14 ms·

Making it clear when we're on a call with you to protect you from fraud

315 points by edward 3y ago

d-z-m 3y ago
> This blog post was accurate when we published it – head to monzo.com or your Monzo app for the most up to date information. I am on monzo.com
chidi0202 3y ago
[dead]
Jinabryte 3y ago
If not for the intervention of this genius hacker Vadimwebhack@ gmail'com I would have been in jail for an offense I did not commit. I was accused of diverting money given to me by the company I work for. I only suspected one person who would possibly guess my passwords. He was my best friend until I had no choice but tohire Vadimwebhack@ gmail'com who granted me full access to all messages on his phone. I was in tears when I read his WhatsApp conversation with another colleague of mine where he said he hates my guts and he will make sure he gets me in trouble with the company and his plan was to divert funds in my name. I am still traumatized I can't even keep friends anymore. If you need help with anything, contact Vadimwebhack@ gmail. com he saved me. He offers many other services like -recovering lost accounts -credit repair -erasing
8organicbits 3y ago
Interesting approach, I'd worry call times would get longer (annoying customers, increasing call center costs). I also wonder how many customer would actually check, if it's a small number then it seems like this just pushes liability to the customer.
- consp 3y ago
  In some jurisdictions I'm pretty sure you cannot shift this liability and this might just be a way for the bank to cover its own losses instead of ass.
sen 3y ago
My bank has done similar for a few years. If someone calls you, they ask you to open the phone app and you get an in-app notification (banner in the app itself, not OS related) that says “Click OK to confirm <rep name> is talking to you” (or some such). They can’t access you account details until you click it.
- david-gpu 3y ago
  > If someone calls you, they ask you to open the phone app and you get an in-app notification You mean that if a genuine bank representative calls you then they prompt you to verify it. A fraudster will not do that and if the customer doesn't challenge them then the scam can continue. One of my fears around getting older is not having the wits to protect myself from bank fraud like this. I don't have a solution.
  - pbhjpbhj 3y ago
    Enduring Power of Attorney (in the UK, now called Lasting Power of Attorney [1]) is a solution of sorts. You given up the ability to access your accounts to a third party, usually a relative. It's used when people lose their mental faculties and are incapable of acting for themselves; it can be elective, or imposed by the court in a very long process. [1] https://www.gov.uk/power-of-attorney https://www.gov.uk/power-of-attorney
    - traceroute66 3y ago
      Oof ... a PoA is a bit of a sledgehammer to crack a nut for many people, especially those who still have a perfectly fine mental faculty. Most UK financial companies will have a third-party authority process. Its the sort of thing used to give professional advisors access to the account, but there is absolutely no reason it cannot be used to give other sorts of third-parties access. The core difference is that a TPA is technically temporary (and thus will need to be renewed on a schedule, typically annually), whilst a POA is a more permanent affair and that's why a POA is a pain in the rectum to setup.
    - adhesive_wombat 3y ago
V__ 3y ago
Are there banks/companies proactively trying to trick customers? Call, then throw up some red flags, then educate? Especially for older customers a "near-miss" might be helpful to lower the risk of them getting scammed.
- amelius 3y ago
  Pentesting for the elderly? Sounds like a cool service.
- timenova 3y ago
  Banks in my country send all sorts of emails with "scammy" subjects, and then when you open them their banner says "Don't fall for such scams" or "Scams start this way". Maybe if they added an option to opt-out of such emails, it would be pretty nice! Now it's just more inbox noise. And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.
  - lambertsimnel 3y ago
    Banks in the UK do all sorts of scammy things, not for that purpose, but as part of their usual business Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof They call customers and ask for security information They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do All of the above risk causing customers to lower their guard to fraud They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard) They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
    - 3y ago
xenocratus 3y ago
One thing I wonder is if this works when you call Monzo as well - once you give them your details, does the same thing appear in the app? Because that opens the door for a man-in-the-middle attack. Actually, in that case it makes the attack so much worse, because it legitimises the attacker.
- jonathanlydall 3y ago
  Also my first question.
- Gare 3y ago
  Why not just have an ability to call in-app via secure voice chat?
  - bartvk 3y ago
    Yeah, I didn’t get that either.
  - andrewfromx 3y ago
    because they want to be able to dial a normal phone number to make your phone ring to get your attention.
    - vinay_ys 3y ago
      hmm, WhatsApp rings my phone more than regular phone network and like me billions of people pick-up WhatsApp calls everyday.
      - andrewfromx 3y ago
        this is true, but for most american's we still use a phone number and do not have any thing like WhatsApp, Signal, or Telegram installed on our phones. The phone number ring is still gold here.
- imakeinternet 3y ago
  Well that would rely on you being able to call Monzo in the first place. None of the numbers you are able to find take you to a person, instead infinitely redirecting you to use the in-app chat... which is more "Leave us a message and we'll pick it up on Monday" than an actual live chat. Background: Monzo froze _all_ of my bank accounts for nearly 5 days after triggering some fraud protection measures. Great in theory... until you are completely unable to speak to anyone.
pluc 3y ago
Wise will include a user-set keyword on all communications: https://wise.com/help/articles/2932695/watch-out-for-phishing https://wise.com/help/articles/2932695/watch-out-for-phishin...
- gokhan 3y ago
  This was tried long ago,then cancelled, in Turkey. Perverts will set it to something they want to hear from call center agent and trigger a call where the poor agent will need to read out loud.
  - internetter 3y ago
    Should probably be changed to a random string like “flying neon dollar” Also wtf
  - pluc 3y ago
    That's pretty easy to work around if there's a will to do it. A single word, a character limit, a dictionary validation or a non-UGC generation are all pretty simple things to implement.
perpil 3y ago
"Privacy & settings – where it lives now – is a natural home for it, but we think it should appear elsewhere too." Seems like the next step would be to send an app push notification before the call and to have a banner that's visible as soon as you log in to the app. Some sort of visual indicator that appears everywhere in the app that you should not be on a call may also reduce an attackers chance of succeeding.
- jeroenhd 3y ago
  I don't know how iOS handles this, but on Android you can get permissions to check if the user is currently in a call. Often this is done to mute media when you accept a call, but I can also imagine any sensitive apps popping up a message on their home screen to indicate whether or not a real customer support agent is trying to reach out to you. I don't think you can get details about the call that easily (like phone number and such) but with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.
  - vitus 3y ago
    Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). There are plenty of scams based on impersonating some official (FBI, IRS, etc). It's not hard to imagine a scammer spoofing your bank's phone number [0, 1, 2, 3]. [0] https://www.snbonline.com/about/news/scammers-can-spoof-an-official-phone-number-heres-how-to-tell https://www.snbonline.com/about/news/scammers-can-spoof-an-o... [1] https://www.westernbank.com/fraud-prevention/what-you-should-know-about-caller-id-spoofing/ https://www.westernbank.com/fraud-prevention/what-you-should... [2] https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/ https://www.wellsfargo.com/privacy-security/fraud/bank-scams... [3] https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing
    - Sebb767 3y ago
      > Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). I think this can be solved far more simply by only showing the notification/warning (or showing it more visibly) when the app detects you are in a call.
deleted 3y ago
[deleted]
nonrandomstring 3y ago
Both a good and bad idea. Obviously dependency on a side/control channel limits this. Better? Mix and broadcast authentication beacons over the audio channel. If it got there, by whatever transport the audio did, you're good to use them as a MAC against some key.
- simonw 3y ago
  Can you expand on that? I don't understand what you mean.
  - nonrandomstring 3y ago
    Sure, what I'm specifically addressing is "can we do it without the internet bit?", because as a security solution I see it as a bit of a problem relying on that. Since the person is calling with a duplex audio link already, by GSM or whatever, why not use that? There are many, many ways (modems of a kind) of putting an (almost) inaudible signal into audio. Those could easily be short message authenticators, just a sequence of digits that derive from some frames of the audio, they might sound like little high frequency blips. Can you see how that might work? [edit] Forgot to say; those frames would get hashed along with some private part of a public key, or sym-key that only you (the user) has. A fake caller wouldn't be able to spoof them easily, and so they wouldn't decode at the client side correctly.
    - esprehn 3y ago
      How do you expect that to work? Their app would either need to have access to all your phone calls, or you'd need separate hardware to detect and authenticate the audio?
      - nonrandomstring 3y ago
        Correct, an app would need to read the audio stream and do some preparatory DSP to extract audio short codes. Of course you could build standards in at a point closer to the radio basebands. I mean, why is basic source authentication not built in as far back as SS7 given we had the technology even in the 1970s? The only time you'd be using the app would be if receiving a call from an untrusted caller. And if you don't trust the app period, then the game is off anyway. In theory the same app could hold certs from a number of "trustworthy" sources you might like to check; much like a TLS certificate. But in the end you'd wind up with too many, and hard to keep track of, and then buffoons like those from the EU commission would be wanting to "force trust" upon you to authenticate "approved government sources" - Which sadly is the problem with all source authentication schemes that work with PKI this way. You really need to keep the application layer relation 1-to-1. I prefer simpler, elegant solutions - like your bank should never call you or push ANYTHING which is why I called it both a good and bad idea, and generally I distrust the whole ecosystem, of "apps" anyway.
FartyMcFarter 3y ago
I have another idea for Monzo: never call people. You can't rely on people being able to talk on the phone for accessibility reasons, so it should never be necessary to call people on the phone. Instead, handle things by the app or wait for customers to call you.
- simonw 3y ago
  From that article: > Remember, we will never call you without arranging it with you first through in-app chat.
  - FartyMcFarter 3y ago
    Right - so why not simply ask people to call them? It would make it a lot simpler to ensure there's no fraudulent calls. No need for some fancy verification method like the one outlined in this article.
    - simonw 3y ago
      The app verification method is better - it helps protect against people being tricked into calling a fake number (through a deceptive text message, email or internet search).
      - FartyMcFarter 3y ago
        If people can be convinced to use the app for verification, why can't they be convinced to use the app to find the correct number to call? I think the latter is much more natural for most.
        simonw 3y ago
        I also like that I can skip a lot of the authentication steps by requesting a call from within the app - that way they already have a head start on identifying me when the call starts.
mcny 3y ago
Ally Bank on the other hand has outsourced its debit card to the worst possible company out there. They called me and asked me for my social security number. I said is this a security training? Are you testing me? He said no, my card was recently used (it was me I was trying to withdraw USD 400) and I said I refuse to either confirm or deny anything on an incoming call. This RUDE person said well my debit card will remain locked until I answer their questions. I said fine I'll call my bank. My card remains locked to this day.
- cianmm 3y ago
  While their security practices sound woeful and you did the right thing, why haven't you called your bank to unlock your card and give the feedback that the outsourcing is awful?
  - firtoz 3y ago
    It's probably less effort to switch to another bank.
  - Sebb767 3y ago
    With those security practices in place, locked is probably the status the card should have.
    - talkin 3y ago
      Who says it’s their security practice… The way the top post is told, I would assume the call to be made by an attacker . :)
- JumpCrisscross 3y ago
  > person said well my debit card will remain locked until I answer their questions You also have the option of reporting them to your state banking regulator [1], the CFPB [2], the FDIC [3] and FTC [4]. A polite way to do this is to write a letter to your bank explaining what happened and Cc’ing the regulators. It will tend to get escalated to their legal department and has a chance of forcing policy change (and producing compensation). [1] https://www.consumerfinance.gov/ask-cfpb/how-do-i-find-my-states-bank-regulator-en-1637/ https://www.consumerfinance.gov/ask-cfpb/how-do-i-find-my-st... [2] https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/ [3] https://www.fdic.gov/contact/ https://www.fdic.gov/contact/ [4] https://reportfraud.ftc.gov/#/ https://reportfraud.ftc.gov/#/
throwaway_qwe 3y ago
I was recently a target of a UK online bank phishing scam (not Monzo). They were highly sophisticated. They knew details of recent transactions, including bank transaction numbers that don’t show in any qif export or anything. They had a plausible reason to call (based on said visibility). They had researched my name and everything about me and my family that is online. They faked caller ID. Their ‘patter’ was so advanced that I do not know this extra layer of protection would have helped much. Luckily I didn’t finish the steps and lost no money. It is clear the bank has had a severe exfiltration event. There are other reports that online. IMHO the law should make banks report breaches to the ICO and a record of the nature and size of the breach be public. Through the process I learned that in the UK you can call 159 to directly contact your bank fraud dept (most banks) https://stopscamsuk.org.uk/159 https://stopscamsuk.org.uk/159 I also learnt about the police’s Action Fraud hotline to report cybercrime. https://www.actionfraud.police.uk/what-is-action-fraud https://www.actionfraud.police.uk/what-is-action-fraud The phisher was very determined. They called back in 15 minutes claiming to be from the bank fraud dept returning my call. Then 2 weeks later they called back claiming to be from Action Fraud. However prepared you think you are for such an attack, my advice is to have utmost caution for every single call from anyone claiming to be anyone. I also have a Monzo account. Even if they called me I wouldn’t use this. Hang up. Call them. Don’t let them call you.
- switch007 3y ago
  Which bank? (Slightly worried UK resident here!)
  - throwaway_qwe 3y ago
    One of those on the 159 programme https://stopscamsuk.org.uk/159 https://stopscamsuk.org.uk/159 Honestly, I’m not sure it matters. They’ve all had such incidents. I read somewhere that about 30% of your fees and mortgage interest go toward fraud mitigation,monitoring, and restitution. I always live by these rules - call them back, don’t talk to them - ask why you need to do anything. It’s exceedingly rare a bank would call you to do something legit there and then. “I will do it later” will help. In fact that’s how I caught the phisher as I noted the aggravation in 1% of his voice. - use credit cards, not debit cards, for purchases. They have far more protection. - use all the 2FA and password complexity you can - never use real info for challenge questions. Never use maiden name of mother etc. you can put “14 green fish” as the answer to the question if you like. - make sure they are FSCS regulated, and try not to exceed that limit. - understand FSCS does not cover you most phishing attempts, since the bank will claim they tried to warn you and were not negligent - use private tabs for bank interactions Through this experience I have learned not to trust “what we know about you” information they share. Do not underestimate HUMINT. A bank snitch could give up something as seemingly innocent (to them) as your “join date” and it be a lynchpin piece of info for a scammer. This may all seem obvious to an HM reader. But it’s worth refreshing and reiterating.
radres 3y ago
people who fall for scams on phone are the ones who wouldn't hear about news like this.
- Sebb767 3y ago
  Don't be so sure of that. A lot of really smart people can fall for scams because they are caught off-guard or are focused on getting something done, discarding some necessary caution along the way.
ryandrake 3y ago
This is a nice feature but the root problem is how trusting people are of the totally insecure phone system. We all have to have “the talk” with our elderly parents, where we try to convince them to never do business over phone or e-mail unless they themselves initiated the conversation. No legitimate business will call you and expect you to pay money, give them access to a computer, ask for security codes, or anything like that. Always hang up, and if you think it’s actually life-or-death important (hint: it isn’t), call them back in their official number. My parents got scammed in the past so they are on the lookout, but I still don’t think they are careful enough. And due to their age they get attacked a lot! Last time I visited, their phone was ringing every hour or two--all scam/spam. It’s only a matter of time until the next one is clever enough to get through. I think these “external caller” scams are going to be with us until that generation dies out. The “trust the phone” instinct is too strong. Of course for my generation, the scammers will find something we inherently trust and exploit that, I have no doubt.
- otteromkram 3y ago
  I think this should be hammered into everyone's head and am surprised it isn't already. I get regular emails from retailers and banks reminding me that they will never call and ask for money or personal info. Then they state exactly what you said; hang up and call the institution's official number if you're unsure who is calling. (Note: a quick way to find the official number is by looking on your debit/credit card. It should be printed on there.) (Note note: Don't sign your credit/debit card. Put "SEE ID" or something in the signature area.)
  - aqfamnzc 3y ago
    Why not sign the card?
    - CharlieDigital 3y ago
      "SEE ID" is an explicit instruction. But I haven't had anyone check the card in ages.
vinay_ys 3y ago
A bank that never calls or messages via traditional phone/mobile network and never uses email is the best. Always use secure in-app communication. And use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Don't depend on another channel for resetting any of the credentials. Educate the user that you will never contact them via any other means. Establish these secure expectations with the user from day-0. Within the app, always do additional factor authentication for any monetary transaction. On the server-side, have per-transaction, per-day limits for fund transfers. For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. Notify the user during this cooling-off period and give them ample opportunity to intervene if they think it is a mistake or fraud. Have low-friction instant payments only to pre-verified and registered merchant addresses. For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. For out-of-network (say international) instant transfers, definitely require payees to be verified and added to payer's account and have fraud protection funds to enable swift clawback and legal frameworks for prosecution across international borders. Without these types of protection, any increasing in banking velocity is bound to result in more fraud harm than traditionally accepted.
- bertil 3y ago
  I'm a Monzo client and honestly, I'm surprised they even offer the option. They do everything on-line if they can: it's cheaper for them, and I find it more convenient, on top of all the reasons you listed. I suspect phone calls only happen at the very edge of rare branches, with elderly or handicapped clients, complex transactions, when ID checks fail, etc. They might not do it at all, and had added that feature in the rares of cases they might — but making it visible as “this changes color if we call you” makes a more compelling story than they previous “we never call you” if you are on the phone with a high-pressure scammer.
  - avianlyric 3y ago
    Banks in the UK are legally obligated to provide phone support to their customers. Monzo mostly doesn’t do outbound calls at all, pretty much the only situation they’ll do an outbound call is if it’s a pre-arranged call to discuss a complaint, or difficult situation (death of a customer etc).
rs_rs_rs_rs_rs 3y ago
After an unfortunate event I managed to teach family members to never do any kind of bank actions in a call where they were the ones being called. Always end that call and then call the bank support back using the number they all know how to find on their credit/debit cards.
- vinay_ys 3y ago
  Most irritating thing the Amex did recently to me is to call me from a random number and then proceeded to ask me for my personal details like date of birth etc for "verification purposes". I promptly refused to provide any details as I have no way to authenticate them and cut the call. They are basically educating their customers to become vulnerable to fraudsters and I told them as much. But the call center person is the wrong person to hear that from me.
Cthulhu_ 3y ago
This is insecure because it relies on people having the app installed and knowing to check it. Why not call the user through the app itself? Why not send a notification through the app telling the user to find the official support line and call that? Banks should not call you anymore since it cannot be trusted.
- noodlesUK 3y ago
  For context, the app is monzo bank. You can’t bank with them without the app, they’re a challenger bank. Essentially all interaction is through that app. What surprises me is that they didn’t just put a webrtc call function hidden in the app so they could call you over a secure channel in the rare case that they needed to call you.
otteromkram 3y ago
I would almost bet that 100% susceptible to scams won't remember to check an app for call verification. Or, maybe I'm just a skeptical curmudgeon...
Horffupolde 3y ago
The problem is not with the call but with who is calling you. If you can authenticate the caller, all’s fine.
stavros 3y ago
This is a great idea, but there's one problem I see with it: When I'm in a call, my internet doesn't work if I'm not on wifi, as the modem is busy with the call. I believe this doesn't happen if you have VoLTE, but it does mean that this feature can't work for many many people.
- pests 3y ago
  Yep, CSMA needs Voice over LTE (VoLTE) or else data is enabled while the call falls back to 3g.
  - pests 3y ago
    disabled*
agilob 3y ago
Monzo is bleeding edge in many things, but their customer support is making people leave this bank. It used to be one of the best in the UK, now it's just hard to find a worse one. Read about the stories here https://old.reddit.com/r/UKPersonalFinance/comments/17kvo4j/tsb_reimbursed_15_times_more_customers_fraud/ https://old.reddit.com/r/UKPersonalFinance/comments/17kvo4j/... >TSB reimbursed 15 times more customers’ fraud losses than Monzo in 2022 https://www.theguardian.com/technology/2023/oct/31/tsb-reimbursed-15-times-more-customers-losses-than-monzo-in-2022 https://www.theguardian.com/technology/2023/oct/31/tsb-reimb...
sailorganymede 3y ago
I absolutely love this feature so much. I work at a competitor of Monzo and this is definitely something I'll bring up with our Product team to see if we are thinking about this.
notnmeyer 3y ago
this is a cool feature! i had someone call me recently claiming to be from coinbase and try to get me to enter a password reset code into a site hosted at “w-coinbase.com”. they claimed my account was compromised and “locked” (it wasn’t). i humored the guy and asked for a help page from coinbase that listed “w-coinbase.com” as one of their official domains. they genius asked me to trust him, or i could talk to his manager who would share my ssn with me as “proof”. i talked to the guy for like an hour asking him to put himself in my shoes, or explain why i couldn’t address the issue myself with a password reset or redoing my mfa setup. he got really angry, saying i was berating him for doing his job. i suggested he give me a case number and i’d call back into coinbase’s support line. he gave me a six digit number and then hung up abruptly when i said i’d call him back. it was glorious. anyway, every one should have a feature like this.
- throwaway290 3y ago
  nice, Atomic Shrimp vibe!
switch007 3y ago
It's a cat-and-mouse game of banks saving money by closing branches (or never having them in the first place) and wanting to make fraud as much as the customer's fault as possible, and implementing new laws to shift some of the burden back to the banks and other organisations and creating toothless regulators for political marketing purposes.
jakub_g 3y ago
Interestingly, ING Bank in Poland just introduced the same, as well as U2F key support. https://niebezpiecznik.pl/post/istotne-zmiany-w-aplikacji-mobilnej-ing/ https://niebezpiecznik.pl/post/istotne-zmiany-w-aplikacji-mo...
petesergeant 3y ago
I live in UAE, and everyone here has a pretty sophisticated government ID, linked to a smartphone app, that performs single sign-on for all government services. Your ID number is not especially secret. Anyway, a frequent scam here is that someone calls you claiming to be the police or the government, and then generates a SSO request on your phone via trying to sign in to a government website using your EID number, and the request certainly adds a layer of seeming authenticity
neilv 3y ago
What if the scammer initiates a call with the company, separate from the call they're having with you? What will that indicator say?
nolongerthere 3y ago
Really what we need is reverse 2FA, when I'm on a call with someone who is asking for sensitive info I should be able to generate a 6 digit number in their app or website and request that they verify it, if they can't verify it, they're not with the bank. simple. I had an issue where a bank (chase) called me to verify a transaction it felt was illegitimate, first thing the bank employee (who claimed to be with the fraud department) did was send me a SMS 2FA code that clearly said "do not share with ANYONE" I told him that and he said "yes, but I need it to confirm you are who I'm trying to reach, if you don't give it to me I will lock your account" ... My account was locked and I had to go into a branch, present 2 forms of photo ID to create a new userID and password and be able to use my cards/access my (new) account again. I had some very strong words for the branch manager and anyone who would listen about how terrible a security practice it is to give those sorts of conflicting instructions.
- throwaway290 3y ago
  You did the right thing. I don't even have two forms of photo ID. I think I would just leave to another bank immediately if it was an option
  - dredmorbius 3y ago
    As much as I tend to agree with you, people who have loans, particularly mortgages, which are frequently traded amongst financial institutions, are locked in to a particular company like it or not. But for retail banking, supposing you actually have the option, yes, absolutely.
    - logifail 3y ago
      > people who have loans, particularly mortgages, which are frequently traded amongst financial institutions, are locked in to a particular company like it or not When we got the mortgage for our house, we went out of our way to arrange it with a bank with which we had (and have since had) no other dealings. Result: Our "mortgage bank" has no insight into our day-to-day finances. Our "day-to-day bank" has no insight into our mortgage.
3guk 3y ago
I just don't pick up the phone to numbers that are not saved in my contacts anymore - seems to have saved me a tonne of hassle.
electrondood 3y ago
1. Bank notifies you to call them, but you initiate the call. 2. Bank confirms your identity with some inconsequential piece of information: a verbal passcode, the approximate dollar amount of two recent transactions, etc. If the bank initiates the call, ask for their name and call the bank back.
graypegg 3y ago
This feels like it would be useful as a general protocol. A signed app on your phone, can register some special endpoint into a registry that responds with if the user logged into the app is being called. Put some button in the phone interface for “Verify”, which pings all of these endpoints, and either shows a logo and a success message, or an unknown caller warning. You wouldn’t want it to ping these services on every call, so it would have to be an action you just train people to do. Better than hiding it in an app though, this should be an OS concern somehow.
neltnerb 3y ago
I'm confused, how easy do they think it is to answer the phone, and then use the phone simultaneously for a call while opening their app and (presumably) authenticating with the app in order to get this information? I can barely handle adding a calendar event while on a call without accidentally hanging up or something, what a weird UI. Why do they not just contact you via their installed app if they're going to assume you have it installed...
michaelteter 3y ago
We're at the point now, particularly where a phone app is part of the security process, that the phone app itself should have direct/private "phone" calling capability between the user of the app and the company. Obviously we have this within common chat apps, and we know there are good open source frameworks for doing this. Company calls consumer via their private company-to-app system, app alerts user of an incoming communication request, and user accepts and has a voice conversation. Then of course it becomes a question of the security quality of the app and communication design between it and the company, but presumably if that is broken then any app-based status or verification would also be broken.
asylteltine 3y ago
Someone has to say it… if I get a phone call and it’s an Indian, it’s 100% a scam and I hang up. Good rule to live by these days.
miki123211 3y ago
Bank apps should have the ability to see if you're on a call when the app is opened. If this is the case and the call doesn't actually originate from their systems, they should ask you whether you're currently called by them and freeze your account if yes is clicked.
ChildOfChaos 3y ago
Monzo are horrible. Hate them, they closed my account a few months after opening it without any reason or ability to appeal. I did nothing wrong, just a normal user, was just testing it out the first couple of months so didn't use it for much, was about to move everything over to it and then they closed my account and i can never have an account with them again. Awful company, who pretend to be friendly and cutting edge, but just gatekeep customers and cut them off without warning for whatever reason they wish.

315 points by edward 3y ago

> This blog post was accurate when we published it – head to monzo.com or your Monzo app for the most up to date information. I am on monzo.com

chidi0202 3y ago

[dead]

Jinabryte 3y ago

If not for the intervention of this genius hacker Vadimwebhack@ gmail'com I would have been in jail for an offense I did not commit. I was accused of diverting money given to me by the company I work for. I only suspected one person who would possibly guess my passwords. He was my best friend until I had no choice but tohire Vadimwebhack@ gmail'com who granted me full access to all messages on his phone. I was in tears when I read his WhatsApp conversation with another colleague of mine where he said he hates my guts and he will make sure he gets me in trouble with the company and his plan was to divert funds in my name. I am still traumatized I can't even keep friends anymore. If you need help with anything, contact Vadimwebhack@ gmail. com he saved me. He offers many other services like -recovering lost accounts -credit repair -erasing

8organicbits 3y ago

Interesting approach, I'd worry call times would get longer (annoying customers, increasing call center costs). I also wonder how many customer would actually check, if it's a small number then it seems like this just pushes liability to the customer.

consp 3y ago
In some jurisdictions I'm pretty sure you cannot shift this liability and this might just be a way for the bank to cover its own losses instead of ass.

sen 3y ago

My bank has done similar for a few years. If someone calls you, they ask you to open the phone app and you get an in-app notification (banner in the app itself, not OS related) that says “Click OK to confirm <rep name> is talking to you” (or some such). They can’t access you account details until you click it.

david-gpu 3y ago
> If someone calls you, they ask you to open the phone app and you get an in-app notification You mean that if a genuine bank representative calls you then they prompt you to verify it. A fraudster will not do that and if the customer doesn't challenge them then the scam can continue. One of my fears around getting older is not having the wits to protect myself from bank fraud like this. I don't have a solution.
- pbhjpbhj 3y ago
  Enduring Power of Attorney (in the UK, now called Lasting Power of Attorney [1]) is a solution of sorts. You given up the ability to access your accounts to a third party, usually a relative. It's used when people lose their mental faculties and are incapable of acting for themselves; it can be elective, or imposed by the court in a very long process. [1] https://www.gov.uk/power-of-attorney https://www.gov.uk/power-of-attorney
  - traceroute66 3y ago
    Oof ... a PoA is a bit of a sledgehammer to crack a nut for many people, especially those who still have a perfectly fine mental faculty. Most UK financial companies will have a third-party authority process. Its the sort of thing used to give professional advisors access to the account, but there is absolutely no reason it cannot be used to give other sorts of third-parties access. The core difference is that a TPA is technically temporary (and thus will need to be renewed on a schedule, typically annually), whilst a POA is a more permanent affair and that's why a POA is a pain in the rectum to setup.
  - adhesive_wombat 3y ago

V__ 3y ago

Are there banks/companies proactively trying to trick customers? Call, then throw up some red flags, then educate? Especially for older customers a "near-miss" might be helpful to lower the risk of them getting scammed.

amelius 3y ago
Pentesting for the elderly? Sounds like a cool service.
timenova 3y ago
Banks in my country send all sorts of emails with "scammy" subjects, and then when you open them their banner says "Don't fall for such scams" or "Scams start this way". Maybe if they added an option to opt-out of such emails, it would be pretty nice! Now it's just more inbox noise. And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.
- lambertsimnel 3y ago
  Banks in the UK do all sorts of scammy things, not for that purpose, but as part of their usual business Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof They call customers and ask for security information They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do All of the above risk causing customers to lower their guard to fraud They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard) They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
  - 3y ago

xenocratus 3y ago

One thing I wonder is if this works when you call Monzo as well - once you give them your details, does the same thing appear in the app? Because that opens the door for a man-in-the-middle attack. Actually, in that case it makes the attack so much worse, because it legitimises the attacker.

jonathanlydall 3y ago
Also my first question.
Gare 3y ago
Why not just have an ability to call in-app via secure voice chat?
- bartvk 3y ago
  Yeah, I didn’t get that either.
- andrewfromx 3y ago
  because they want to be able to dial a normal phone number to make your phone ring to get your attention.
  - vinay_ys 3y ago
    hmm, WhatsApp rings my phone more than regular phone network and like me billions of people pick-up WhatsApp calls everyday.
    - andrewfromx 3y ago
      this is true, but for most american's we still use a phone number and do not have any thing like WhatsApp, Signal, or Telegram installed on our phones. The phone number ring is still gold here.
imakeinternet 3y ago
Well that would rely on you being able to call Monzo in the first place. None of the numbers you are able to find take you to a person, instead infinitely redirecting you to use the in-app chat... which is more "Leave us a message and we'll pick it up on Monday" than an actual live chat. Background: Monzo froze _all_ of my bank accounts for nearly 5 days after triggering some fraud protection measures. Great in theory... until you are completely unable to speak to anyone.

pluc 3y ago

Wise will include a user-set keyword on all communications: https://wise.com/help/articles/2932695/watch-out-for-phishing https://wise.com/help/articles/2932695/watch-out-for-phishin...

gokhan 3y ago
This was tried long ago,then cancelled, in Turkey. Perverts will set it to something they want to hear from call center agent and trigger a call where the poor agent will need to read out loud.
- internetter 3y ago
  Should probably be changed to a random string like “flying neon dollar” Also wtf
- pluc 3y ago
  That's pretty easy to work around if there's a will to do it. A single word, a character limit, a dictionary validation or a non-UGC generation are all pretty simple things to implement.

perpil 3y ago

"Privacy & settings – where it lives now – is a natural home for it, but we think it should appear elsewhere too." Seems like the next step would be to send an app push notification before the call and to have a banner that's visible as soon as you log in to the app. Some sort of visual indicator that appears everywhere in the app that you should not be on a call may also reduce an attackers chance of succeeding.

jeroenhd 3y ago
I don't know how iOS handles this, but on Android you can get permissions to check if the user is currently in a call. Often this is done to mute media when you accept a call, but I can also imagine any sensitive apps popping up a message on their home screen to indicate whether or not a real customer support agent is trying to reach out to you. I don't think you can get details about the call that easily (like phone number and such) but with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.
- vitus 3y ago
  Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). There are plenty of scams based on impersonating some official (FBI, IRS, etc). It's not hard to imagine a scammer spoofing your bank's phone number [0, 1, 2, 3]. [0] https://www.snbonline.com/about/news/scammers-can-spoof-an-official-phone-number-heres-how-to-tell https://www.snbonline.com/about/news/scammers-can-spoof-an-o... [1] https://www.westernbank.com/fraud-prevention/what-you-should-know-about-caller-id-spoofing/ https://www.westernbank.com/fraud-prevention/what-you-should... [2] https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/ https://www.wellsfargo.com/privacy-security/fraud/bank-scams... [3] https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing
  - Sebb767 3y ago
    > Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). I think this can be solved far more simply by only showing the notification/warning (or showing it more visibly) when the app detects you are in a call.

deleted 3y ago

[deleted]

nonrandomstring 3y ago

Both a good and bad idea. Obviously dependency on a side/control channel limits this. Better? Mix and broadcast authentication beacons over the audio channel. If it got there, by whatever transport the audio did, you're good to use them as a MAC against some key.

simonw 3y ago
Can you expand on that? I don't understand what you mean.
- nonrandomstring 3y ago
  Sure, what I'm specifically addressing is "can we do it without the internet bit?", because as a security solution I see it as a bit of a problem relying on that. Since the person is calling with a duplex audio link already, by GSM or whatever, why not use that? There are many, many ways (modems of a kind) of putting an (almost) inaudible signal into audio. Those could easily be short message authenticators, just a sequence of digits that derive from some frames of the audio, they might sound like little high frequency blips. Can you see how that might work? [edit] Forgot to say; those frames would get hashed along with some private part of a public key, or sym-key that only you (the user) has. A fake caller wouldn't be able to spoof them easily, and so they wouldn't decode at the client side correctly.
  - esprehn 3y ago
    How do you expect that to work? Their app would either need to have access to all your phone calls, or you'd need separate hardware to detect and authenticate the audio?
    - nonrandomstring 3y ago
      Correct, an app would need to read the audio stream and do some preparatory DSP to extract audio short codes. Of course you could build standards in at a point closer to the radio basebands. I mean, why is basic source authentication not built in as far back as SS7 given we had the technology even in the 1970s? The only time you'd be using the app would be if receiving a call from an untrusted caller. And if you don't trust the app period, then the game is off anyway. In theory the same app could hold certs from a number of "trustworthy" sources you might like to check; much like a TLS certificate. But in the end you'd wind up with too many, and hard to keep track of, and then buffoons like those from the EU commission would be wanting to "force trust" upon you to authenticate "approved government sources" - Which sadly is the problem with all source authentication schemes that work with PKI this way. You really need to keep the application layer relation 1-to-1. I prefer simpler, elegant solutions - like your bank should never call you or push ANYTHING which is why I called it both a good and bad idea, and generally I distrust the whole ecosystem, of "apps" anyway.

FartyMcFarter 3y ago

I have another idea for Monzo: never call people. You can't rely on people being able to talk on the phone for accessibility reasons, so it should never be necessary to call people on the phone. Instead, handle things by the app or wait for customers to call you.

simonw 3y ago
From that article: > Remember, we will never call you without arranging it with you first through in-app chat.
- FartyMcFarter 3y ago
  Right - so why not simply ask people to call them? It would make it a lot simpler to ensure there's no fraudulent calls. No need for some fancy verification method like the one outlined in this article.
  - simonw 3y ago
    The app verification method is better - it helps protect against people being tricked into calling a fake number (through a deceptive text message, email or internet search).
    - FartyMcFarter 3y ago
      If people can be convinced to use the app for verification, why can't they be convinced to use the app to find the correct number to call? I think the latter is much more natural for most.
      - simonw 3y ago
        I also like that I can skip a lot of the authentication steps by requesting a call from within the app - that way they already have a head start on identifying me when the call starts.

mcny 3y ago

Ally Bank on the other hand has outsourced its debit card to the worst possible company out there. They called me and asked me for my social security number. I said is this a security training? Are you testing me? He said no, my card was recently used (it was me I was trying to withdraw USD 400) and I said I refuse to either confirm or deny anything on an incoming call. This RUDE person said well my debit card will remain locked until I answer their questions. I said fine I'll call my bank. My card remains locked to this day.

cianmm 3y ago
While their security practices sound woeful and you did the right thing, why haven't you called your bank to unlock your card and give the feedback that the outsourcing is awful?
- firtoz 3y ago
  It's probably less effort to switch to another bank.
- Sebb767 3y ago
  With those security practices in place, locked is probably the status the card should have.
  - talkin 3y ago
    Who says it’s their security practice… The way the top post is told, I would assume the call to be made by an attacker . :)
JumpCrisscross 3y ago
> person said well my debit card will remain locked until I answer their questions You also have the option of reporting them to your state banking regulator [1], the CFPB [2], the FDIC [3] and FTC [4]. A polite way to do this is to write a letter to your bank explaining what happened and Cc’ing the regulators. It will tend to get escalated to their legal department and has a chance of forcing policy change (and producing compensation). [1] https://www.consumerfinance.gov/ask-cfpb/how-do-i-find-my-states-bank-regulator-en-1637/ https://www.consumerfinance.gov/ask-cfpb/how-do-i-find-my-st... [2] https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/ [3] https://www.fdic.gov/contact/ https://www.fdic.gov/contact/ [4] https://reportfraud.ftc.gov/#/ https://reportfraud.ftc.gov/#/

throwaway_qwe 3y ago

I was recently a target of a UK online bank phishing scam (not Monzo). They were highly sophisticated. They knew details of recent transactions, including bank transaction numbers that don’t show in any qif export or anything. They had a plausible reason to call (based on said visibility). They had researched my name and everything about me and my family that is online. They faked caller ID. Their ‘patter’ was so advanced that I do not know this extra layer of protection would have helped much. Luckily I didn’t finish the steps and lost no money. It is clear the bank has had a severe exfiltration event. There are other reports that online. IMHO the law should make banks report breaches to the ICO and a record of the nature and size of the breach be public. Through the process I learned that in the UK you can call 159 to directly contact your bank fraud dept (most banks) https://stopscamsuk.org.uk/159 https://stopscamsuk.org.uk/159 I also learnt about the police’s Action Fraud hotline to report cybercrime. https://www.actionfraud.police.uk/what-is-action-fraud https://www.actionfraud.police.uk/what-is-action-fraud The phisher was very determined. They called back in 15 minutes claiming to be from the bank fraud dept returning my call. Then 2 weeks later they called back claiming to be from Action Fraud. However prepared you think you are for such an attack, my advice is to have utmost caution for every single call from anyone claiming to be anyone. I also have a Monzo account. Even if they called me I wouldn’t use this. Hang up. Call them. Don’t let them call you.

switch007 3y ago
Which bank? (Slightly worried UK resident here!)
- throwaway_qwe 3y ago
  One of those on the 159 programme https://stopscamsuk.org.uk/159 https://stopscamsuk.org.uk/159 Honestly, I’m not sure it matters. They’ve all had such incidents. I read somewhere that about 30% of your fees and mortgage interest go toward fraud mitigation,monitoring, and restitution. I always live by these rules - call them back, don’t talk to them - ask why you need to do anything. It’s exceedingly rare a bank would call you to do something legit there and then. “I will do it later” will help. In fact that’s how I caught the phisher as I noted the aggravation in 1% of his voice. - use credit cards, not debit cards, for purchases. They have far more protection. - use all the 2FA and password complexity you can - never use real info for challenge questions. Never use maiden name of mother etc. you can put “14 green fish” as the answer to the question if you like. - make sure they are FSCS regulated, and try not to exceed that limit. - understand FSCS does not cover you most phishing attempts, since the bank will claim they tried to warn you and were not negligent - use private tabs for bank interactions Through this experience I have learned not to trust “what we know about you” information they share. Do not underestimate HUMINT. A bank snitch could give up something as seemingly innocent (to them) as your “join date” and it be a lynchpin piece of info for a scammer. This may all seem obvious to an HM reader. But it’s worth refreshing and reiterating.

radres 3y ago

people who fall for scams on phone are the ones who wouldn't hear about news like this.

Sebb767 3y ago
Don't be so sure of that. A lot of really smart people can fall for scams because they are caught off-guard or are focused on getting something done, discarding some necessary caution along the way.

ryandrake 3y ago

This is a nice feature but the root problem is how trusting people are of the totally insecure phone system. We all have to have “the talk” with our elderly parents, where we try to convince them to never do business over phone or e-mail unless they themselves initiated the conversation. No legitimate business will call you and expect you to pay money, give them access to a computer, ask for security codes, or anything like that. Always hang up, and if you think it’s actually life-or-death important (hint: it isn’t), call them back in their official number. My parents got scammed in the past so they are on the lookout, but I still don’t think they are careful enough. And due to their age they get attacked a lot! Last time I visited, their phone was ringing every hour or two--all scam/spam. It’s only a matter of time until the next one is clever enough to get through. I think these “external caller” scams are going to be with us until that generation dies out. The “trust the phone” instinct is too strong. Of course for my generation, the scammers will find something we inherently trust and exploit that, I have no doubt.

otteromkram 3y ago
I think this should be hammered into everyone's head and am surprised it isn't already. I get regular emails from retailers and banks reminding me that they will never call and ask for money or personal info. Then they state exactly what you said; hang up and call the institution's official number if you're unsure who is calling. (Note: a quick way to find the official number is by looking on your debit/credit card. It should be printed on there.) (Note note: Don't sign your credit/debit card. Put "SEE ID" or something in the signature area.)
- aqfamnzc 3y ago
  Why not sign the card?
  - CharlieDigital 3y ago
    "SEE ID" is an explicit instruction. But I haven't had anyone check the card in ages.

vinay_ys 3y ago

A bank that never calls or messages via traditional phone/mobile network and never uses email is the best. Always use secure in-app communication. And use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Don't depend on another channel for resetting any of the credentials. Educate the user that you will never contact them via any other means. Establish these secure expectations with the user from day-0. Within the app, always do additional factor authentication for any monetary transaction. On the server-side, have per-transaction, per-day limits for fund transfers. For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. Notify the user during this cooling-off period and give them ample opportunity to intervene if they think it is a mistake or fraud. Have low-friction instant payments only to pre-verified and registered merchant addresses. For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. For out-of-network (say international) instant transfers, definitely require payees to be verified and added to payer's account and have fraud protection funds to enable swift clawback and legal frameworks for prosecution across international borders. Without these types of protection, any increasing in banking velocity is bound to result in more fraud harm than traditionally accepted.

bertil 3y ago
I'm a Monzo client and honestly, I'm surprised they even offer the option. They do everything on-line if they can: it's cheaper for them, and I find it more convenient, on top of all the reasons you listed. I suspect phone calls only happen at the very edge of rare branches, with elderly or handicapped clients, complex transactions, when ID checks fail, etc. They might not do it at all, and had added that feature in the rares of cases they might — but making it visible as “this changes color if we call you” makes a more compelling story than they previous “we never call you” if you are on the phone with a high-pressure scammer.
- avianlyric 3y ago
  Banks in the UK are legally obligated to provide phone support to their customers. Monzo mostly doesn’t do outbound calls at all, pretty much the only situation they’ll do an outbound call is if it’s a pre-arranged call to discuss a complaint, or difficult situation (death of a customer etc).

rs_rs_rs_rs_rs 3y ago

After an unfortunate event I managed to teach family members to never do any kind of bank actions in a call where they were the ones being called. Always end that call and then call the bank support back using the number they all know how to find on their credit/debit cards.

vinay_ys 3y ago
Most irritating thing the Amex did recently to me is to call me from a random number and then proceeded to ask me for my personal details like date of birth etc for "verification purposes". I promptly refused to provide any details as I have no way to authenticate them and cut the call. They are basically educating their customers to become vulnerable to fraudsters and I told them as much. But the call center person is the wrong person to hear that from me.

Cthulhu_ 3y ago

This is insecure because it relies on people having the app installed and knowing to check it. Why not call the user through the app itself? Why not send a notification through the app telling the user to find the official support line and call that? Banks should not call you anymore since it cannot be trusted.

noodlesUK 3y ago
For context, the app is monzo bank. You can’t bank with them without the app, they’re a challenger bank. Essentially all interaction is through that app. What surprises me is that they didn’t just put a webrtc call function hidden in the app so they could call you over a secure channel in the rare case that they needed to call you.

otteromkram 3y ago

I would almost bet that 100% susceptible to scams won't remember to check an app for call verification. Or, maybe I'm just a skeptical curmudgeon...

Horffupolde 3y ago

The problem is not with the call but with who is calling you. If you can authenticate the caller, all’s fine.

stavros 3y ago

This is a great idea, but there's one problem I see with it: When I'm in a call, my internet doesn't work if I'm not on wifi, as the modem is busy with the call. I believe this doesn't happen if you have VoLTE, but it does mean that this feature can't work for many many people.

pests 3y ago
Yep, CSMA needs Voice over LTE (VoLTE) or else data is enabled while the call falls back to 3g.
- pests 3y ago
  disabled*

agilob 3y ago

Monzo is bleeding edge in many things, but their customer support is making people leave this bank. It used to be one of the best in the UK, now it's just hard to find a worse one. Read about the stories here https://old.reddit.com/r/UKPersonalFinance/comments/17kvo4j/tsb_reimbursed_15_times_more_customers_fraud/ https://old.reddit.com/r/UKPersonalFinance/comments/17kvo4j/... >TSB reimbursed 15 times more customers’ fraud losses than Monzo in 2022 https://www.theguardian.com/technology/2023/oct/31/tsb-reimbursed-15-times-more-customers-losses-than-monzo-in-2022 https://www.theguardian.com/technology/2023/oct/31/tsb-reimb...

sailorganymede 3y ago

I absolutely love this feature so much. I work at a competitor of Monzo and this is definitely something I'll bring up with our Product team to see if we are thinking about this.

notnmeyer 3y ago

this is a cool feature! i had someone call me recently claiming to be from coinbase and try to get me to enter a password reset code into a site hosted at “w-coinbase.com”. they claimed my account was compromised and “locked” (it wasn’t). i humored the guy and asked for a help page from coinbase that listed “w-coinbase.com” as one of their official domains. they genius asked me to trust him, or i could talk to his manager who would share my ssn with me as “proof”. i talked to the guy for like an hour asking him to put himself in my shoes, or explain why i couldn’t address the issue myself with a password reset or redoing my mfa setup. he got really angry, saying i was berating him for doing his job. i suggested he give me a case number and i’d call back into coinbase’s support line. he gave me a six digit number and then hung up abruptly when i said i’d call him back. it was glorious. anyway, every one should have a feature like this.

throwaway290 3y ago
nice, Atomic Shrimp vibe!

switch007 3y ago

It's a cat-and-mouse game of banks saving money by closing branches (or never having them in the first place) and wanting to make fraud as much as the customer's fault as possible, and implementing new laws to shift some of the burden back to the banks and other organisations and creating toothless regulators for political marketing purposes.

jakub_g 3y ago

Interestingly, ING Bank in Poland just introduced the same, as well as U2F key support. https://niebezpiecznik.pl/post/istotne-zmiany-w-aplikacji-mobilnej-ing/ https://niebezpiecznik.pl/post/istotne-zmiany-w-aplikacji-mo...

petesergeant 3y ago

I live in UAE, and everyone here has a pretty sophisticated government ID, linked to a smartphone app, that performs single sign-on for all government services. Your ID number is not especially secret. Anyway, a frequent scam here is that someone calls you claiming to be the police or the government, and then generates a SSO request on your phone via trying to sign in to a government website using your EID number, and the request certainly adds a layer of seeming authenticity

neilv 3y ago

What if the scammer initiates a call with the company, separate from the call they're having with you? What will that indicator say?

nolongerthere 3y ago

Really what we need is reverse 2FA, when I'm on a call with someone who is asking for sensitive info I should be able to generate a 6 digit number in their app or website and request that they verify it, if they can't verify it, they're not with the bank. simple. I had an issue where a bank (chase) called me to verify a transaction it felt was illegitimate, first thing the bank employee (who claimed to be with the fraud department) did was send me a SMS 2FA code that clearly said "do not share with ANYONE" I told him that and he said "yes, but I need it to confirm you are who I'm trying to reach, if you don't give it to me I will lock your account" ... My account was locked and I had to go into a branch, present 2 forms of photo ID to create a new userID and password and be able to use my cards/access my (new) account again. I had some very strong words for the branch manager and anyone who would listen about how terrible a security practice it is to give those sorts of conflicting instructions.

throwaway290 3y ago
You did the right thing. I don't even have two forms of photo ID. I think I would just leave to another bank immediately if it was an option
- dredmorbius 3y ago
  As much as I tend to agree with you, people who have loans, particularly mortgages, which are frequently traded amongst financial institutions, are locked in to a particular company like it or not. But for retail banking, supposing you actually have the option, yes, absolutely.
  - logifail 3y ago
    > people who have loans, particularly mortgages, which are frequently traded amongst financial institutions, are locked in to a particular company like it or not When we got the mortgage for our house, we went out of our way to arrange it with a bank with which we had (and have since had) no other dealings. Result: Our "mortgage bank" has no insight into our day-to-day finances. Our "day-to-day bank" has no insight into our mortgage.

3guk 3y ago

I just don't pick up the phone to numbers that are not saved in my contacts anymore - seems to have saved me a tonne of hassle.

electrondood 3y ago

1. Bank notifies you to call them, but you initiate the call. 2. Bank confirms your identity with some inconsequential piece of information: a verbal passcode, the approximate dollar amount of two recent transactions, etc. If the bank initiates the call, ask for their name and call the bank back.

graypegg 3y ago

This feels like it would be useful as a general protocol. A signed app on your phone, can register some special endpoint into a registry that responds with if the user logged into the app is being called. Put some button in the phone interface for “Verify”, which pings all of these endpoints, and either shows a logo and a success message, or an unknown caller warning. You wouldn’t want it to ping these services on every call, so it would have to be an action you just train people to do. Better than hiding it in an app though, this should be an OS concern somehow.

neltnerb 3y ago

I'm confused, how easy do they think it is to answer the phone, and then use the phone simultaneously for a call while opening their app and (presumably) authenticating with the app in order to get this information? I can barely handle adding a calendar event while on a call without accidentally hanging up or something, what a weird UI. Why do they not just contact you via their installed app if they're going to assume you have it installed...

michaelteter 3y ago

We're at the point now, particularly where a phone app is part of the security process, that the phone app itself should have direct/private "phone" calling capability between the user of the app and the company. Obviously we have this within common chat apps, and we know there are good open source frameworks for doing this. Company calls consumer via their private company-to-app system, app alerts user of an incoming communication request, and user accepts and has a voice conversation. Then of course it becomes a question of the security quality of the app and communication design between it and the company, but presumably if that is broken then any app-based status or verification would also be broken.

asylteltine 3y ago

Someone has to say it… if I get a phone call and it’s an Indian, it’s 100% a scam and I hang up. Good rule to live by these days.

miki123211 3y ago

Bank apps should have the ability to see if you're on a call when the app is opened. If this is the case and the call doesn't actually originate from their systems, they should ask you whether you're currently called by them and freeze your account if yes is clicked.

ChildOfChaos 3y ago

Monzo are horrible. Hate them, they closed my account a few months after opening it without any reason or ability to appeal. I did nothing wrong, just a normal user, was just testing it out the first couple of months so didn't use it for much, was about to move everything over to it and then they closed my account and i can never have an account with them again. Awful company, who pretend to be friendly and cutting edge, but just gatekeep customers and cut them off without warning for whatever reason they wish.