4 ms·
This could be prevented SO EASILY if the text message also described the action that will happen as soon as verification is completed, rather than just the veri
by EGreg 4y ago
This could be prevented SO EASILY if the text message also described the action that will happen as soon as verification is completed, rather than just the verification code. Sheesh. So many banks and merchants, and no one puts that in there? Is it because of the 140 character limit (another dumb limit these days)?
- philips 4y agoI feel every bank should default to sending you a notification text and/or email on every transaction. Most banks have the feature but it can be annoying to setup. Another issue I have had is both email and phone providers may start rate limiting or marking as spam if you get too many automated messages.
- InCityDreams 4y agoMy €uro bank does that....within seconds of using my card a notifiction appears with the amount withdrawn/ deposited. Further under the 'push notifications' i opted for 'all', so also my direct debit bills get flagged to me.
- thraxil 4y agoMonzo in the UK sends a notification in the app on every transaction. You then even have the option of freezing your card immediately if you think something's up.
- monkey_monkey 4y agoBarclays and American Express do this as well. It really should be standard practice now.
- nicbou 4y agoMost German banks do it now, I'd say. It's a fantastic feature.
- pasc1878 4y agoMy bank First Direct sends an SMS message every day there is a transaction and has for at least 15 years. Visa updates are weekly.
- thimkerbell 4y agoI asked (at the branch, in person) to get such notifications but was told I'd have to set up online access to my account, to get them. I asked how to get such online access to be "read only" (so it couldn't withdraw from my account) but was told that wasn't possible.
- thimkerbell 4y agoWith another financial institution, I did have online access and had set up notifications, but despite doing so, I wasn't getting them. Complained, but employees were unconcerned.
- thimkerbell 4y agoI asked to get notifications if anyone asked to access my safe deposit box, or at least to let me require a password for such access, but was told that's not possible.
- glowingly 4y agoMy bank does, but only if I install their app and enable notifications. Even then, I still had to slowly tap through layers upon layers of menus to setup rules that actually triggered the alerts. Latter part is somewhat fine, even if an opinionated default ("report all, no exceptions") would have sufficed. Former is the annoying part, mostly because Bank of America's app is just slow and still isn't up to par with their website. Notably, the virtual card function is not present on the mobile app, even after many years (imagine a really bad Privacy.com clone, like really bad, but it still has virtual numbers at least).
- Lazare 4y agoOne suspects if the legal system put liability on the banks, they'd very quickly find some good solutions.
- wonderbore 4y agoThere's no such limit anymore. It costs more, but all phones support SMS concatenation
- r_hoods_ghost 4y agoAll my bank accounts (UK) have some variant of "Never share this code with anyone, not even us." appended or prepended whenever they send a verification code. It's so universal I assume this is mandated by law. I'm guessing this isn't the case in the states?
- EGreg 4y agoThat is not going to cut it Because people just get used to this being boilerplate and anyway services such as Plaid “override” that, so why wouldn’t “the bank’s own employees” do it? No, we need exactly what I said above
- r_hoods_ghost 4y agoMine do that as well. I.E they also say use xxxx to log in to online banking. Or use xxx to approve this transaction / new payee / standing order.
- akkartik 4y agoCan you elaborate on the "override"?
- EGreg 4y agoPeople think "yeah, the text message SAYS not to give it to anyone, but they say it all the time and this is Plaid, I mean come on, it's Plaid, I can trust them, right?" and they think that even more for a Bank Employee (TM) Everyone should have a policy of never giving out personal info or confirming any digits until they HANG UP AND CALL BACK on the corporate number to discuss any issue.
- z3t4 4y agoWhat's even worse is that the code is used as single factor, eg. No extra security besides this code.
- tommek4077 4y agoProbably they phished the logins otherwise. Normally those sms are the second factor.
- fxtentacle 4y agoFor my bank account in Germany, every text message with a security code will list precisely what entering that code will do, so it might read: "Enter code 12345 to send $12.34 to Dr Strange, account 1234 at Mystery Bank." Mandating that by law in the US would easily make these scams a lot more difficult to pull off.
- dade_ 4y agoI noticed banks have generally modified their message to warn people: “Please use 123456 as your TD security code to log in. We will never contact you for this code. Do not reveal it to anyone else.” Only HSBC requires a token to authorize transactions that I have found so far (token +PIN) Most happily let you do anything once logged in. That said, I am sure we have all heard someone complain, “Why am I getting these login codes from my bank? I am not trying to login”. Most people don’t make the connection to fraud attempts.
- quercusa 4y agoI'm not sure they are typically fraudulent attempts - I think many people are unable to remember/enter even their usernames/email addresses consistently.
- thimkerbell 4y agoI gave a then-rarely-used phone number to someone in an organization that regularly deals with elderly people. A day or so later, that phone got a 'fail' text message from a bank that I'm not a customer of. I reported it to them as phishing but didn't hear back.