3 ms·

Transferring money out is far lower risk than unauthorised account access. If they transfer money out and it turns out it was fraud they can easily compensate

Transferring money out is far lower risk than unauthorised account access. If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. If they give unauthorised account access then there's far greater harm including risk they'll get penalised by regulators over data security as well as the damage being potentially hard to undo if further changes are made to the account.

P5fRxh5kUvp2th 4y ago
The point is that requiring cvv for a login is stupid, not that the risk levels are different. Does it become acceptable to require the blood of my first-born because the risk levels are different? Of course not. They're not even allowed to store that in the US (PCI-DSS), so the other poster must not be in the US.
- jefftk 4y ago
  Your GP had "it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane", and your parent is explaining why that's a non-insane thing.
  - rippercushions 4y ago
    GP here. I found every part of the process insane. To enumerate: 1) getting locked out for not having the CVV of some random card that expired a decade earlier 2) being allowed to transfer money out, but not to login into the account 3) being allowed to keep my second account, even though they don't trust me enough to give me access to the first None of these make sense individually, and they make even less sense as a whole.
- ballenf 4y ago
  They probably couldn't see the CVV but were going to run the card and see if it verified.
  - P5fRxh5kUvp2th 4y ago
    fair enough
markwkw 4y ago
In a large corporation, different precesses can be handled and developed by separate teams often working in silos. After many years, there may not be a force to assure these processes are consistent, have rules that make sense in relation to one a other. I think the answer may just be it’s “dumb” because no one cares or has the power or will to look at things holistically.
adolph 4y ago
> If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. But, once he'd learned that all of the other ½ cents are left floating around inside the megacorporation's database, Gorman hacked into the company's computer system and funneled them all into his next check, accruing the amount of $85,789.90, (a crime that would be later be known in slang as "salami slicing"). https://superman.fandom.com/wiki/Gus_Gorman https://superman.fandom.com/wiki/Gus_Gorman

P5fRxh5kUvp2th 4y ago

The point is that requiring cvv for a login is stupid, not that the risk levels are different. Does it become acceptable to require the blood of my first-born because the risk levels are different? Of course not. They're not even allowed to store that in the US (PCI-DSS), so the other poster must not be in the US.

jefftk 4y ago
Your GP had "it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane", and your parent is explaining why that's a non-insane thing.
- rippercushions 4y ago
  GP here. I found every part of the process insane. To enumerate: 1) getting locked out for not having the CVV of some random card that expired a decade earlier 2) being allowed to transfer money out, but not to login into the account 3) being allowed to keep my second account, even though they don't trust me enough to give me access to the first None of these make sense individually, and they make even less sense as a whole.
ballenf 4y ago
They probably couldn't see the CVV but were going to run the card and see if it verified.
- P5fRxh5kUvp2th 4y ago
  fair enough

markwkw 4y ago

In a large corporation, different precesses can be handled and developed by separate teams often working in silos. After many years, there may not be a force to assure these processes are consistent, have rules that make sense in relation to one a other. I think the answer may just be it’s “dumb” because no one cares or has the power or will to look at things holistically.

adolph 4y ago

> If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. But, once he'd learned that all of the other ½ cents are left floating around inside the megacorporation's database, Gorman hacked into the company's computer system and funneled them all into his next check, accruing the amount of $85,789.90, (a crime that would be later be known in slang as "salami slicing"). https://superman.fandom.com/wiki/Gus_Gorman https://superman.fandom.com/wiki/Gus_Gorman