4 ms·

That would be nice if it worked. I had a call from my bank, and they before the they could even tell me what it was about, they asked me to answer some securit

That would be nice if it worked. I had a call from my bank, and they before the they could even tell me what it was about, they asked me to answer some security questions. When I pointed out out how ridiculous that was, and I asked them to prove their identity first, they didn't even have process for it. Calling back was also impossible since apparently there was no way to get connecter back to the person with whom I was speaking. I was unable to get back in touch with them, and a week later someone else called from the bank trying to do the same, and the same thing happened again. I refused to answer their security questions and they had no way to prove their identity. The next time they called, they didn't ask for the security questions anymore and just got to the point immediately. They have never asked for it since. I wonder if I'm flagged in their database as someone who shouldn't be asked security questions.

pdonis 5y ago
> That would be nice if it worked. It looks like you didn't even try it. In order to do what the GP described, when your bank calls you, you say nothing and answer nothing. You hang up and call back on a number you know. > Calling back was also impossible since apparently there was no way to get connecter back to the person with whom I was speaking. You don't have to. You just ask the bank when you call them back: did someone just call me a little bit ago? What about? If the bank can't answer that question, it's time to find another bank. Any reputable bank will be able to look at your file and see that a call was made to you and what the issue was. > The next time they called, they didn't ask for the security questions anymore and just got to the point immediately. They have never asked for it since. This does not look like success to me. It looks like failure. What your bank should be doing is sending you a message via some known channel--like the message center on their website, where you can see messages for you when you log in--telling you that there is an issue that you need to call them about. If you're giving information to someone who calls you out of the blue and says they're from your bank, you're setting yourself up to be scammed.
- lokedhs 5y ago
  > It looks like you didn't even try it. In order to do what the GP described, when your bank calls you, you say nothing and answer nothing. You hang up and call back on a number you know. I did do exactly that. I asked them for a reference that I could give when I call back. They couldn't give me that. I then did try to call them back, and said "someone called me about something just now, what was it?" and they were not able to tell me. > If the bank can't answer that question, it's time to find another bank. Thankfully, that's not my normal bank. This was the bank that has by car loan. That's my only interaction with them. It's unlikely I'll have more business with them. > This does not look like success to me. It looks like failure. Absolutely. This along with the other issues suggests that they value convenience over security. Also, this is not a small bank we're talking about. I have never seen issues this bad with other banks, but the problem is that when there are banks that get away with this, that suggests people in general do not make a fuss about it and simply accepts whatever people tell them on the phone. If nothing else, it proves why phone scams work. If the bank didn't even have an answer when I asked them to authenticate themselves, that suggests very few people even ask.
  - pdonis 5y ago
    > I asked them for a reference Asked who? The people who called you out of the blue and you weren't sure it was legit? I wasn't recommending that at all. I said, explicitly, that you say nothing and answer nothing when you are the recipient of the call. You only say or ask anything when you are the one who initiated the call, to a number that you already know via some other information channel belongs to the bank. > I then did try to call them back, and said "someone called me about something just now, what was it?" and they were not able to tell me. Did they say there was any issue with your account? If there wasn't, then that would indicate that the previous call you got out of the blue was not legit. If they weren't even able to tell you that, then yes, this sounds like a really incompetent bank.
- lelanthran 5y ago
  > You don't have to. You just ask the bank when you call them back: did someone just call me a little bit ago? What about? > If the bank can't answer that question, it's time to find another bank. Any reputable bank will be able to look at your file and see that a call was made to you and what the issue was. That won't help: all the phisher has to do is make a call at around the same time that the legit employee called you. The person you called back would probably not be able to tell you what the call should be about anyway.
  - zerocount 5y ago
    The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate.
    - lelanthran 5y ago
      > The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate. And I'm saying that even if the customer support knows about the call, that doesn't mean that the next call you get in 2m from the bank is legitimate. In all cases, anyone reaching out to you from your bank should be treated as not legitimate. The only way to do this is to call the bank yourself, and get put through to the person who wants to talk to you. Any other way including the way you said you'd do it is vulnerable to phishing.
      - wccrawford 5y ago
        You're not wrong about the incoming calls, but I can't figure out who you're replying to. Nobody above you in the thread seems to be suggesting that the bank ever call you. And certainly not call again in a short time.
        lelanthran 5y ago
JumpCrisscross 5y ago
> there was no way to get connecter back to the person with whom I was speaking You shouldn't have to get back to that exact person. Just their department.
- lokedhs 5y ago
  That is what I assumed as well, but when I did call back they had no idea what the topic was. Hopefully, this particular experience is rare, but the fact that it can happen at all is somewhat concerning
  - cortesoft 5y ago
    What were they trying to reach you about? Was it actually important to you or was is something you could have ignored?
    - lokedhs 5y ago
      They wanted to tell me that I hadn't made my loan payment. They were right about it. I did miss it. I had made a larger payment a few months earlier, and I hadn't resumed regular payments.
      - ollien 5y ago
        One would think this wouldn't be such difficult information for a L1 rep to tell you. sigh
- mindslight 5y ago
  Most banks have separate customer facing departments and back office departments that process paperwork. In the full evolution of this setup the customer facing departments are basically useless, and answer your questions by putting you on hold while calling up a back office department. Getting the actual details of some issue is like pulling teeth with these arrangements, because the front end has no domain knowledge. But every so often a person from the back office will call you to ask a question and you'll get to speak to a real human who can intelligently tell you the status of an issue. And so when you get calls like that, your choice is to either just roll with their insecure process where they want to verify you but you don't verify them, or give up getting that additional visibility and ultimately spend more time on the phone working through the front end.
prox 5y ago
This is where the marketing department sits in an entirely different building and doesn’t know a thing what’s happening around them.

pdonis 5y ago

> That would be nice if it worked. It looks like you didn't even try it. In order to do what the GP described, when your bank calls you, you say nothing and answer nothing. You hang up and call back on a number you know. > Calling back was also impossible since apparently there was no way to get connecter back to the person with whom I was speaking. You don't have to. You just ask the bank when you call them back: did someone just call me a little bit ago? What about? If the bank can't answer that question, it's time to find another bank. Any reputable bank will be able to look at your file and see that a call was made to you and what the issue was. > The next time they called, they didn't ask for the security questions anymore and just got to the point immediately. They have never asked for it since. This does not look like success to me. It looks like failure. What your bank should be doing is sending you a message via some known channel--like the message center on their website, where you can see messages for you when you log in--telling you that there is an issue that you need to call them about. If you're giving information to someone who calls you out of the blue and says they're from your bank, you're setting yourself up to be scammed.

lokedhs 5y ago
> It looks like you didn't even try it. In order to do what the GP described, when your bank calls you, you say nothing and answer nothing. You hang up and call back on a number you know. I did do exactly that. I asked them for a reference that I could give when I call back. They couldn't give me that. I then did try to call them back, and said "someone called me about something just now, what was it?" and they were not able to tell me. > If the bank can't answer that question, it's time to find another bank. Thankfully, that's not my normal bank. This was the bank that has by car loan. That's my only interaction with them. It's unlikely I'll have more business with them. > This does not look like success to me. It looks like failure. Absolutely. This along with the other issues suggests that they value convenience over security. Also, this is not a small bank we're talking about. I have never seen issues this bad with other banks, but the problem is that when there are banks that get away with this, that suggests people in general do not make a fuss about it and simply accepts whatever people tell them on the phone. If nothing else, it proves why phone scams work. If the bank didn't even have an answer when I asked them to authenticate themselves, that suggests very few people even ask.
- pdonis 5y ago
  > I asked them for a reference Asked who? The people who called you out of the blue and you weren't sure it was legit? I wasn't recommending that at all. I said, explicitly, that you say nothing and answer nothing when you are the recipient of the call. You only say or ask anything when you are the one who initiated the call, to a number that you already know via some other information channel belongs to the bank. > I then did try to call them back, and said "someone called me about something just now, what was it?" and they were not able to tell me. Did they say there was any issue with your account? If there wasn't, then that would indicate that the previous call you got out of the blue was not legit. If they weren't even able to tell you that, then yes, this sounds like a really incompetent bank.
lelanthran 5y ago
> You don't have to. You just ask the bank when you call them back: did someone just call me a little bit ago? What about? > If the bank can't answer that question, it's time to find another bank. Any reputable bank will be able to look at your file and see that a call was made to you and what the issue was. That won't help: all the phisher has to do is make a call at around the same time that the legit employee called you. The person you called back would probably not be able to tell you what the call should be about anyway.
- zerocount 5y ago
  The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate.
  - lelanthran 5y ago
    > The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate. And I'm saying that even if the customer support knows about the call, that doesn't mean that the next call you get in 2m from the bank is legitimate. In all cases, anyone reaching out to you from your bank should be treated as not legitimate. The only way to do this is to call the bank yourself, and get put through to the person who wants to talk to you. Any other way including the way you said you'd do it is vulnerable to phishing.
    - wccrawford 5y ago
      You're not wrong about the incoming calls, but I can't figure out who you're replying to. Nobody above you in the thread seems to be suggesting that the bank ever call you. And certainly not call again in a short time.
      - lelanthran 5y ago

JumpCrisscross 5y ago

> there was no way to get connecter back to the person with whom I was speaking You shouldn't have to get back to that exact person. Just their department.

lokedhs 5y ago
That is what I assumed as well, but when I did call back they had no idea what the topic was. Hopefully, this particular experience is rare, but the fact that it can happen at all is somewhat concerning
- cortesoft 5y ago
  What were they trying to reach you about? Was it actually important to you or was is something you could have ignored?
  - lokedhs 5y ago
    They wanted to tell me that I hadn't made my loan payment. They were right about it. I did miss it. I had made a larger payment a few months earlier, and I hadn't resumed regular payments.
    - ollien 5y ago
      One would think this wouldn't be such difficult information for a L1 rep to tell you. sigh
mindslight 5y ago
Most banks have separate customer facing departments and back office departments that process paperwork. In the full evolution of this setup the customer facing departments are basically useless, and answer your questions by putting you on hold while calling up a back office department. Getting the actual details of some issue is like pulling teeth with these arrangements, because the front end has no domain knowledge. But every so often a person from the back office will call you to ask a question and you'll get to speak to a real human who can intelligently tell you the status of an issue. And so when you get calls like that, your choice is to either just roll with their insecure process where they want to verify you but you don't verify them, or give up getting that additional visibility and ultimately spend more time on the phone working through the front end.

prox 5y ago

This is where the marketing department sits in an entirely different building and doesn’t know a thing what’s happening around them.