3 ms·
How did entering login and 2fa do the following things. 1. Login 2. Add payee 3. Create transaction 4. Verify transaction This appears to be a banking issu
by 2Gkashmiri 2y ago
How did entering login and 2fa do the following things.
1. Login
2. Add payee
3. Create transaction
4. Verify transaction
This appears to be a banking issue where they do not try to maximize the attack surface.
Sure people will try to game the system by doing phishing but its the responsibility of banks to actively make it harder
- dylan604 2y agoI read it as the first 2fa code was used to login, then the system quickly attempted to add this new payee which required a second 2fa code, so the phishing site quickly sends another request stating the code saying the first was rejected.
- twelve40 2y agoYep. A few simple steps like an extra SMS (or email) code to add a recipient, an email notifying about the change, not perfect, but will make this harder to pull off. Not sure what is '"pay anyone" payee', i don't think it's a thing at my bank. They could try to scrape the account number though, I think in the States that may be enough to try to debit someone's account.