5 ms·

It's so strange to read this is still happening in US. I live in Europe - 95% of such attacks are prevented by something called Strong Customer Authentication,

• sschueller 5y ago
  I have the feeling there is no interest in fixing these things in the US. Too many people making money of certain outdated services. From printing paper checks to minting pennies. Like everything, it will require a gigantic scandal before anything is fixed/changed and it will open the door for new issues.
  • thathndude 5y ago
    It will change when it becomes the economically rational choice for banks. I won’t bore with details, but I’m a lawyer who primarily sues banks for customers. And I’ve seen the lawsuits I file lead/contribute to changes in bank behavior and policy. The regulatory protections are there. Now lawyers need to punch banks on the nose until they decide they want to do more to stop the fraud in the first instance. But it’s strange, clients have almost like a Stockholm syndrome with the banks. Their rational is often something like “I don’t want to sue them and make them mad, because that might mean I won’t get my money back” But you’re not going to get your money back unless you sue. Meanwhile deadlines pass and then you’re screwed (and embarrassed)
    • le-mark 5y ago
      Can you expand on what regulations are allowing successful suit to be brought, and maybe an example or two of how that works in practice?
      • thathndude 5y ago
        I’d say there are three main fact scenarios I bring claims for: 1. Credit account are closed without a specific reason being given. (Banks have an obligation to give you a reason). 2. Debit card/checking account fraud. There’s a federal law specifically protecting consumers in those cases. 3. Credit card/. Again, a specific federal law for these cases. What’s noteworthy for each one of these violations, or, more accurately, for each one of these causes of action, is that there is a right to recover attorneys fees. And whenever you have that, then the consumer has an opportunity to find a lawyer who will forgo any payment unless, and until, there is a recovery. That’s how I pursue the vast majority of my cases. I even cover the filing fee for the consumer. So when I say consumers need to sue their banks, and they get this response of “well they can’t afford a lawyer,“ i’m pretty sure they can afford free. but this pessimistic mindset seems to have taken hold. And I’d like to try and undo it.
        • jo6gwb 5y ago
          #ForThePeople
• signal11 5y ago
  > Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'” In the UK, banks have put in quite a lot of messaging around the fact that they'll never ask for a password -- so the above line from the article ought to set off alarm bells in most customers' minds. Of course, there are people, particularly older or vulnerable users, who are impacted by this as they might not be aware. Phone scams to get 2FA codes aren't going away anytime soon, sadly. Also, as an industry, I wish we could move away from SMS-based 2FA. It's kind of amazing that SMSes these days are a barren wasteland -- mostly automated messages, scams, ... and two-factor codes. And some institutions still use SMSes to deliver two factor codes ... including Paypal in the UK.
  • thathndude 5y ago
    I think that’s the genius of the scam. “We’ll never ask for your password. And we’re not asking for your password. This is just a one-time authentication token. Your password is safe!”
  • mschuster91 5y ago
    In Europe, regulation prevents or at least places strong barriers on SIM card theft, which makes SMS 2FA pretty secure. You can't just go and transfer a phone number in a matter of minutes to someone else - it is always a multiple days long process involving numerous SMS notifications prior to the actual transfer. Every time I read post-mortems on hacks and scams in the US, my mind is a bit blown on just how easy most could have been prevented by tiny bits of government regulation that we Europeans take for granted.
    • mndgs 5y ago
      Touche, mister, touche..
    • human 5y ago
      We mostly need to sue the hell out of companies that don’t identify correctly their customers when making important changes to their account (like transfering a phone number)!
• hdjjhhvvhga 5y ago
  Yeah, basically the only major attack surface is one the SIM itself, but I have the feeling telcos learned their lesson and verify the identity of the person asking for a SIM replacement in a more strict way.
• thathndude 5y ago
  For what it’s worth, a consumer is pretty well protected after the fact by regulatory protections. But I’ll include the PSA I posted on the article as well: Attorney here (not legal advice). Please be aware that there is a short deadline required for Regulatory disputes (approximately 60 days). That could have an effect on your claim. Time is of the essence. And depending on how soon you notify the institution before the deadline, you can be stuck losing up to $500. Again, please just know time is of the essence and you want to reach to an experienced attorney ASAP if you suffer fraud.
  • BrandoElFollito 5y ago
    In the EU it is a year, and you may loose up to 150€. Good luck to the bank which would like to enforce this. One tried, I told them I am leaving, they said it is a misunderstanding and that of course they did not mean to make me pay these 150€.
    • thathndude 5y ago
      Yeah. That’s superior to our protections. Generally, in the US, its 60-90 days (the fact that it’s variable is obviously not ideal) and $500 loss limit.
      • BrandoElFollito 5y ago
        In the EU this is a EU regulation, so all banks have the same rules. I just checked, it is now 50€ only, and only if the payment was done with a PIN or SMS/app confirmation. This is the maximum amount (so if you had, say 3 times 300€ of fraudulent transactions, you would pay a max of 50€ total - and like I said it is not likely that the bank will make you pay anyway)
  • mindslight 5y ago
    Something I've been curious about (not asking for legal advice). If the deadline to report is 60 days from the statement/notification of the transaction, what about accounts that only issue statements quarterly or monthly? Is it really still workable to contest a transaction say 10 months after it occurred, if the bank has only just issued you a statement?
• contidrift 5y ago
  On top of all that, most banks here allow you to create an unlimited number of free virtual credit cards which draw funds from your real credit card or a debit account. Cards can be created to suit most cases such as one-time transactions, monthly subscriptions and "pre-paid" type cards with a defined total which are tied to one merchant. All multiple use cards are valid for a max of 12 months.
  • BrandoElFollito 5y ago
    I am not sure that this is "most", more probably "some". Out of 6 banks across 2 EU countries, only two allowed for that. Another one had dynamic CVV.
    • contidrift 5y ago
      Weird, just about every bank here in Portugal allows for that. The virtual "visa" card creation/management is handled through SIBS, the company that does all national card transactions. I assumed due to convenience and safety that virtual cards were more widespread in Europe, not least because of the requirements such as 3DS for card payments. At least fintech companies like Revolut and N26 should be available for most Europeans and they offer virtual cards, though with other limitations/costs.
      • BrandoElFollito 5y ago
        Ah, this is interesting - you have a centralized entity that handles the transactions? This is indeed what must be the reason for the widespread of the availability. In France I know that Fortuneo gives that possibility, but for instance Boursorama or Credit Mutuel do not. It is funny how the banking is different between countries in the EU. France is slowly making its way though the 90's while Poland uses a phone based transaction system (BLIK). I always saw Portugal as bing very modern in that way (you had chips on your identity cards for years, we just got them this year, with the new credit-card format of id cards)
• tgb 5y ago
  I don't understand how 2FA would stop this attack. The attack described involves phishing for a one time code like what most 2FA methods give.
  • Tenoke 5y ago
    The actual transaction then has another 2fa, seperate from the logging in. In one of my banks this is approving the sum of the transfer in an app after logging in with a password(you can't transfer the app to another device easily), in another it's approving by using an authenticator-like app + a seperate pin, in a bank before that it included a whole seperate device for me to put my debit card in. In neither case would simply logging in or getting my account password be enough.
    • tgb 5y ago
      Interesting. The attack seems to be primarily on people who don't already have Zelle so in the analogous case in Europe wouldn't the attacker just be able to setup the app as the victim and authorize the transfer themselves?
      • Tenoke 5y ago
        You can't just install the app on another device with the login details, you need to talk to the bank and go through a whole process when changing a device (in one of my banks it can only be done in person even).
• baybal2 5y ago
  SCA will not do a thing. SMSes are hackable, and SS7 network is routinely exploited. Google has made things worse by making confirmation SMSes very easily identifiable, and interceptable at scale with their SMS verification service which is now being pushed down developer's throats. (Google yr66t3YYkAe that's a Google 2FA ID of some bank, seemingly already actively exploited) Adding confirmation links inside SMSes is what some money transfer companies did responding to the threat of SMS interception, but I think this made it even worse, at least on Android. It's trivial to coax dozens of popular apps into opening a link in the browser, or webview using Android's "intents," thus completely negating any CSFR protection.
• CogitoCogito 5y ago
  > Though to be fair, scamming is still present here, typically involving calling older people and trying to persuade them to reveal bank access codes during a phone call. There two differences with US banks here: - banks are required never to ask for access credentials over insecure channel (phone/email) (though SMS is also not perfect in this regard); - banks are required to educate customers that they never ask for such credentials, educate about fraud scenarios, etc. And they do (at least the reputable ones) This has happened many times in Sweden in the last few years. Banks almost always tried to talk their way out of any sort of responsibility even though scammers took advantage of their pretty bad processes. The banks processes as well as the apps' designs have improved, but I think the point is that essentially nothing of what happened there in the US wasn't happening in Sweden as well. I presume it's the same with the rest of Europe. This quote from the article is key: > “Consumers — many who never ever realized they had a Zelle account – then call their banks, expecting they’ll be covered by credit-card-like protections, only to face disappointment and in some cases, financial ruin,” Sullivan wrote in a recent Substack post. “Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was recently affirmed by the CFPB here. If you are reading this story and fighting with your bank, start by providing that link to the financial institution.” Good to see US regulators aren't letting banks off the hook. They should furthermore come down very hard on any bank that even acts like they might not be responsible since that's essentially fraud. At the end of the day it's an issue of securing human processes as well as regulators holding banks feet to the fire for problems their processes create.
• drpre 5y ago
  PSD2 only took effect in 2019, and for many countries the enforcement was delayed for card payments up to a full year due to lack of issuer readiness. 2FA is absolutely the future and I believe globally payments should move in this direction… I’m just pointing out that even in Europe, this has not been the standard for all that long. That said I hope other countries/regions follow the example — the EEA seems to lead the charge on major online issues, e.g. payments and privacy.