4 ms·
I don't understand the procedure. I mean, to get access to a bank account through a "new" phone (which is apparently the method used) you need besides the 2FA
by jaclaz 4y ago
I don't understand the procedure.
I mean, to get access to a bank account through a "new" phone (which is apparently the method used) you need besides the 2FA on the "old" phone also login/password or user/pin to the bank, don't you?
- hermitcrab 4y ago"Once they have the phone and the card, they register the card on the relevant bank's app on their own phone or computer. Since it is the first time that card will have been used on the new device, a one-off security passcode is demanded." The 2FA code is sent to the stolen phone. If notification preview is on, the thief can see the 2FA code, even though they don't have access to the new phone. So 1) thief steals card and phone. 2) Thief pretends to be victim and asks to register the stolen card on their own phone. 3) 2FA code is sent to stolen phone, but thief can see it due notification preview. 4) Card is registered on thief's phone and and now be used for fraud.
- jaclaz 4y agoMaybe here (Italy) it is different, but AFAIK you need to login to the bank in order to do anything like changing the phone or the phone number, i.e. the 2FA is sent for confirmation (on the old phone) only after you are logged in/authenticated (and this needs access credentials+2FA).