4 ms·
> They're already doing something (invisible as it may be). They can definitely do a better job. But without companies such as Telesign, fraud losses would far,
by tpxl 3y ago
> They're already doing something (invisible as it may be). They can definitely do a better job. But without companies such as Telesign, fraud losses would far, far worse.
Until banks accept that they got defrauded, not you, whatever they do will be too little.
- velavar 3y ago> Until banks accept that they got defrauded, not you, whatever they do will be too little. True. Regardless of accepting responsibility, I think they're spending a good bit of money in preventing fraud from happening [1]. Maybe some regulation around banks taking fraud losses would do the trick but the flipside would be that simple financial flows of legitimate customers would become full of friction as banks race to lock down fraud losses. Fraud detection is a really hard fraud problem for even a human, let alone models. [1] https://bankingjournal.aba.com/2022/01/study-banks-see-rise-in-fraud-attempts-associated-costs-in-2021/ https://bankingjournal.aba.com/2022/01/study-banks-see-rise-...
- slt2021 3y agoNo-one is actually breaking into a bank and stealing $$ from your account. Virtually most of the fraud is happening due to customer's own fault, not strictly bank's fault: 1. installed malware and got all saved CC data stolen 2. website you ordered your widgets got hacked and your CC stolen 3. clicked phish linked and lost your online bank credentials 4. got scammed and sent zelle to a scammer 5. used shady website to order deeply discounted electronics / signed up for adult membership website - and gave your CC data right into hands of fraudsters 6. used shady third party ATM in tourist place like Cancun and got your card skimmed etc 7. used same user/pass credentials for online banking, as your email account, and your online bank got taken over
- velavar 3y agoSo true and something I see everyday on my job! it's no wonder then that financial companies have to resort to using data from companies like Telesign to view these red flags and attempt to detect fraud.
- youngtaff 3y agoThey could offer decent 2FA i.e. not SMS, for starters
- firefoxkekw 3y ago8. Using android phones that haven't received any security updates in the last few years because the vendor stopped releasing updates a couple of years after the release.
- glitcher 3y agoNow go and explain to anyone's grandmother how this list of items is her fault. Hard disagree on victim blaming being the answer. Sure all of us can learn to be more careful with tech, but the way banks frame fraud against them as identity theft against you is slimy doublespeak.
- slt2021 3y agoAnswer is simple: if you cant use technology safely - dont use it! Problem is nobody is teaching effective fraud defense for consumers at scale. Disable online banking, use checkbook and write checks everywhere or carry cash. I still see older people use checkbooks from time to time, even shopping groceries. Problem solved. We require drivers license to operate vehicle, it is time we should require infosec101 training before handing over credit cards and or online banking accounts. So that you cannot blame the bank for your own fault. Or migrate to something Apple Pay, but that also does not guarantee 100% fraud prevention
- Rygian 3y agoSo you are advocating for the vast majority of the internet population to stop using online banking. Let's flip the omelette: no one forces banks to do business online; if a bank can't build secure online banking, they can default to checkbooks and cash. They have the means and motive to build solutions that are actually secure and usable, so they should bear the burden of dealing with fraud when their solutions fail to be secure.
- slt2021 3y agoMost of the online banks are pretty secure for non-oblivious person. I always used online banking and never got scammed. It is pretty secure for me. Combination of user & password with enough entropy, and basic brute-force defense that blocks after 3-4 attempts is the industry minimum standard. User is the weakest link always, you cannot fix the "stupid" user that downloads malware, warez, adult content and gets infected and loses everything. These people need life lesson to learn how to operate technology safely. Although I agree that online banking could be made more secure, but the threat model will immediately evolve and adapt because scammers/fraudsters are still there and they want to eat.
- ygjb 3y agoSo point by point: 1. Stealing a credit card number, ccv, expiry, and name shouldn't be game over. It is because businesses want to reduce friction for customer purchases. If card not present transactions required a second step of verification, for example, multi-factor authentication, it would drastically reduce this type of fraud. Unfortunately it would also increase friction for online purchases, which is why everyone in the card processing chain is looking to shift liability away from themselves. 2. That is not the customers fault. Full stop. Yes, some sites are more shady than others, but there is nothing a consumer can do to determine if a service provider will get hacked. 3. Yes. Unfortunately, phishing is really easy. Despite the prevalence of this attack, training users to effectively detect and avoid being a victim is almost impossible. 4. See #3. 5. See #2. 6. How is a customer supposed to validate the security of an ATM against modern skimming technology, many of which are virtually indistinguishable from normal bank machines. 7. Yep, not great. Why don't banks require 2FA? Because it creates friction and increases costs. Better to just externalize the risk. Your entire blame the user argument is bunk that has been packaged up and recirculated by the finance community for almost 20 years (and I have been using these arguments against them for nearly that long, granted it's close to ~12 years since I worked in infosec at a bank).
- WeylandYutani 3y agoI have to input a 4 digit code to use my card. As I understand it this is practically unheard of in the US. That's fraud prevention right there.