7 ms·

My 82 year old mother found out that fraudsters had emptied her HSBC_UK account

86 points by fortran77 3y ago

sva_ 3y ago
https://nitter.net/AAMortazavi/status/1713265395388252666 https://nitter.net/AAMortazavi/status/1713265395388252666
- deciplex 3y ago
  thank you I got banned from Twitter ages ago and never bothered to create another account. I used to not have trouble reading threads like this but among other things with "X" the UI has become absolutely impossible to use lately. I'm not even sure if I'm allowed to read the rest of this thread on Twitter itself but, if I am, how to do it is not at all obvious.
  - pengaru 3y ago
    FYI all you need to do (for now) is plain substitute the twitter.com with nitter.net. The links in comments are convenient, but it's trivial to DIY when faced with some twitter thread you want to read without a login.
    - m463 3y ago
      you can make a firefox bookmark with location set to: javascript: (location.hostname="nitter.net")
  - marssaxman 3y ago
    If you install the LibRedirect plugin, your browser will automatically rewrite twitter links to nitter.net, which is much more convenient.
  - arprocter 3y ago
    Since Xitter decided to play the 'log in to read this' game, Nitter Redirect extension has saved me a lot of annoyance https://addons.mozilla.org/en-US/firefox/addon/nitter-redirect/ https://addons.mozilla.org/en-US/firefox/addon/nitter-redire...
    - idonotknowwhy 3y ago
      Thanks, works on android
tpmx 3y ago
Back in June 2022 there was a landmark decision in the Swedish supreme court (https://www.domstol.se/hogsta-domstolen/avgoranden/2022/115592/ https://www.domstol.se/hogsta-domstolen/avgoranden/2022/1155...) that made the banks responsible in most of these kinds of cases. The same thing needs to happen in other countries. I love the British comedian David Mitchell's long time campaign against this kind of bank behavior: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi... ('’Identity theft’? It’s daylight robbery by the banks' - 2018) https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E (Mitchell & Webb - Identity Theft, 2007)
- ghusto 3y ago
  I always took the bank's sudden intense interest in my security as serving there concerns, not mine. Not only did it smell insincere and fishy, but it didn't make sense either. Why should I care so much for _their_ service? If they get scammed into giving all my money to someone else, that sounds very much like a _them_ problem, and not a me problem.
  - jfim 3y ago
    Even if it's caused by their incompetence, you'll have to sort it out if it happens, and they won't really care all that much.
    - ghusto 3y ago
      At least here, their care isn't really optional. It's their responsibility, since it's their service. I think they have to prove it was through my own fault in order to brush it off, and that's difficult. Difficult enough that when I had to get my money back (lost due to fraud), they didn't ask more than a nominal set of questions.
- thfuran 3y ago
  I don't understand how the liability could lie elsewhere. I understand why the bank might want to tell a customer "someone else took your money. It sucks to be you", but it seems pretty clear cut that it's no different than the bank somehow misplacing funds for any other reason (at least as far as the customer is concerned. The bank's insurer presumably cares about the particulars of how they're misplacing money).
ceejayoz 3y ago
It's intensely frustrating that most big banks' branch staff are now there just to say "computer says no". They're not empowered to do anything whatsoever. I'm exceedingly glad to have switched to a local credit union.
- qingcharles 3y ago
  For non-Britishers: https://www.youtube.com/watch?v=0n_Ty_72Qds https://www.youtube.com/watch?v=0n_Ty_72Qds
  - FredPret 3y ago
    Thank you! Never knew where this came from.
- marssaxman 3y ago
  I switched to a local credit union years ago and I can't imagine going back. Service can be slow-moving, but it is always humane. When a fraudster emptied my checking account several years ago, I simply walked into the branch, told them what had happened, identified the fraudulent transactions, and they sorted it out - practically on the spot. I walked away with some cash and a new debit card; the rest of the money was returned later that week. A brief chat with an investigator several weeks later concluded the matter (they had identified the culprit).
dkarl 3y ago
> So we’ll do the whole @financialombuds thing and fill in a million faceless forms. But I bet that not a single person will ever turn up at her home, sit down with her and just talk to her. Shame on you @HSBC_UK Such a weird place to look for care and comfort. Let's grant that an elderly person needs assistance and compassion in this time, and as a community we should provide it. Would we want the bank to provide it? Hell no! There's an enormous conflict of interest there. In this situation I wouldn't want somebody from the bank cozying up to my mom and earning her trust. In fact, I'd go ballistic if they tried. Their financial incentives are to use that trust to persuade her not to exercise her full rights, to avoid her becoming aware of all the avenues of recourse available to her, to make her feel that everything will be okay if she lets the matter drop. What we really want for someone in her situation, besides emotional support, is a savvy legal advocate who will let the bank know that she is aware of her rights and the bank's obligations, and that she has legal resources at her disposal.
- rwmj 3y ago
  That's great in theory, but you missed the part where the fraudsters stole all her money. There is no Legal Aid for cases like these. Charities or (in this case) relatives are the best hope for her.
  - nh23423fefe 3y ago
    Lot of passive voice everywhere for some odd reason
  - dkarl 3y ago
    > There is no Legal Aid for cases like these. Charities or (in this case) relatives That's the part that could be fixed. If we manage to provide legal assistance to every criminal defendant who can't afford it, we could provide a consumer advocate for people in her situation, backed up with a lawyer when necessary. They wouldn't have to do much; their attention and their ability to bring legal resources to bear would motivate the bank to do what they are obligated to do.
  - avianlyric 3y ago
rwmj 3y ago
Fraud is absolutely rampant[1] and the police / "In-"ActionFraud will do absolutely nothing about it. Combine this with the banks having reduced costs and outsourced everything, and the outcome is cases like this one. [1] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/articles/natureoffraudandcomputermisuseinenglandandwales/yearendingmarch2022 https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand...
mytailorisrich 3y ago
HSBC UK is pretty serious about fraud, actually. Their fraud department calls me several times a year to enquire about any transactions out of the ordinary to the point I am very careful when I travel abroad because I know they are bound to flag the activity.
- Havoc 3y ago
  Clearly they're phoning the wrong people then
- varispeed 3y ago
  You sure it is the bank and not fraudsters?
  - ceejayoz 3y ago
    This is a serious problem. I had a fraudulent charge today that my credit card company caught. I got both a text and a phone call; the phone call bounced me from person to person, one asking for last four digits, the other asking for name, and when I couldn't immediately find the card to get the CVV the third offered to send me a two-factor code via text to confirm my identity... which said "we will not call and ask for code" in the text message. Still not 100% sure it was the bank, so I asked for a reference number (which they couldn't provide) and said I would call back the number on my card instead.
    - mytailorisrich 3y ago
      HSBC publishes their relevant phone numbers so usually I just call them back. Recently they also have started sending texts instead. They text that "you card ending with xxxx has been used for a transaction of x money at y company, did you make this transaction?" and you just reply Y/N. If you don't reply they start calling.
  - mytailorisrich 3y ago
    Yes, fraudsters don't have Indian accents ;)
kylehotchkiss 3y ago
I'm all for giving people agency over their finances for their entire life... but come on... there's got to be some way of asking "did this person really intend to empty their bank account" to that person or a loved one before actually allowing the transaction to succeed. A fraud filter at the bank should see the owners age and know that something is off. Better to be wrong and be an annoying bank instead of mindless like HSBC and allowing this to happen.
- mytailorisrich 3y ago
  It's the wrong question. What matters is only identity verification, including using all information available as you suggest. But once this has been satisfactorily verified what the person does with their money is none of the bank's concern.
qingcharles 3y ago
At least with a bank there are some actual human beings that you can rant at and maybe, finally, persuade to take some action. That is getting less and less common these days. Take companies like Google and Meta who pride themselves on not having a single human support person. I even paid for Google support to try and get back into my Google account lol. Here's their reply: "My name is Christopher, and I’ll be taking up your case here today. I understand you are trying to get back into a different Google account but are not able to. I understand how important this is to you to get back into your account. We'll work together to see if we can get you back into the account. You've said you have access to your email address, password and recovery email but you lost your phone number in a fire. Based on that, we currently don't have any other account recovery suggestions for you."
- deleted 3y ago
  [deleted]
- red369 3y ago
  This is an incredible reply to receive! I suppose good current security practice is to assume that most of us will also be in a similar situation one day. There are services that I still have difficulty giving up, which are provided by companies I don't trust to not lock me out forever or to provide customer service. I feel stupid as I type this - are other people in a similar situation? Is the only option to vote with our wallets and choose better/paid providers? I like to think that there's a solution out there which returns us to a time when it didn't feel like account access involved the sword of Damocles: - coming up with the perfect combination of 2FA/Advanced Protection/removing mobile phone number which prevents these arbitrary lockouts, - a popular name and shame website collating these ridiculous examples
- red369 3y ago
  I'm just going to repeat something I've just remembered that I heard recently which might be useful to someone. I read somewhere in a HN comment that someone was able to restore access to a Google account which they were locked out of because they already had all email forwarding from the locked account to another account. One of the options Google offered for unlocking access to an account was having access to email from that same account, which seems ludicrous to me, but in this case worked for that person. As well as setting recovery email addresses, it might be worth turning on forwarding to that recovery email, and a rule in the recovery account to automatically send those emails to trash.
pessimist 3y ago
Support is bad because outsourced everything, and the outsourcing companies are under huge pressure to cut costs and especially human costs. Everything is measured, and extra time responding to complaints is a huge red flag, so its made as hard as possible to interact with humans. Time for empathy is out of the question, and its probably a security risk. In less than 5 years, all of this will be replaced by LLMs, and we will have the luxury of talking to a warm but completely fake human who will provide us even less help than before.
- varispeed 3y ago
  > and the outsourcing companies are under huge pressure to maximise profits and it easiest to achieve at a human costs.
varispeed 3y ago
> Organisations, political parties, etc talk a good game when it comes to “support” or “mental health” or “community” but when the shit hits the fan, they’re all faceless organisations. Morally bankrupt and full of equality adverts and slogans. Yup, that's the UK. Nothing in this country works anymore. People think it does until they have a problem and then they find everything is just a facade. Need to call an ambulance? Emergency service will tell you to take an uber. Been victim of a crime? Police will do their best to make you go away. Victim of a fraud? It was your fault go away. and so on. and you pay for all of it highest taxes in living memory. Sorry for the rant. Elections can't come soon enough.
- gustavus 3y ago
  That's not true my understanding is that the UK police are the best in the world at making sure you are tracked down and punished if you say something unflattering about someone on the internet, or if you happen to be walking around with a chisel, or god-forbid a pocket knife. And then from what I've heard the NHS is the best run health care system in the world[1]. 1. Best run according to this documentary https://www.youtube.com/watch?v=x-5zEb1oS9A https://www.youtube.com/watch?v=x-5zEb1oS9A
  - kergonath 3y ago
    Yes Minister is more accurate than quite a lot of documentaries…
- kergonath 3y ago
  > Sorry for the rant. Elections can't come soon enough. I am sorry but British history says that regardless of how Labour polls today, on election day you’ll still end up with Tories. Or, alternatively, new new Labour for a couple of years and then Tories. That’s pretty much British politics for as long as there has been a UK.
  - cvccvroomvroom 3y ago
    And that explains where British politics and civilization is headed: regulatory capture, chaos, and dysfunction moving towards a conservative utopia because of a feckless left.
lol768 3y ago
"@HSBC_UK allowed fraudsters to transfer all her savings for a period of 6/7 weeks comprised of c.150 transactions to one external account" This doesn't sound right, and the Twitter thread is devoid of much detail as to the root cause here. Last I checked, HSBC had a physical code generator that had to be involved in approving transfers, so how were these transfers (150 of them!) actually made? So, was this actually APP fraud? (in which case - let's not beat around the bush here - it's almost certainly the account holder's fault, but obviously things are less black and white when the account holder is vulnerable). Or was there actually a flaw in HSBC's account security which allowed criminals to gain access to the account? None of these facts excuse the poor customer service, but there's generally good reasoning that these cases are dealt with by a dedicated fraud team and not by random staff in branches. There needs to be more regulation to ensure that they're staffed appropriately and victims aren't left in the lurch, though.
- stevemk14ebr 3y ago
  what makes it 'clearly not right' and why is it 'obviously the account holders fault'? Victim blame much?
  - lol768 3y ago
    > what makes it 'clearly not right' It doesn't add up with my experience of how banks (incl. HSBC) deal with transfers. > Victim blame much? If we can't have a rational conversation about the actual factors leading to these sorts of events (i.e. exactly how the transfers were authorised, where the weakest link in the security chain was), how are we supposed to prevent future occurrences? We can have all of the technical measures in the world in place, but if a customer explicitly consents to someone else logging in, or making these transfers - we should be discussing non-technical solutions instead. Equally, if it turns out that the UI design of the existing security measures was poor and that lead to this case, then that's something that industry can and should improve upon (or be forced to, via regulation).
arp242 3y ago
There was another story a few years ago, which I can't find right now, but I'm fairly certain I remember the details correct: Someone bought a new house to retire with their life savings. Everything was arranged properly, and she transferred the money to the bank account the estate agents told them. But they never received the money. What had happened was that someone had hacked in to the real estate agent email and had sent a fraudulent email, so she transferred the tens of thousands of pounds to the wrong account. This was discovered a few days later. Bank said there's nothing they can do; "your life is destroyed but not our problem kthxfucketybye". Of course the real estate agents took no responsibility either (after all, we all know that the primary function of most people involved in the housing industry is to make everyone as miserable as possible). (I don't recall if things did end up being resolved after a few years; I'd appreciate it if someone remembers the article; IIRC it was in The Guardian).
- TacticalCoder 3y ago
  > What had happened was that someone had hacked in to the real estate agent email and had sent a fraudulent email, so she transferred the tens of thousands of pounds to the wrong account. This was discovered a few days later. That's why I always "warm" bank accounts. I first do a little transfer, then confirm with the person, on the phone, that the money was received. If that's not possible (for example for fully automated system which expect the exact amount), I make 100% sure the account is correct. Invoice from my car dealership asking me to wire 3 K EUR? I call them and ask the secretary to read me loud the bank account number. Note that what you mention is a famous scam in the cryptocurrencies world: replacing Bitcoin deposit addresses (say a Bitcoin deposit address belonging to an exchange like Kraken or Coinbase) with the attacker's address. There are even malware who modify the clipboard when they detect that a Bitcoin address is in the clipboard. Even "better": there are malware that do this while making sure the last four digits are the same as those on the legit address (so people only checking the last four digits and thinking they're good are owned). It's very hard to not get scammed in this mediocre world full of shitty insecure, constantly owned, OSes, phones, websites, etc.: nothing that appears on these shitty devices can be trusted. The problem is so bad people are using 2FA devices and are still getting scammed.
- mminer237 3y ago
LorenPechtel 3y ago
Fundamentally, there's a major conflict of interest here--what incentive do they have to actually investigate? Finding the truth means they're out the money. Letting it sit means they're not. This will persist until we change the laws to make misbehavior more expensive than proper behavior.
xyzelement 3y ago
Feel bad for mum but this guy is annoying. When I have a business relationship with a bank, I don't expect them to show up at my house or be all up in a concern about my mental state. I don't show up at the branch to check in on the mortgage department's mental well being every time the rates go up, I don't send my condolences when the stock price tanks or they have a layoff, etc. It's not the nature of the relationship! The main question is - did the bank fuck up and if so, will they fix their fuckup. The TLDR of this thread seems to be that (1) yes the fucked up and admitted it and (2) the author seems to believe it will be resolved. So that sounds fine. The expectation that the bank will toss mom a few quid outside of their remediation process seems preposterous.
gavinhoward 3y ago
I switched banks semi-recently. The biggest reason I chose this bank is because they have a policy that a human always answers the phone. I tested them on this before I switched, multiple times. Most of the time, it was one ring. It was never more than two. I wish I could tell you all to switch to my bank, but it's a local one, and I'd rather keep that information under wraps.

86 points by fortran77 3y ago

sva_ 3y ago

https://nitter.net/AAMortazavi/status/1713265395388252666 https://nitter.net/AAMortazavi/status/1713265395388252666

deciplex 3y ago
thank you I got banned from Twitter ages ago and never bothered to create another account. I used to not have trouble reading threads like this but among other things with "X" the UI has become absolutely impossible to use lately. I'm not even sure if I'm allowed to read the rest of this thread on Twitter itself but, if I am, how to do it is not at all obvious.
- pengaru 3y ago
  FYI all you need to do (for now) is plain substitute the twitter.com with nitter.net. The links in comments are convenient, but it's trivial to DIY when faced with some twitter thread you want to read without a login.
  - m463 3y ago
    you can make a firefox bookmark with location set to: javascript: (location.hostname="nitter.net")
- marssaxman 3y ago
  If you install the LibRedirect plugin, your browser will automatically rewrite twitter links to nitter.net, which is much more convenient.
- arprocter 3y ago
  Since Xitter decided to play the 'log in to read this' game, Nitter Redirect extension has saved me a lot of annoyance https://addons.mozilla.org/en-US/firefox/addon/nitter-redirect/ https://addons.mozilla.org/en-US/firefox/addon/nitter-redire...
  - idonotknowwhy 3y ago
    Thanks, works on android

tpmx 3y ago

Back in June 2022 there was a landmark decision in the Swedish supreme court (https://www.domstol.se/hogsta-domstolen/avgoranden/2022/115592/ https://www.domstol.se/hogsta-domstolen/avgoranden/2022/1155...) that made the banks responsible in most of these kinds of cases. The same thing needs to happen in other countries. I love the British comedian David Mitchell's long time campaign against this kind of bank behavior: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi... ('’Identity theft’? It’s daylight robbery by the banks' - 2018) https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E (Mitchell & Webb - Identity Theft, 2007)

ghusto 3y ago
I always took the bank's sudden intense interest in my security as serving there concerns, not mine. Not only did it smell insincere and fishy, but it didn't make sense either. Why should I care so much for _their_ service? If they get scammed into giving all my money to someone else, that sounds very much like a _them_ problem, and not a me problem.
- jfim 3y ago
  Even if it's caused by their incompetence, you'll have to sort it out if it happens, and they won't really care all that much.
  - ghusto 3y ago
    At least here, their care isn't really optional. It's their responsibility, since it's their service. I think they have to prove it was through my own fault in order to brush it off, and that's difficult. Difficult enough that when I had to get my money back (lost due to fraud), they didn't ask more than a nominal set of questions.
thfuran 3y ago
I don't understand how the liability could lie elsewhere. I understand why the bank might want to tell a customer "someone else took your money. It sucks to be you", but it seems pretty clear cut that it's no different than the bank somehow misplacing funds for any other reason (at least as far as the customer is concerned. The bank's insurer presumably cares about the particulars of how they're misplacing money).

ceejayoz 3y ago

It's intensely frustrating that most big banks' branch staff are now there just to say "computer says no". They're not empowered to do anything whatsoever. I'm exceedingly glad to have switched to a local credit union.

qingcharles 3y ago
For non-Britishers: https://www.youtube.com/watch?v=0n_Ty_72Qds https://www.youtube.com/watch?v=0n_Ty_72Qds
- FredPret 3y ago
  Thank you! Never knew where this came from.
marssaxman 3y ago
I switched to a local credit union years ago and I can't imagine going back. Service can be slow-moving, but it is always humane. When a fraudster emptied my checking account several years ago, I simply walked into the branch, told them what had happened, identified the fraudulent transactions, and they sorted it out - practically on the spot. I walked away with some cash and a new debit card; the rest of the money was returned later that week. A brief chat with an investigator several weeks later concluded the matter (they had identified the culprit).

dkarl 3y ago

> So we’ll do the whole @financialombuds thing and fill in a million faceless forms. But I bet that not a single person will ever turn up at her home, sit down with her and just talk to her. Shame on you @HSBC_UK Such a weird place to look for care and comfort. Let's grant that an elderly person needs assistance and compassion in this time, and as a community we should provide it. Would we want the bank to provide it? Hell no! There's an enormous conflict of interest there. In this situation I wouldn't want somebody from the bank cozying up to my mom and earning her trust. In fact, I'd go ballistic if they tried. Their financial incentives are to use that trust to persuade her not to exercise her full rights, to avoid her becoming aware of all the avenues of recourse available to her, to make her feel that everything will be okay if she lets the matter drop. What we really want for someone in her situation, besides emotional support, is a savvy legal advocate who will let the bank know that she is aware of her rights and the bank's obligations, and that she has legal resources at her disposal.

rwmj 3y ago
That's great in theory, but you missed the part where the fraudsters stole all her money. There is no Legal Aid for cases like these. Charities or (in this case) relatives are the best hope for her.
- nh23423fefe 3y ago
  Lot of passive voice everywhere for some odd reason
- dkarl 3y ago
  > There is no Legal Aid for cases like these. Charities or (in this case) relatives That's the part that could be fixed. If we manage to provide legal assistance to every criminal defendant who can't afford it, we could provide a consumer advocate for people in her situation, backed up with a lawyer when necessary. They wouldn't have to do much; their attention and their ability to bring legal resources to bear would motivate the bank to do what they are obligated to do.
- avianlyric 3y ago

rwmj 3y ago

Fraud is absolutely rampant[1] and the police / "In-"ActionFraud will do absolutely nothing about it. Combine this with the banks having reduced costs and outsourced everything, and the outcome is cases like this one. [1] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/articles/natureoffraudandcomputermisuseinenglandandwales/yearendingmarch2022 https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand...

mytailorisrich 3y ago

HSBC UK is pretty serious about fraud, actually. Their fraud department calls me several times a year to enquire about any transactions out of the ordinary to the point I am very careful when I travel abroad because I know they are bound to flag the activity.

Havoc 3y ago
Clearly they're phoning the wrong people then
varispeed 3y ago
You sure it is the bank and not fraudsters?
- ceejayoz 3y ago
  This is a serious problem. I had a fraudulent charge today that my credit card company caught. I got both a text and a phone call; the phone call bounced me from person to person, one asking for last four digits, the other asking for name, and when I couldn't immediately find the card to get the CVV the third offered to send me a two-factor code via text to confirm my identity... which said "we will not call and ask for code" in the text message. Still not 100% sure it was the bank, so I asked for a reference number (which they couldn't provide) and said I would call back the number on my card instead.
  - mytailorisrich 3y ago
    HSBC publishes their relevant phone numbers so usually I just call them back. Recently they also have started sending texts instead. They text that "you card ending with xxxx has been used for a transaction of x money at y company, did you make this transaction?" and you just reply Y/N. If you don't reply they start calling.
- mytailorisrich 3y ago
  Yes, fraudsters don't have Indian accents ;)

kylehotchkiss 3y ago

I'm all for giving people agency over their finances for their entire life... but come on... there's got to be some way of asking "did this person really intend to empty their bank account" to that person or a loved one before actually allowing the transaction to succeed. A fraud filter at the bank should see the owners age and know that something is off. Better to be wrong and be an annoying bank instead of mindless like HSBC and allowing this to happen.

mytailorisrich 3y ago
It's the wrong question. What matters is only identity verification, including using all information available as you suggest. But once this has been satisfactorily verified what the person does with their money is none of the bank's concern.

qingcharles 3y ago

At least with a bank there are some actual human beings that you can rant at and maybe, finally, persuade to take some action. That is getting less and less common these days. Take companies like Google and Meta who pride themselves on not having a single human support person. I even paid for Google support to try and get back into my Google account lol. Here's their reply: "My name is Christopher, and I’ll be taking up your case here today. I understand you are trying to get back into a different Google account but are not able to. I understand how important this is to you to get back into your account. We'll work together to see if we can get you back into the account. You've said you have access to your email address, password and recovery email but you lost your phone number in a fire. Based on that, we currently don't have any other account recovery suggestions for you."

deleted 3y ago
[deleted]
red369 3y ago
This is an incredible reply to receive! I suppose good current security practice is to assume that most of us will also be in a similar situation one day. There are services that I still have difficulty giving up, which are provided by companies I don't trust to not lock me out forever or to provide customer service. I feel stupid as I type this - are other people in a similar situation? Is the only option to vote with our wallets and choose better/paid providers? I like to think that there's a solution out there which returns us to a time when it didn't feel like account access involved the sword of Damocles: - coming up with the perfect combination of 2FA/Advanced Protection/removing mobile phone number which prevents these arbitrary lockouts, - a popular name and shame website collating these ridiculous examples
red369 3y ago
I'm just going to repeat something I've just remembered that I heard recently which might be useful to someone. I read somewhere in a HN comment that someone was able to restore access to a Google account which they were locked out of because they already had all email forwarding from the locked account to another account. One of the options Google offered for unlocking access to an account was having access to email from that same account, which seems ludicrous to me, but in this case worked for that person. As well as setting recovery email addresses, it might be worth turning on forwarding to that recovery email, and a rule in the recovery account to automatically send those emails to trash.

pessimist 3y ago

Support is bad because outsourced everything, and the outsourcing companies are under huge pressure to cut costs and especially human costs. Everything is measured, and extra time responding to complaints is a huge red flag, so its made as hard as possible to interact with humans. Time for empathy is out of the question, and its probably a security risk. In less than 5 years, all of this will be replaced by LLMs, and we will have the luxury of talking to a warm but completely fake human who will provide us even less help than before.

varispeed 3y ago
> and the outsourcing companies are under huge pressure to maximise profits and it easiest to achieve at a human costs.

varispeed 3y ago

> Organisations, political parties, etc talk a good game when it comes to “support” or “mental health” or “community” but when the shit hits the fan, they’re all faceless organisations. Morally bankrupt and full of equality adverts and slogans. Yup, that's the UK. Nothing in this country works anymore. People think it does until they have a problem and then they find everything is just a facade. Need to call an ambulance? Emergency service will tell you to take an uber. Been victim of a crime? Police will do their best to make you go away. Victim of a fraud? It was your fault go away. and so on. and you pay for all of it highest taxes in living memory. Sorry for the rant. Elections can't come soon enough.

gustavus 3y ago
That's not true my understanding is that the UK police are the best in the world at making sure you are tracked down and punished if you say something unflattering about someone on the internet, or if you happen to be walking around with a chisel, or god-forbid a pocket knife. And then from what I've heard the NHS is the best run health care system in the world[1]. 1. Best run according to this documentary https://www.youtube.com/watch?v=x-5zEb1oS9A https://www.youtube.com/watch?v=x-5zEb1oS9A
- kergonath 3y ago
  Yes Minister is more accurate than quite a lot of documentaries…
kergonath 3y ago
> Sorry for the rant. Elections can't come soon enough. I am sorry but British history says that regardless of how Labour polls today, on election day you’ll still end up with Tories. Or, alternatively, new new Labour for a couple of years and then Tories. That’s pretty much British politics for as long as there has been a UK.
- cvccvroomvroom 3y ago
  And that explains where British politics and civilization is headed: regulatory capture, chaos, and dysfunction moving towards a conservative utopia because of a feckless left.

lol768 3y ago

"@HSBC_UK allowed fraudsters to transfer all her savings for a period of 6/7 weeks comprised of c.150 transactions to one external account" This doesn't sound right, and the Twitter thread is devoid of much detail as to the root cause here. Last I checked, HSBC had a physical code generator that had to be involved in approving transfers, so how were these transfers (150 of them!) actually made? So, was this actually APP fraud? (in which case - let's not beat around the bush here - it's almost certainly the account holder's fault, but obviously things are less black and white when the account holder is vulnerable). Or was there actually a flaw in HSBC's account security which allowed criminals to gain access to the account? None of these facts excuse the poor customer service, but there's generally good reasoning that these cases are dealt with by a dedicated fraud team and not by random staff in branches. There needs to be more regulation to ensure that they're staffed appropriately and victims aren't left in the lurch, though.

stevemk14ebr 3y ago
what makes it 'clearly not right' and why is it 'obviously the account holders fault'? Victim blame much?
- lol768 3y ago
  > what makes it 'clearly not right' It doesn't add up with my experience of how banks (incl. HSBC) deal with transfers. > Victim blame much? If we can't have a rational conversation about the actual factors leading to these sorts of events (i.e. exactly how the transfers were authorised, where the weakest link in the security chain was), how are we supposed to prevent future occurrences? We can have all of the technical measures in the world in place, but if a customer explicitly consents to someone else logging in, or making these transfers - we should be discussing non-technical solutions instead. Equally, if it turns out that the UI design of the existing security measures was poor and that lead to this case, then that's something that industry can and should improve upon (or be forced to, via regulation).

arp242 3y ago

There was another story a few years ago, which I can't find right now, but I'm fairly certain I remember the details correct: Someone bought a new house to retire with their life savings. Everything was arranged properly, and she transferred the money to the bank account the estate agents told them. But they never received the money. What had happened was that someone had hacked in to the real estate agent email and had sent a fraudulent email, so she transferred the tens of thousands of pounds to the wrong account. This was discovered a few days later. Bank said there's nothing they can do; "your life is destroyed but not our problem kthxfucketybye". Of course the real estate agents took no responsibility either (after all, we all know that the primary function of most people involved in the housing industry is to make everyone as miserable as possible). (I don't recall if things did end up being resolved after a few years; I'd appreciate it if someone remembers the article; IIRC it was in The Guardian).

TacticalCoder 3y ago
> What had happened was that someone had hacked in to the real estate agent email and had sent a fraudulent email, so she transferred the tens of thousands of pounds to the wrong account. This was discovered a few days later. That's why I always "warm" bank accounts. I first do a little transfer, then confirm with the person, on the phone, that the money was received. If that's not possible (for example for fully automated system which expect the exact amount), I make 100% sure the account is correct. Invoice from my car dealership asking me to wire 3 K EUR? I call them and ask the secretary to read me loud the bank account number. Note that what you mention is a famous scam in the cryptocurrencies world: replacing Bitcoin deposit addresses (say a Bitcoin deposit address belonging to an exchange like Kraken or Coinbase) with the attacker's address. There are even malware who modify the clipboard when they detect that a Bitcoin address is in the clipboard. Even "better": there are malware that do this while making sure the last four digits are the same as those on the legit address (so people only checking the last four digits and thinking they're good are owned). It's very hard to not get scammed in this mediocre world full of shitty insecure, constantly owned, OSes, phones, websites, etc.: nothing that appears on these shitty devices can be trusted. The problem is so bad people are using 2FA devices and are still getting scammed.
mminer237 3y ago

LorenPechtel 3y ago

Fundamentally, there's a major conflict of interest here--what incentive do they have to actually investigate? Finding the truth means they're out the money. Letting it sit means they're not. This will persist until we change the laws to make misbehavior more expensive than proper behavior.

xyzelement 3y ago

Feel bad for mum but this guy is annoying. When I have a business relationship with a bank, I don't expect them to show up at my house or be all up in a concern about my mental state. I don't show up at the branch to check in on the mortgage department's mental well being every time the rates go up, I don't send my condolences when the stock price tanks or they have a layoff, etc. It's not the nature of the relationship! The main question is - did the bank fuck up and if so, will they fix their fuckup. The TLDR of this thread seems to be that (1) yes the fucked up and admitted it and (2) the author seems to believe it will be resolved. So that sounds fine. The expectation that the bank will toss mom a few quid outside of their remediation process seems preposterous.

gavinhoward 3y ago

I switched banks semi-recently. The biggest reason I chose this bank is because they have a policy that a human always answers the phone. I tested them on this before I switched, multiple times. Most of the time, it was one ring. It was never more than two. I wish I could tell you all to switch to my bank, but it's a local one, and I'd rather keep that information under wraps.