4 ms·

> I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. Anecdote time. My wife and I h

> I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. Anecdote time. My wife and I have a shared checking account that got hacked and drained. First her debit card got skimmed. Then the perp called USAA a half dozen times claiming to be her and asking for account credentials. Finally they got a helpful account rep to reset the password, disable MFA, and tell them the username. Yep. You heard that right. Social engineering works even on bank tellers who should know better. Fortunately it's just a daily use account and I'm paranoid, so there was only 5K they could access there. USAA owned up to the whole thing and restored the funds, but now they punish my wife with a 10-minute interrogation to prove her identity if she ever has to get them on the phone for a legitimate reason.

bsagdiyev 5y ago
Weird, USAA froze my cards and funds immediately the only time I've had suspicious transactions. I guess the social portion is where we diverge though, they definitely tried harder to get in to yours. Ours was just a guy in Vancouver trying to order Thai food through a delivery app.
- rootusrootus 5y ago
  They froze the card, but only after six consecutive withdrawals from an ATM in Miami. I was getting notifications on my phone about the withdrawals (did I mention I'm paranoid) but since I was driving, I didn't see them for about half an hour when I arrived at my destination. Called USAA immediately and they had already frozen the card. But the money had already been withdrawn. I can't explain why it took many consecutive withdrawals in a short time, in a city that I've never visited, 3000 miles away from the most recent use of the card, to trigger USAA's protection algorithms. USAA did finally take care of it. My biggest beefs with them are 1) they dragged their feet a couple days on the investigation until I called them myself (I'm the veteran, my wife is not, and they were much more responsive to me), and 2) they really do punish my wife for something not her fault. You know those questions you get which are sourced from your credit file? What street did you live on, what's your mortgage payment, things like that? That's what they ask every time, after asking for a secret password and PIN code to be used for phone calls. I'll give them credit though, for actually sharing the gory details with me once they were done tracking down everything, and admitting that one of their own employees had broken their rules and handed over the credentials to my wife's account.
jnwatson 5y ago
This incident reinforces the rule never to use your debit card for credit card transactions.
- nkozyra 5y ago
  Absolutely do not use your debit card ... well, anywhere if you can help it. (Apologies, saw the wrong parent comment) How many utilities, credit card companies require a checking account for autopay? How many times have you thrown out an old checkbook that contains routing and account numbers on a carbon copy pages? Bank accounts are not especially secure, we mostly hope to limit the risk/reward calculation for hacking them and basic security controls.
  - rootusrootus 5y ago
    > How many utilities, credit card companies require a checking account for autopay? In my experience, this is getting better! I now have all but one of my bills being paid by my credit card. Used to be that the utility companies made you pay extra and use a third party service if you wanted to use your credit card. Not all, though. Verizon, for example, will let you pay with a credit card, but they give a substantial discount if you use a debit card instead. For obvious reasons. I hope that does not become normal. I'm used to Verizon being scummy, I hope it doesn't become the default behavior for the other utilities I pay for.
    - Symbiote 5y ago
      The US needs an automatic bill payment system with strong guarantees. In Britain, most people¹ pay bills (electricity, water, phone, internet, insurance, car loan, credit card etc) by "Direct Debit"². (Most European countries have a similar system with similar guarantees, but this one is described in English.) If anything should go wrong, the bank must fix it. There's a list of direct debits in the bank's interface, and they can be cancelled/suspended with one click (or by phoning or going to the bank). It isn't perfect (see 3 from two weeks ago) but that sort of problem is rare enough that it was reported in newspapers. ¹ "Direct Debits are used by nine in ten UK consumers to pay some or all of their regular bills". ² https://www.directdebit.co.uk/DirectDebitExplained/Pages/DirectDebitGuarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/Pages/Dir... ³ https://www.moneysavingexpert.com/news/2022/03/tsb-customers-double-charged-due-to-technical-error---here-s-wha/ https://www.moneysavingexpert.com/news/2022/03/tsb-customers...
slg 5y ago
I just want to point out that this comment is exactly why social engineering is a problem. You have been a victim of what happens when a company doesn't put in enough effort to verify the identity of the person they have on the phone. Yet when that company starts putting in that effort, you object and call it a "punishment". Convenience and security are often in direct competition with each other. Almost all of us would expect convenience in this situation. You should know better more than most the cost of choosing convenience and even you want that convenience. Is there any wonder why businesses select convenience over security?
- rootusrootus 5y ago
  I call it a punishment because it's over the top. It was a lot of money for an individual, not a lot of money for the bank. So the security should be proportional. Instead of putting in a 10-ton vault door in front of every customer interaction, I'd prefer they only escalated to that level when someone calls in saying things like "I lost my wallet and I'm stuck away from home, give me access to 'my' money, and oh by the way I don't even know my own login name."
  - slg 5y ago
    This type of escalating validation is also ripe for social engineering. You said this person called 10 times. They don't need to do everything in one call. Instead the goal for earlier calls can be to gather information. You gave the example of the person trying to take over the account without knowing the login name. What information would someone need to supply to get the account name? Does that require escalation? If not, what is the value of requiring that as part of the identity validation process? If the company is going to provide some level of support to people they haven't verified, that support will be abused as a means of passing the verification.
    - rootusrootus 5y ago
      At the risk of being a software developer that always sees everything as a software problem, I feel like this could largely be mitigated with very simple improvements to the customer service application. Back when this happened, that was my first question to USAA and one for which the security guy didn't have a ready answer, though probably it boils down to some version of "we are heavily regulated and continue to rely on software built for mainframes." There are so many possible ways to mitigate the risk which should be triggered well before a half dozen attempts finally gets to a teller credulous enough to believe their excuses for ignorance.
joering2 5y ago
> but now they punish my wife with a 10-minute interrogation to prove her identity if she ever has to get them on the phone for a legitimate reason. How is that punishment? If USAA knows you or your wife were a target of somewhat sophisticated attack that ultimately broke their security barriers, wouldn't you yourself actually want some extra protection? If anything, this is a positive sign for USAA, I doubt with my Bank of America anyone would care with any sort of extra layers of security if my account would ever get hacked in a sophisticated way.
- rootusrootus 5y ago
  I call it punishment because I don't think the attack was really sophisticated, I think USAA's internal training and software was wholly inadequate to defend against a persistent unsophisticated attacker. Why were they still routing his calls to regular bank tellers after the first couple attempts? Why wasn't the security department involved at that point as the only allowable contact point? Why did they actually hand out the login name and password for an account without doing the 10 minute deep-dive identity verification they now make my wife do?
  - joering2 5y ago
    I guess on the bright side, nobody will ever hack into your USAA account :)
nradov 5y ago
This is one reason to keep at least some accounts with a large national bank or credit union. If you need to prove your identity or deal with a lost card while traveling you can at least walk into a physical branch and talk to a manager.

bsagdiyev 5y ago

Weird, USAA froze my cards and funds immediately the only time I've had suspicious transactions. I guess the social portion is where we diverge though, they definitely tried harder to get in to yours. Ours was just a guy in Vancouver trying to order Thai food through a delivery app.

rootusrootus 5y ago
They froze the card, but only after six consecutive withdrawals from an ATM in Miami. I was getting notifications on my phone about the withdrawals (did I mention I'm paranoid) but since I was driving, I didn't see them for about half an hour when I arrived at my destination. Called USAA immediately and they had already frozen the card. But the money had already been withdrawn. I can't explain why it took many consecutive withdrawals in a short time, in a city that I've never visited, 3000 miles away from the most recent use of the card, to trigger USAA's protection algorithms. USAA did finally take care of it. My biggest beefs with them are 1) they dragged their feet a couple days on the investigation until I called them myself (I'm the veteran, my wife is not, and they were much more responsive to me), and 2) they really do punish my wife for something not her fault. You know those questions you get which are sourced from your credit file? What street did you live on, what's your mortgage payment, things like that? That's what they ask every time, after asking for a secret password and PIN code to be used for phone calls. I'll give them credit though, for actually sharing the gory details with me once they were done tracking down everything, and admitting that one of their own employees had broken their rules and handed over the credentials to my wife's account.

jnwatson 5y ago

This incident reinforces the rule never to use your debit card for credit card transactions.

nkozyra 5y ago
Absolutely do not use your debit card ... well, anywhere if you can help it. (Apologies, saw the wrong parent comment) How many utilities, credit card companies require a checking account for autopay? How many times have you thrown out an old checkbook that contains routing and account numbers on a carbon copy pages? Bank accounts are not especially secure, we mostly hope to limit the risk/reward calculation for hacking them and basic security controls.
- rootusrootus 5y ago
  > How many utilities, credit card companies require a checking account for autopay? In my experience, this is getting better! I now have all but one of my bills being paid by my credit card. Used to be that the utility companies made you pay extra and use a third party service if you wanted to use your credit card. Not all, though. Verizon, for example, will let you pay with a credit card, but they give a substantial discount if you use a debit card instead. For obvious reasons. I hope that does not become normal. I'm used to Verizon being scummy, I hope it doesn't become the default behavior for the other utilities I pay for.
  - Symbiote 5y ago
    The US needs an automatic bill payment system with strong guarantees. In Britain, most people¹ pay bills (electricity, water, phone, internet, insurance, car loan, credit card etc) by "Direct Debit"². (Most European countries have a similar system with similar guarantees, but this one is described in English.) If anything should go wrong, the bank must fix it. There's a list of direct debits in the bank's interface, and they can be cancelled/suspended with one click (or by phoning or going to the bank). It isn't perfect (see 3 from two weeks ago) but that sort of problem is rare enough that it was reported in newspapers. ¹ "Direct Debits are used by nine in ten UK consumers to pay some or all of their regular bills". ² https://www.directdebit.co.uk/DirectDebitExplained/Pages/DirectDebitGuarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/Pages/Dir... ³ https://www.moneysavingexpert.com/news/2022/03/tsb-customers-double-charged-due-to-technical-error---here-s-wha/ https://www.moneysavingexpert.com/news/2022/03/tsb-customers...

slg 5y ago

I just want to point out that this comment is exactly why social engineering is a problem. You have been a victim of what happens when a company doesn't put in enough effort to verify the identity of the person they have on the phone. Yet when that company starts putting in that effort, you object and call it a "punishment". Convenience and security are often in direct competition with each other. Almost all of us would expect convenience in this situation. You should know better more than most the cost of choosing convenience and even you want that convenience. Is there any wonder why businesses select convenience over security?

rootusrootus 5y ago
I call it a punishment because it's over the top. It was a lot of money for an individual, not a lot of money for the bank. So the security should be proportional. Instead of putting in a 10-ton vault door in front of every customer interaction, I'd prefer they only escalated to that level when someone calls in saying things like "I lost my wallet and I'm stuck away from home, give me access to 'my' money, and oh by the way I don't even know my own login name."
- slg 5y ago
  This type of escalating validation is also ripe for social engineering. You said this person called 10 times. They don't need to do everything in one call. Instead the goal for earlier calls can be to gather information. You gave the example of the person trying to take over the account without knowing the login name. What information would someone need to supply to get the account name? Does that require escalation? If not, what is the value of requiring that as part of the identity validation process? If the company is going to provide some level of support to people they haven't verified, that support will be abused as a means of passing the verification.
  - rootusrootus 5y ago
    At the risk of being a software developer that always sees everything as a software problem, I feel like this could largely be mitigated with very simple improvements to the customer service application. Back when this happened, that was my first question to USAA and one for which the security guy didn't have a ready answer, though probably it boils down to some version of "we are heavily regulated and continue to rely on software built for mainframes." There are so many possible ways to mitigate the risk which should be triggered well before a half dozen attempts finally gets to a teller credulous enough to believe their excuses for ignorance.

joering2 5y ago

> but now they punish my wife with a 10-minute interrogation to prove her identity if she ever has to get them on the phone for a legitimate reason. How is that punishment? If USAA knows you or your wife were a target of somewhat sophisticated attack that ultimately broke their security barriers, wouldn't you yourself actually want some extra protection? If anything, this is a positive sign for USAA, I doubt with my Bank of America anyone would care with any sort of extra layers of security if my account would ever get hacked in a sophisticated way.

rootusrootus 5y ago
I call it punishment because I don't think the attack was really sophisticated, I think USAA's internal training and software was wholly inadequate to defend against a persistent unsophisticated attacker. Why were they still routing his calls to regular bank tellers after the first couple attempts? Why wasn't the security department involved at that point as the only allowable contact point? Why did they actually hand out the login name and password for an account without doing the 10 minute deep-dive identity verification they now make my wife do?
- joering2 5y ago
  I guess on the bright side, nobody will ever hack into your USAA account :)

nradov 5y ago

This is one reason to keep at least some accounts with a large national bank or credit union. If you need to prove your identity or deal with a lost card while traveling you can at least walk into a physical branch and talk to a manager.