3 ms·

I just want to point out that this comment is exactly why social engineering is a problem. You have been a victim of what happens when a company doesn't put in

by slg 5y ago

I just want to point out that this comment is exactly why social engineering is a problem. You have been a victim of what happens when a company doesn't put in enough effort to verify the identity of the person they have on the phone. Yet when that company starts putting in that effort, you object and call it a "punishment". Convenience and security are often in direct competition with each other. Almost all of us would expect convenience in this situation. You should know better more than most the cost of choosing convenience and even you want that convenience. Is there any wonder why businesses select convenience over security?

rootusrootus 5y ago
I call it a punishment because it's over the top. It was a lot of money for an individual, not a lot of money for the bank. So the security should be proportional. Instead of putting in a 10-ton vault door in front of every customer interaction, I'd prefer they only escalated to that level when someone calls in saying things like "I lost my wallet and I'm stuck away from home, give me access to 'my' money, and oh by the way I don't even know my own login name."
- slg 5y ago
  This type of escalating validation is also ripe for social engineering. You said this person called 10 times. They don't need to do everything in one call. Instead the goal for earlier calls can be to gather information. You gave the example of the person trying to take over the account without knowing the login name. What information would someone need to supply to get the account name? Does that require escalation? If not, what is the value of requiring that as part of the identity validation process? If the company is going to provide some level of support to people they haven't verified, that support will be abused as a means of passing the verification.
  - rootusrootus 5y ago
    At the risk of being a software developer that always sees everything as a software problem, I feel like this could largely be mitigated with very simple improvements to the customer service application. Back when this happened, that was my first question to USAA and one for which the security guy didn't have a ready answer, though probably it boils down to some version of "we are heavily regulated and continue to rely on software built for mainframes." There are so many possible ways to mitigate the risk which should be triggered well before a half dozen attempts finally gets to a teller credulous enough to believe their excuses for ignorance.
deleted 5y ago
[deleted]
regpertom 5y ago
When I was in a lot of debt, banks outsourced collections agency called many times on a private number and wanted me to verify myself before they would verify themselves. No. Bank denied they would do that but that was lies. They couldn’t even admit to trying to get in contact with me. Collections agency couldn’t even play the theoretically game of maybe there’s a certain someone out there, who knows who, who hasn’t paid off a credit card, maybe this certain someone would want to consider going into his bank and having a chat but that’s not for me to say ah capishe? I’ve got a rock you’ve got a sword how are we gonna play this out? Good times haha

by slg 5y ago

rootusrootus 5y ago

I call it a punishment because it's over the top. It was a lot of money for an individual, not a lot of money for the bank. So the security should be proportional. Instead of putting in a 10-ton vault door in front of every customer interaction, I'd prefer they only escalated to that level when someone calls in saying things like "I lost my wallet and I'm stuck away from home, give me access to 'my' money, and oh by the way I don't even know my own login name."

slg 5y ago
This type of escalating validation is also ripe for social engineering. You said this person called 10 times. They don't need to do everything in one call. Instead the goal for earlier calls can be to gather information. You gave the example of the person trying to take over the account without knowing the login name. What information would someone need to supply to get the account name? Does that require escalation? If not, what is the value of requiring that as part of the identity validation process? If the company is going to provide some level of support to people they haven't verified, that support will be abused as a means of passing the verification.
- rootusrootus 5y ago
  At the risk of being a software developer that always sees everything as a software problem, I feel like this could largely be mitigated with very simple improvements to the customer service application. Back when this happened, that was my first question to USAA and one for which the security guy didn't have a ready answer, though probably it boils down to some version of "we are heavily regulated and continue to rely on software built for mainframes." There are so many possible ways to mitigate the risk which should be triggered well before a half dozen attempts finally gets to a teller credulous enough to believe their excuses for ignorance.

deleted 5y ago

[deleted]

regpertom 5y ago

When I was in a lot of debt, banks outsourced collections agency called many times on a private number and wanted me to verify myself before they would verify themselves. No. Bank denied they would do that but that was lies. They couldn’t even admit to trying to get in contact with me. Collections agency couldn’t even play the theoretically game of maybe there’s a certain someone out there, who knows who, who hasn’t paid off a credit card, maybe this certain someone would want to consider going into his bank and having a chat but that’s not for me to say ah capishe? I’ve got a rock you’ve got a sword how are we gonna play this out? Good times haha