4 ms·
> Only thing missing was reading out the OTP, obviously, which I would not have done. This is the real red flag here. No workflow that I'm aware of ever has yo
by ohazi 5y ago
> Only thing missing was reading out the OTP, obviously, which I would not have done.
This is the real red flag here. No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field.
- deleted 5y ago[deleted]
- chime 5y agoLast week I had to call Wells Fargo to change my home address. They texted me a code to read it back to them to confirm my identity. Their standard text messages for auth codes say: Wells Fargo will NEVER call or text you for this code. DON'T share it. Enter code 123456 online to send $1.00. Their verification text said: Free Msg: Use Wells Fargo verification code 123456 to verify your identity. Reply STOP to stop msgs. Call 1-800-869-3557 if you didn't request this code.
- underwater 5y agoIt should explicitly say that the code is intended to be shared with one.
- JumpCrisscross 5y ago> No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field If I place a large wire with my bank, they text me a code and ask me to read it back to them. Granted, I will only do that if I initiated the call.
- jrib 5y agoWhen calling banks and even telcos, their sop to verify identity seems to be to request you to read one of these codes