be able to make a determination between a legitimate, and a fraudulent bank CS representative who wants her to confirm her username and password? Or is she going to have an easier time in a world where you never, ever, ever, ever give another human being your password over the phone? Do you want convenience, or security? Actually, the better question is, does your bank want convenience for you, or security for them? (Because they are ultimately on the hook for fraud)
      - eertami 6y ago
        >If you think you're smart enough to not fall for that What? Seriously? There's nothing to fall for here. You should never trust an inbound call. If your bank calls you, you take their information, immediately hang up, find the banks phone line and call that number back yourself.
        vkou 6y ago
        The scam goes as follows. 'We have detected fraudulent activity, call us back with the number on the card.' You hang up. They don't. You pick up the phone, and dial the number on the card. Depending on how landline phone routing works in your area, you hanging up does not end the call. You picking up the phone again resumes the previous call, you dialing some numbers does nothing, the scammer makes some telephony noises, and goes ahead and resumes their conversation with you. Nothing to fall for, eh? Also, please keep in mind, we are apes. The logical centers of our brains turn off when your bank calls you to tell you that you are being robbed. Especially if your mind isn't as sharp as it used to be.
        eertami 6y ago
        I literally do not know a single person with a landline, so I cannot say if that is remotely true or not. I'll take your word for it. But what I am 100% sure of is that you could make any telephony noises you like down my phone and you will not succeed getting access to my banking details. You'd probably have better luck calling the bank and trying to persuade them.
        vkou 6y ago
        The point isn't making the telephony noises, the point is that most people have no idea that in certain situations, hanging up the phone and dialing a new number does not actually dial a new number. It sounds like you didn't know about this, for instance. And again, this isn't about you. Most of the time, you don't pay for fraud, the bank does. That means that your bank is incentevised to reduce fraud, at the expense of your convenience - because not all of their customers are as smart as you are.
  - Nextgrid 6y ago
    My response to another comment would be relevant here too: https://news.ycombinator.com/item?id=26433737 https://news.ycombinator.com/item?id=26433737 > Both your and the parent's points are valid. Identity verification is a hard problem that the major legacy banks have a big problem with. Their processes are both extremely annoying and can fail and lock out the legitimate account owner (the reason many of you have had trouble replacing cards abroad is because "shipping to a previously known address" is itself a security measure) while at the same time being vulnerable to a targeted attack from someone with knowledge of how the process works.
elliekelly 6y ago
And in the US they can’t issue a debit card within 30 days of an address change without specifically verifying the change is legitimate: https://www.ecfr.gov/cgi-bin/text-idx?SID=a04646f38f28731e83133780c9b877ba&mc=true&node=se16.1.681_12&rgn=div8 https://www.ecfr.gov/cgi-bin/text-idx?SID=a04646f38f28731e83...
amznthrwaway 6y ago
American Express will absolutely send replacements while traveling. I’ve had them send replacement cards to my hotel without problem.

No bank should be sending cards to an address not on file - that is a major fraud risk 101 issue right there.

BugsJustFindMe 6y ago

It was "on file" as soon as I gave it to them after verifying my identity.

vkou 6y ago
I too can verify your identity. All I need is your first name, last name, date of birth, and last four digits of your SSN. Which are all floating around the darknet in one of the dozens of large data breaches American companies have had over the years. Should I be able to get your replacement credit card delivered to my home address with that?
- BugsJustFindMe 6y ago
  Account changes by phone involve a password and 2FA like everything else. Try again.
  - brewdad 6y ago
    What bank is this? None of my half dozen credit cards have this. None of them even support 2FA on the web to the best of my knowledge.
  - vkou 6y ago
    Neither my primary bank nor my primary credit union support 2FA. If you're conditioned to give your password to your bank over the phone, I can use those three piece of information, and will happily call you up, posing as a bank CS representative. If you think you're smart enough to not fall for that, let's suppose for a moment that you may be right. But what about your 76-year-old grandmother? Is she going to consistently be able to make a determination between a legitimate, and a fraudulent bank CS representative who wants her to confirm her username and password? Or is she going to have an easier time in a world where you never, ever, ever, ever give another human being your password over the phone? Do you want convenience, or security? Actually, the better question is, does your bank want convenience for you, or security for them? (Because they are ultimately on the hook for fraud)
    - eertami 6y ago
      >If you think you're smart enough to not fall for that What? Seriously? There's nothing to fall for here. You should never trust an inbound call. If your bank calls you, you take their information, immediately hang up, find the banks phone line and call that number back yourself.
      - vkou 6y ago
        The scam goes as follows. 'We have detected fraudulent activity, call us back with the number on the card.' You hang up. They don't. You pick up the phone, and dial the number on the card. Depending on how landline phone routing works in your area, you hanging up does not end the call. You picking up the phone again resumes the previous call, you dialing some numbers does nothing, the scammer makes some telephony noises, and goes ahead and resumes their conversation with you. Nothing to fall for, eh? Also, please keep in mind, we are apes. The logical centers of our brains turn off when your bank calls you to tell you that you are being robbed. Especially if your mind isn't as sharp as it used to be.
        eertami 6y ago
        I literally do not know a single person with a landline, so I cannot say if that is remotely true or not. I'll take your word for it. But what I am 100% sure of is that you could make any telephony noises you like down my phone and you will not succeed getting access to my banking details. You'd probably have better luck calling the bank and trying to persuade them.
        vkou 6y ago
        The point isn't making the telephony noises, the point is that most people have no idea that in certain situations, hanging up the phone and dialing a new number does not actually dial a new number. It sounds like you didn't know about this, for instance. And again, this isn't about you. Most of the time, you don't pay for fraud, the bank does. That means that your bank is incentevised to reduce fraud, at the expense of your convenience - because not all of their customers are as smart as you are.
- Nextgrid 6y ago
  My response to another comment would be relevant here too: https://news.ycombinator.com/item?id=26433737 https://news.ycombinator.com/item?id=26433737 > Both your and the parent's points are valid. Identity verification is a hard problem that the major legacy banks have a big problem with. Their processes are both extremely annoying and can fail and lock out the legitimate account owner (the reason many of you have had trouble replacing cards abroad is because "shipping to a previously known address" is itself a security measure) while at the same time being vulnerable to a targeted attack from someone with knowledge of how the process works.

elliekelly 6y ago

And in the US they can’t issue a debit card within 30 days of an address change without specifically verifying the change is legitimate: https://www.ecfr.gov/cgi-bin/text-idx?SID=a04646f38f28731e83133780c9b877ba&mc=true&node=se16.1.681_12&rgn=div8 https://www.ecfr.gov/cgi-bin/text-idx?SID=a04646f38f28731e83...

amznthrwaway 6y ago

American Express will absolutely send replacements while traveling. I’ve had them send replacement cards to my hotel without problem.