6 ms·

A bank that never calls or messages via traditional phone/mobile network and never uses email is the best. Always use secure in-app communication. And use secur

A bank that never calls or messages via traditional phone/mobile network and never uses email is the best. Always use secure in-app communication. And use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Don't depend on another channel for resetting any of the credentials. Educate the user that you will never contact them via any other means. Establish these secure expectations with the user from day-0. Within the app, always do additional factor authentication for any monetary transaction. On the server-side, have per-transaction, per-day limits for fund transfers. For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. Notify the user during this cooling-off period and give them ample opportunity to intervene if they think it is a mistake or fraud. Have low-friction instant payments only to pre-verified and registered merchant addresses. For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. For out-of-network (say international) instant transfers, definitely require payees to be verified and added to payer's account and have fraud protection funds to enable swift clawback and legal frameworks for prosecution across international borders. Without these types of protection, any increasing in banking velocity is bound to result in more fraud harm than traditionally accepted.

bertil 3y ago
I'm a Monzo client and honestly, I'm surprised they even offer the option. They do everything on-line if they can: it's cheaper for them, and I find it more convenient, on top of all the reasons you listed. I suspect phone calls only happen at the very edge of rare branches, with elderly or handicapped clients, complex transactions, when ID checks fail, etc. They might not do it at all, and had added that feature in the rares of cases they might — but making it visible as “this changes color if we call you” makes a more compelling story than they previous “we never call you” if you are on the phone with a high-pressure scammer.
- avianlyric 3y ago
  Banks in the UK are legally obligated to provide phone support to their customers. Monzo mostly doesn’t do outbound calls at all, pretty much the only situation they’ll do an outbound call is if it’s a pre-arranged call to discuss a complaint, or difficult situation (death of a customer etc).
542458 3y ago
That sounds fantastic for more technically sophisticated users… but I strongly suspect the reason banks continue to use phone, email, and SMS is that most users aren’t that technically sophisticated, and strongly want to use the (admittedly unsuited) communication methods they’re already familiar with. There was a post here a while ago about the debt collection industry that had a section of which the essence was “You’d be shocked at how little many people understand about banking and technology and basic math”.
tgsovlerkhgsel 3y ago
That's very secure. It's also utterly unusable and will result in customers picking another bank, possibly retrieving their deposit through regulators and the court system in some cases because it's easier than going through your impossible account recovery.
lxgr 3y ago
These are all good ideas, but unfortunately really not that easy to implement, largely due to institutional inertia, but also because it would put the bank at a competitive disadvantage with others: Often, security and convenience really are trade-offs. > Don't depend on another channel for resetting any of the credentials. What if a customer's house burns down with their phone and Yubikey in it? > For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. That's not up to a single bank. > For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. "Why are you telling me what I can and can't do with my own money!?" Sometimes, large value transfers really do need to happen quite spontaneously to a previously-unknown recipient, e.g. for a used car purchase. > Use a pre-registered and securely couriered FIDO2 token (Yubikey) That would indeed be great, but not a single bank I've done business with supports FIDO. In fact, I haven't even heard of one that does (I might just open an account with them!)
danjc 3y ago
One annoying aspect to app push notifications is that my bank uses them to send marketing too.
- expertentipp 3y ago
  The marketing will eventually sneak into every guaranteed channel of customer attention. That's why no app is sending me notifications.
expertentipp 3y ago
> Use a pre-registered and securely couriered FIDO2 token (Yubikey) Banks are awful enough with software, I don't want any hardware from them. Increasingly mobile apps are becoming first class citizen for online banking, web browsers second class. There doesn't exist reliable non-infuriating workflow with physical security key and a smartphone.
steelframe 3y ago
> use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Does this work with a privacy-respecting ROM like GrapheneOS? If not, then it's nowhere near the best solution for me.

bertil 3y ago

I'm a Monzo client and honestly, I'm surprised they even offer the option. They do everything on-line if they can: it's cheaper for them, and I find it more convenient, on top of all the reasons you listed. I suspect phone calls only happen at the very edge of rare branches, with elderly or handicapped clients, complex transactions, when ID checks fail, etc. They might not do it at all, and had added that feature in the rares of cases they might — but making it visible as “this changes color if we call you” makes a more compelling story than they previous “we never call you” if you are on the phone with a high-pressure scammer.

avianlyric 3y ago
Banks in the UK are legally obligated to provide phone support to their customers. Monzo mostly doesn’t do outbound calls at all, pretty much the only situation they’ll do an outbound call is if it’s a pre-arranged call to discuss a complaint, or difficult situation (death of a customer etc).

542458 3y ago

That sounds fantastic for more technically sophisticated users… but I strongly suspect the reason banks continue to use phone, email, and SMS is that most users aren’t that technically sophisticated, and strongly want to use the (admittedly unsuited) communication methods they’re already familiar with. There was a post here a while ago about the debt collection industry that had a section of which the essence was “You’d be shocked at how little many people understand about banking and technology and basic math”.

tgsovlerkhgsel 3y ago

That's very secure. It's also utterly unusable and will result in customers picking another bank, possibly retrieving their deposit through regulators and the court system in some cases because it's easier than going through your impossible account recovery.

lxgr 3y ago

These are all good ideas, but unfortunately really not that easy to implement, largely due to institutional inertia, but also because it would put the bank at a competitive disadvantage with others: Often, security and convenience really are trade-offs. > Don't depend on another channel for resetting any of the credentials. What if a customer's house burns down with their phone and Yubikey in it? > For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. That's not up to a single bank. > For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. "Why are you telling me what I can and can't do with my own money!?" Sometimes, large value transfers really do need to happen quite spontaneously to a previously-unknown recipient, e.g. for a used car purchase. > Use a pre-registered and securely couriered FIDO2 token (Yubikey) That would indeed be great, but not a single bank I've done business with supports FIDO. In fact, I haven't even heard of one that does (I might just open an account with them!)

danjc 3y ago

One annoying aspect to app push notifications is that my bank uses them to send marketing too.

expertentipp 3y ago
The marketing will eventually sneak into every guaranteed channel of customer attention. That's why no app is sending me notifications.

expertentipp 3y ago

> Use a pre-registered and securely couriered FIDO2 token (Yubikey) Banks are awful enough with software, I don't want any hardware from them. Increasingly mobile apps are becoming first class citizen for online banking, web browsers second class. There doesn't exist reliable non-infuriating workflow with physical security key and a smartphone.

steelframe 3y ago

> use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Does this work with a privacy-respecting ROM like GrapheneOS? If not, then it's nowhere near the best solution for me.