5 ms·

> “In the background, they’re using the username with the forgot password feature, and that’s going to generate one of these two-factor authentication passcodes

> “In the background, they’re using the username with the forgot password feature, and that’s going to generate one of these two-factor authentication passcodes,” Otsuka said. “Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'” It seems like a simple mitigation on the bank's end would be to add warning text to the 2 factor authentication. "You have requested to change your password via our web portal at yourbank.com. If you did not request to change your password via the web portal, or if someone asked you to give them this number, then it is possible that someone pretending to be a bank representative is attempting to hack your account. The code to change your password is ..... Do not share this code with anyone."

gurchik 5y ago
The 2FA messages I get from my bank are already something like "Your security code is 0123456. Do not share with anyone. We will never call to ask for this code." But it wouldn't surprise me if victims are too scared to read it properly, so some improvement could be helpful. It doesn't help that other banks regularly ask for SMS codes over the phone, entraining into people to do it without thinking. I would personally feel a lot better if every bank had the ability to only allow 2FA via OTP, or only physical key, or even email. My bank uses a "Security Word" which is crazy to me.
- underwater 5y ago
  The scammers get you panicked and hold you in that state so that you're stressed out and not thinking rationally. They also exploit a small slip up and escalate it into a catastrophic one. For example the scam might start with the assumption that caller ID is accurate, or the assumption that because there is fraud on your account the person is actually from the "fraud department", or the assumption that hanging up a landline terminates the call. Each of those are small slipups, but they get people bought into the fiction, and then as the scam escalates they don't stop and think through the sequence and realise that the initial assumption was flawed.
rocqua 5y ago
Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think you are right. Binding 'signatures' to what you are authorizing is one of the ways to prevent your authorization from being re-used. There are parallels in cryptography where you sign not just data but also what it will be used for. Otherwise an attacker might reuse your signature.
jonathantf2 5y ago
Whenever I log into my mobile account I get the following texts 2 minutes apart, doesn't matter if I'm doing a SIM swap or just checking the bill. "SECURITY WARNING The one-time code you requested will arrive shortly. DO NOT give this code to anyone. If someone's calling you and asking for a code, they DO NOT work for O2. Call us on 202 if you suspect fraud so we can protect your account." "Be alert to fraud NEVER share this code, including with O2 staff. Help us protect your O2 account. To swap your sim, enter code 123456."

gurchik 5y ago

The 2FA messages I get from my bank are already something like "Your security code is 0123456. Do not share with anyone. We will never call to ask for this code." But it wouldn't surprise me if victims are too scared to read it properly, so some improvement could be helpful. It doesn't help that other banks regularly ask for SMS codes over the phone, entraining into people to do it without thinking. I would personally feel a lot better if every bank had the ability to only allow 2FA via OTP, or only physical key, or even email. My bank uses a "Security Word" which is crazy to me.

underwater 5y ago
The scammers get you panicked and hold you in that state so that you're stressed out and not thinking rationally. They also exploit a small slip up and escalate it into a catastrophic one. For example the scam might start with the assumption that caller ID is accurate, or the assumption that because there is fraud on your account the person is actually from the "fraud department", or the assumption that hanging up a landline terminates the call. Each of those are small slipups, but they get people bought into the fiction, and then as the scam escalates they don't stop and think through the sequence and realise that the initial assumption was flawed.

rocqua 5y ago

Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think you are right. Binding 'signatures' to what you are authorizing is one of the ways to prevent your authorization from being re-used. There are parallels in cryptography where you sign not just data but also what it will be used for. Otherwise an attacker might reuse your signature.

jonathantf2 5y ago

Whenever I log into my mobile account I get the following texts 2 minutes apart, doesn't matter if I'm doing a SIM swap or just checking the bill. "SECURITY WARNING The one-time code you requested will arrive shortly. DO NOT give this code to anyone. If someone's calling you and asking for a code, they DO NOT work for O2. Call us on 202 if you suspect fraud so we can protect your account." "Be alert to fraud NEVER share this code, including with O2 staff. Help us protect your O2 account. To swap your sim, enter code 123456."