20 ms·
Large banks like chase are motivated to make social engineering attacks like this more difficult. However, they need to do so while also considering the frictio
by jhgg 2y ago
Large banks like chase are motivated to make social engineering attacks like this more difficult. However, they need to do so while also considering the friction and potential frustration that additional security/verification measures might cause for their customers.
One idea that would mitigate against this, while also not imposing significant burden to the customer is to have the procedure be that the app simply instructs you to hang up your call, and then after dials a randomly selected number from a large pool of numbers the bank controls, that has been wired up to (given your phone number) connect you back to the bank and directly to the agent that has called you. If your phone number dials any other number from the pool during this time (the attacker is trying to race you to call back the bank while spoofing your number), then the account flagged as being potentially under attack.
- amadeuspagel 2y agoBut why use the phone system at all? We have WebRTC now. It should be possible to call right from your bank's web app.
- nunez 2y agoNot everyone has or knows how to use the app
- landgenoot 2y agoI can call one of my banks from the app. They will generate a phone number followed by a , and an appended code. No need to identify during the call.
- jhgg 2y agoBecause it's significantly easier to just ask the phone to make a call, than it is to build VOIP calls into the app. As well, you get a lot of things for free: - user is familiar with the phone UI, and knows how to mute/use speaker phone. - put the call on hold if another incoming call comes in, - able to call someone and make it into a conference call, - more reliable on shitty internet.