10 ms·

I had a long argument with HSBC UK Security a few years ago where I was completely unable to get the to understand they were putting their customers at risk. I

I had a long argument with HSBC UK Security a few years ago where I was completely unable to get the to understand they were putting their customers at risk. In the event that something looked strange on your account the 'HSBC Fraud Department' would text you and ask them to call you on a phone number. A phone number that didn't appear anywhere on their website. "We don't want it public. OK,well at least put it on a non-linked page so that if you SEARCH for the number on the website search tool, it returns a page with the number on "Well, I suppose that's an idea I could pass on". Even when I said to them "You are training your customers to accept potentially fraudulent text messages" they didn't get it. Infuriating.

ajsnigrutin 5y ago
Bank phone numbers should be written on the back of credit/debit cards (and in a lot of countries, they are). "A fraudulent transaction has been detected on your credit card no. *1234, please call the number written on the back of your card", and you're done.
- BiteCode_dev 5y ago
  Unless the fraudulent transaction is due to the fact you just lost your credit card.
  - burnished 5y ago
    The important part is that you are able to look up/personally verify that you are contacting the correct people. If I lose my card I can still look up the right number on my banks website. Because you cannot confidently identify a caller it is better for the customer to reach out using more easily verified information.
  - ajsnigrutin 5y ago
    Well yeah.. but again, the number could also be in the footer of the banks website. People usually get scammed when they have the card with them... when they lose the card, they're the one actively looking for a phone number, and not presented with one from a scammer.
    - BiteCode_dev 5y ago
      - "Sir, I'm calling you because I found your card, I called your bank, and they gave me your number. They told me you should report the card as lost in case it's been used fraudulently with the phone number that is written at the back of the card" - "Can you send me back the card?" - "I'm in a train, I won't be able to do that for a while. You should really call" - "But I don't have the number" - "I can read it to you" Pwn
      - ajsnigrutin 5y ago
        But for this, you must lose a card, not realize you lost it, a scammer must find your card, and he must somehow get your phone number to scam you.
      - mnw21cam 5y ago
        Red flag number 1 - my bank wouldn't give someone random my telephone number. That would be illegal.
        lazide 5y ago
        Good thing there are no data leaks or compromises! /s That my bank insists on using essentially now public information now to verify (and refuses to use anything else, even after being repeatedly asked!) is also infuriating. Last 4 of SSN and DOB? Really?
        mnw21cam 5y ago
        Well, the point isn't that my bank wouldn't "leak" my details - I certainly don't trust them that far. So it's absolutely possible for a random person to get my phone number from the bank. But if a random person were to phone me and tell me that my bank gave them my phone number to be helpful, I'd be calling that out as a lie.
        lazide 5y ago
        If someone spoofs the banks number on caller ID (trivial), knows all your security question answers, the bank you bank with, and your number - very few people are NOT going to fall for some kind of attack there correct?
  - Vrondi 5y ago
    That number should also be on every single billing statement you've ever received from them, so you know, check that paper or pdf.
  - kube-system 5y ago
    If my bank has blocked fraudulent transactions for a card I've lost, I'm not in much hurry to respond. They've already blocked it, and I don't have the card to use anyway.
pfranz 5y ago
US credit card companies aren't any better. I recently had a similar "fraud alert." The company ditched travel notices in 2016 claiming their AI was good enough to replace it. A few weeks after traveling I had a very small purchase flagged (under $20 at a place like Target). When I called the number they asked me for my complete credit card number, social security number, they didn't know my phone number or email and had to clarify which was my first and last name. They then asked me to photograph my drivers license and text it to them. When I told them I wasn't comfortable doing this, they reiterated that this was the only way my credit card would be restored immediately and once I hung up the phone I would no longer have this option. They did give me another way to verify, they would send me an email to a web portal I could upload the photos to. After uploading I would have to wait 7-10 business days for them to review and restore my card. Thankfully, I had another credit card I could use. I did submit via the web form after doing my best to make sure it was legit. Weeks later my credit card wasn't restored. When I later called them, it was immediately restored after a few simple questions. I sent an email to their security department describing how weird and sketchy this process was and I never got a response.
- easton 5y ago
  Not all US credit card companies are like this. I specifically remember a few years ago that my Mom got a call from AMEX about some fraud on her card, to which she responded “I never get calls from you, how do I know this is real?”. They said no problem, just hang up and call the number on the back of your card. I believe some banks even skip the call entirely, and just prompt you to call the number on the card.
  - djhworld 5y ago
    On traditional landline phones that older folk tend to use (although I guess that's dwindling every year) a common tactic for scammers is to ask the victim to call the number on the back of the card. However the scammers don't hang up they just play a fake dial tone so the victim dials the number thinking they're contacting their bank but they're actually just speaking to the scammers again
flyinghamster 5y ago
And don't get me started on banks sending out emails chock full of "Click this link!" It's like they're setting people up to get phished.
- distances 5y ago
  I have three bank accounts and none of them send emails with links. If they send any email to start with, they just say go read your messaging/documents on your bank account.
- kevincox 5y ago
  For most banks it is fine. They say "Click this link" I click it, then click "Login" and everything is fine. Other banks purposely break my password manager so I have a high chance of pasting my password into a phishing site because I am in a habit of pasting my password for that bank.
mdp2021 5y ago
In theory, you would first call your bank consultant to verify the number is legitimate. (Supposing the existence of a process which is not completely broken.)
jvvw 5y ago
I have also had that with HSBC -if you call the main online banking number they will put you through but it involves being shunted around on hold. The thing I found most annoying was the attitude of the HSBC representatives when I said (very politely) that I wanted to call back.
- reaperducer 5y ago
  The thing I found most annoying was the attitude of the HSBC representatives when I said (very politely) that I wanted to call back Because they poor person on the phone gets dinged for not completing the transaction. You doing the right thing causes them to look bad in the computer-tallied automated productivity tracking tool. Call center employee metrics are absolutely brutal.
valdiorn 5y ago
I had a similar experience from HSBC. They called me about a potential fraudulent claim. They asked for my DOB, card number, sort code, you know, to verify "that I am who I say"... all the stuff they SHOULDN'T ask, and stupidly I gave it all up. To be fair, I did because my card had been rejected literally 30 seconds before while trying to make a purchase. But it was only after the phone call ended that I realised what I had done. I phoned them back on a number listed on their website, asked them to confirm that I had indeed spoken with HSBC fraud detection, and they confirmed. I then lambasted them for asking me all the questions they tell their customers never to answer. They're just training their customers to give out information, and even alert customers like myself can sometimes have a moment of panic and comply.
- mytailorisrich 5y ago
  In fairness HSBC calls from known numbers (granted, you may not recognise it the first time, but you can look it up then save it) and publishes numbers where you can call them [1] [1] https://www.hsbc.co.uk/help/security-centre/report-a-problem/#card-missing-stolen https://www.hsbc.co.uk/help/security-centre/report-a-problem...
  - kabdib 5y ago
    This doesn't help when it's so common to spoof caller-id. The telco industry has blown any trust we can put in this information. [I just learned that the FCC is considering not allowing calls made outside the US to be spoofed as numbers originating inside the US. I thought that was the whole point behind STIR/SHAKEN, silly me].
    - mytailorisrich 5y ago
      It does help because you can call back if you recognise the number (which defeats spoofed caller ID) or call the number published. There's not really any alternative to calling a trusted number.
  - skeeter2020 5y ago
    If I don't care that you can redial the displayed number and get me this doesn't matter when I spoof my outgoing number though...
MrBuddyCasino 5y ago
If I was talking to employees of the "Mexican drug cartel money laundering corporation", I too would be disappointed they don't give a shit.
anpago 5y ago
Hopefully this trial 159 scheme takes off one simple number to call regardless of bank. https://www.moneysavingexpert.com/news/2021/09/stop--hang-up--and-call-159-if-you-re-worried-about-bank-scam-ca/ https://www.moneysavingexpert.com/news/2021/09/stop--hang-up... I mentioned to a fewer older family members and they were all for a simple number to call.
- alasdair_ 5y ago
  Reminds me of the “now there are 14 standards” xkcd.
ksdale 5y ago
In the US, we had a medical provider who, when they would call you to give you test results, would attempt to get you to verify your identity by telling them part of you social security number. Haha, you called me! How do I know you're who you say you are?
mhandley 5y ago
Natwest seems to have taken to sending me text messages listing three recent transactions (where one is suspicious to them), and asking did you make these? Reply y or n. I can't verify that the text is from Natwest, but it seems relatively safe, as I'm not providing any personal information in return, so this seems a reasonable first line security mechanism. Of course someone could clone my SIM, in which case there's no protection, but it does raise the bar for using a stolen cards, and I think that's the intent. If my bank ever does call me, they have to leave voicemail because I don't answer calls from unknown numbers. And then I call back using the number on the back of the card.
optimalsolver 5y ago
>Even when I said to them "You are training your customers to accept potentially fraudulent text messages" they didn't get it. You were talking to a call centre worker making close to minimum wage and who's job is to get shouted at by customers all day. Even if they wanted to help you, their opinion would count for nothing. No wonder they didn't give a shit.

ajsnigrutin 5y ago

Bank phone numbers should be written on the back of credit/debit cards (and in a lot of countries, they are). "A fraudulent transaction has been detected on your credit card no. *1234, please call the number written on the back of your card", and you're done.

BiteCode_dev 5y ago
Unless the fraudulent transaction is due to the fact you just lost your credit card.
- burnished 5y ago
  The important part is that you are able to look up/personally verify that you are contacting the correct people. If I lose my card I can still look up the right number on my banks website. Because you cannot confidently identify a caller it is better for the customer to reach out using more easily verified information.
- ajsnigrutin 5y ago
  Well yeah.. but again, the number could also be in the footer of the banks website. People usually get scammed when they have the card with them... when they lose the card, they're the one actively looking for a phone number, and not presented with one from a scammer.
  - BiteCode_dev 5y ago
    - "Sir, I'm calling you because I found your card, I called your bank, and they gave me your number. They told me you should report the card as lost in case it's been used fraudulently with the phone number that is written at the back of the card" - "Can you send me back the card?" - "I'm in a train, I won't be able to do that for a while. You should really call" - "But I don't have the number" - "I can read it to you" Pwn
    - ajsnigrutin 5y ago
      But for this, you must lose a card, not realize you lost it, a scammer must find your card, and he must somehow get your phone number to scam you.
    - mnw21cam 5y ago
      Red flag number 1 - my bank wouldn't give someone random my telephone number. That would be illegal.
      - lazide 5y ago
        Good thing there are no data leaks or compromises! /s That my bank insists on using essentially now public information now to verify (and refuses to use anything else, even after being repeatedly asked!) is also infuriating. Last 4 of SSN and DOB? Really?
        mnw21cam 5y ago
        Well, the point isn't that my bank wouldn't "leak" my details - I certainly don't trust them that far. So it's absolutely possible for a random person to get my phone number from the bank. But if a random person were to phone me and tell me that my bank gave them my phone number to be helpful, I'd be calling that out as a lie.
        lazide 5y ago
        If someone spoofs the banks number on caller ID (trivial), knows all your security question answers, the bank you bank with, and your number - very few people are NOT going to fall for some kind of attack there correct?
- Vrondi 5y ago
  That number should also be on every single billing statement you've ever received from them, so you know, check that paper or pdf.
- kube-system 5y ago
  If my bank has blocked fraudulent transactions for a card I've lost, I'm not in much hurry to respond. They've already blocked it, and I don't have the card to use anyway.

pfranz 5y ago

US credit card companies aren't any better. I recently had a similar "fraud alert." The company ditched travel notices in 2016 claiming their AI was good enough to replace it. A few weeks after traveling I had a very small purchase flagged (under $20 at a place like Target). When I called the number they asked me for my complete credit card number, social security number, they didn't know my phone number or email and had to clarify which was my first and last name. They then asked me to photograph my drivers license and text it to them. When I told them I wasn't comfortable doing this, they reiterated that this was the only way my credit card would be restored immediately and once I hung up the phone I would no longer have this option. They did give me another way to verify, they would send me an email to a web portal I could upload the photos to. After uploading I would have to wait 7-10 business days for them to review and restore my card. Thankfully, I had another credit card I could use. I did submit via the web form after doing my best to make sure it was legit. Weeks later my credit card wasn't restored. When I later called them, it was immediately restored after a few simple questions. I sent an email to their security department describing how weird and sketchy this process was and I never got a response.

easton 5y ago
Not all US credit card companies are like this. I specifically remember a few years ago that my Mom got a call from AMEX about some fraud on her card, to which she responded “I never get calls from you, how do I know this is real?”. They said no problem, just hang up and call the number on the back of your card. I believe some banks even skip the call entirely, and just prompt you to call the number on the card.
- djhworld 5y ago
  On traditional landline phones that older folk tend to use (although I guess that's dwindling every year) a common tactic for scammers is to ask the victim to call the number on the back of the card. However the scammers don't hang up they just play a fake dial tone so the victim dials the number thinking they're contacting their bank but they're actually just speaking to the scammers again

flyinghamster 5y ago

And don't get me started on banks sending out emails chock full of "Click this link!" It's like they're setting people up to get phished.

distances 5y ago
I have three bank accounts and none of them send emails with links. If they send any email to start with, they just say go read your messaging/documents on your bank account.
kevincox 5y ago
For most banks it is fine. They say "Click this link" I click it, then click "Login" and everything is fine. Other banks purposely break my password manager so I have a high chance of pasting my password into a phishing site because I am in a habit of pasting my password for that bank.

mdp2021 5y ago

In theory, you would first call your bank consultant to verify the number is legitimate. (Supposing the existence of a process which is not completely broken.)

jvvw 5y ago

I have also had that with HSBC -if you call the main online banking number they will put you through but it involves being shunted around on hold. The thing I found most annoying was the attitude of the HSBC representatives when I said (very politely) that I wanted to call back.

reaperducer 5y ago
The thing I found most annoying was the attitude of the HSBC representatives when I said (very politely) that I wanted to call back Because they poor person on the phone gets dinged for not completing the transaction. You doing the right thing causes them to look bad in the computer-tallied automated productivity tracking tool. Call center employee metrics are absolutely brutal.

valdiorn 5y ago

I had a similar experience from HSBC. They called me about a potential fraudulent claim. They asked for my DOB, card number, sort code, you know, to verify "that I am who I say"... all the stuff they SHOULDN'T ask, and stupidly I gave it all up. To be fair, I did because my card had been rejected literally 30 seconds before while trying to make a purchase. But it was only after the phone call ended that I realised what I had done. I phoned them back on a number listed on their website, asked them to confirm that I had indeed spoken with HSBC fraud detection, and they confirmed. I then lambasted them for asking me all the questions they tell their customers never to answer. They're just training their customers to give out information, and even alert customers like myself can sometimes have a moment of panic and comply.

mytailorisrich 5y ago
In fairness HSBC calls from known numbers (granted, you may not recognise it the first time, but you can look it up then save it) and publishes numbers where you can call them [1] [1] https://www.hsbc.co.uk/help/security-centre/report-a-problem/#card-missing-stolen https://www.hsbc.co.uk/help/security-centre/report-a-problem...
- kabdib 5y ago
  This doesn't help when it's so common to spoof caller-id. The telco industry has blown any trust we can put in this information. [I just learned that the FCC is considering not allowing calls made outside the US to be spoofed as numbers originating inside the US. I thought that was the whole point behind STIR/SHAKEN, silly me].
  - mytailorisrich 5y ago
    It does help because you can call back if you recognise the number (which defeats spoofed caller ID) or call the number published. There's not really any alternative to calling a trusted number.
- skeeter2020 5y ago
  If I don't care that you can redial the displayed number and get me this doesn't matter when I spoof my outgoing number though...

MrBuddyCasino 5y ago

If I was talking to employees of the "Mexican drug cartel money laundering corporation", I too would be disappointed they don't give a shit.

anpago 5y ago

Hopefully this trial 159 scheme takes off one simple number to call regardless of bank. https://www.moneysavingexpert.com/news/2021/09/stop--hang-up--and-call-159-if-you-re-worried-about-bank-scam-ca/ https://www.moneysavingexpert.com/news/2021/09/stop--hang-up... I mentioned to a fewer older family members and they were all for a simple number to call.

alasdair_ 5y ago
Reminds me of the “now there are 14 standards” xkcd.

ksdale 5y ago

In the US, we had a medical provider who, when they would call you to give you test results, would attempt to get you to verify your identity by telling them part of you social security number. Haha, you called me! How do I know you're who you say you are?

mhandley 5y ago

Natwest seems to have taken to sending me text messages listing three recent transactions (where one is suspicious to them), and asking did you make these? Reply y or n. I can't verify that the text is from Natwest, but it seems relatively safe, as I'm not providing any personal information in return, so this seems a reasonable first line security mechanism. Of course someone could clone my SIM, in which case there's no protection, but it does raise the bar for using a stolen cards, and I think that's the intent. If my bank ever does call me, they have to leave voicemail because I don't answer calls from unknown numbers. And then I call back using the number on the back of the card.

optimalsolver 5y ago

>Even when I said to them "You are training your customers to accept potentially fraudulent text messages" they didn't get it. You were talking to a call centre worker making close to minimum wage and who's job is to get shouted at by customers all day. Even if they wanted to help you, their opinion would count for nothing. No wonder they didn't give a shit.