7 ms·
Meanwhile US banks, Venmo, PayPal, etc all insist on using "real" phone numbers as verification. Funny that Venmo won't let me use a voip number, but I signed
by nixosbestos 2y ago
Meanwhile US banks, Venmo, PayPal, etc all insist on using "real" phone numbers as verification.
Funny that Venmo won't let me use a voip number, but I signed up for Tello, activated an eSIM while abroad and was immediately able to receive an SMS and sign-up. For the high barrier cost of $5. Wow, such security. Bravo folks.
- blackeyeblitzar 2y agoThe problem is that VOIP numbers, from companies like Bandwidth, are frequently used to perform various frauds. So many financial services ban them because the KYC for real numbers is much better.
- mellow-lake-day 2y agoKYC = know your customer?
- tempodox 2y agoYes.
- dr_dshiv 2y agoIt has nothing to do with Kentucky’s Yummiest Chicken, if that’s what you were thinking.
- FergusArgyll 2y agoYes, and AML = Anti Money Laundering
- silisili 2y agoI have more bank and credit accounts than the average person, probably. 5 bank accounts, and 8 credits accounts I can remember as active off the top of my head. Every single one works with GVoice, except Venmo. Chase, Cap1, Fidelity, etc. Not small players. So while I think you make a fair enough argument for sure, it doesn't seem to be the case when nobody else does it, and makes Venmo seem like a pain in the arse.
- BenjiWiebe 2y agoMy Gvoice number works with Chase, Citi, Discover, AMEX, Capitol One. Does not work with Wells Fargo, despite allowing you to sign up with it. Took a notarized snail mail to fix that one.
- zmgsabst 2y agoIn practice, these companies get a phone number I possess for 1-3 months on a travel SIM rather than the VOIP number I’ve steadily maintained for two decades and by which the US feds know me (because they don’t care).
- immibis 2y agoBecause VOIP requires a verified Google account and phone number, while traditional numbers can, uh, be purchased anonymously at the corner store.
- atonse 2y agoDepends on which country. In places like India that’s not possible. Your cell phone number becomes a de facto identity so they require all kinds of identity documents to get a SIM.
- taneliv 2y agoSo there's a cottage industry of middle men on the streets who will set you up with a SIM card, or a travel ticket or whatever, for people who don't have identity. (Or in some cases don't want to reveal their identity, but I reckon this is less typical.) Sure, you pay extra for the service, the middle man takes 10%, 30% or 500% and the identity is then with that person---or their fraudulent papers, I don't know how it works in detail.
- int_19h 2y agoIt's usually the other way around - first countries introduce laws that require ID to buy a cell phone ("because criminals"), and then the phone number starts getting used as a de facto identity.
- atonse 2y agoAh yeah, good point. That makes more sense.
- baobun 2y ago> while traditional numbers can, uh, be purchased anonymously at the corner store. That is a closing window and the case in fewer and fewer places. It wont be long until most people would need to fly across the globe or get involved with organised crime to pull that off...
- freeopinion 2y ago
- axus 2y agoDon't all financial institutions need some real identification with physical address to sign up? Phone numbers / email addresses should be for communication, not tracking.
- cookiengineer 2y agoThe same level of security that shitter's checkmark introduced. All checkmark accounts are fake, and the ones without are real people, I guess? The idea that scammers don't have digital money laying around just waiting on being spent on something is so absurdly out of touch on how everything in cyber works.
- disqard 2y agoCorporations are "people". Corporations "eat" money. Entities that can feed a corporation, are treated as peers, i.e. "people". Thus, on shitter, if you can pay, you are a person (and get a blue checkmark).
- withinboredom 2y agoOh, nice allusion. If corporations eat money and you're not paying, i.e., a free service. You are prey.
- immibis 2y agoYou aren't even the product. You're the raw material.
- toast0 2y ago> For the high barrier cost of $5. Wow, such security. Bravo folks. $5 is at least 5x the cost of a voip number. I'm not a bank, but if I'm spending money to verify you control a number, I feel better when you (or someone else) has spent $5 on the number than if it was $1 or less.
- lazide 2y agoAlso, that is clearly a workaround that took some research to do. Aka you’re probably in the top 1% of the population from a ‘figuring out workarounds’ perspective. VoIP is so well known (and automated) to do, even at $.10, it would be a magnitude easier to do. Banks are always slow, and behind the times - because they are risk adverse. That has pros and cons.
- somat 2y agoIt makes me think of linux distros. there are the ones that closely follow software updates and you get to complain that things are breaking all the time. and there are the stable distros, now you get to complain how old and out of date everything is.
- iszomer 2y agoI still have about $15 of international calling credit on a GV number I hardly use anymore with no option of transferring or using that balance on a different platform like Google's Play store.
- rsync 2y ago"... but if I'm spending money to verify you control a number, I feel better when you (or someone else) has spent $5 ..." This is exactly it. All of these auth mechanisms that tie back to "real" phone numbers and other aspects of "real identity" are not for you - they are not for your security. These companies have a brutal, unrelenting scam/spam problem that they have no idea how to solve and so the best they can do is just throw sand in the gears. So, when twilio (for instance) refuses to let you 2FA with anything other than tracing back to a real mobile SIM[1] (how ironic ...) it is not to help you - it is designed to slow down abusers. [1] The "authy" workflow is still backstopped by a mobile SIM.
- mjevans 2y agoBlanket Denial is the issue. A PROCESS for verifying the number isn't used for fraud and allowing use. I don't know, maybe the fact that I've been a customer for YEARS, use that number, and have successfully done thousands of dollars in transactions over a platform without any abnormal issue?
- terribleperson 2y agoMy google voice number is unlikely to be stolen from me, but instead I have to use a 'real' phone number that could be compromised by handing cash to an employee at a store. One time a company retroactively blocked VOIP numbers, which was really stupid.
- Krasnol 2y ago> My google voice number is unlikely to be stolen from me I'd say that with Google, chances are that they just stop offering the service.
- MetaWhirledPeas 2y agoWhen Google Voice was brand new I snagged me a number. (Since lost because I did not respond to a prompt to keep it alive, or something?) I wonder if they anticipated the cost of keeping those around for decades. Managing someone's personal phone number is a solemn commitment that you can't just drop willy-nilly.
- thfuran 2y agoThe only solemn commitment Google has is to the bottom line.
- MetaWhirledPeas 2y agoAren't they still supporting old Google Voice numbers though? I don't see how they could be making any money on that.
- Uvix 2y agoOnly US domestic calls are free, international calls have a per-minute charge.
- thfuran 2y agoThat's one of their older services. I assume they really like the data they get from it.
- fasteo 2y agoDoes Tello require KYC, that is, is the eSIM linked to an actual identity ? As least in Europe (psd2) that’s the key for accepting a phone number as a 2FA method
- ricktdotorg 2y agoi bought a Tello eSIM to use for my Rabbit R1, am in USA, was not required to provide any KYC, received a (213) LA area code number, recommend Tello so far.
- rsync 2y agoNo KYC with Tello or USMobile. All of my 2FA Mules[1] are USMobile SIMs attached to pseudonyms which were created out of thin air. It helps a lot to run your own mail servers and have a few pseudonym domains that are used for only these purposes. [1] https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/
- mikeweiss 2y agoCan we talk about how Venmo doesn't even let you login from abroad... And their app doesn't provide a decent error message it just 403s.
- fnordpiglet 2y agoThese stem from a requirement to know you as a person in some verifiable way. These are legal and regulatory requirements but the laws and requirements are there to ensure finserv can meaningfully contain criminal activity - fraud, theft, money laundering, black market, terrorism financing, etc. It turns out by far the most effective measure is simply knowing who the principals are in any transaction. Some companies have much lower thresholds for their KYC, but end up being facilitators of crime and draw scrutiny over time by both their more regulated partners and their governments. I’d note that the US is relatively lax in these requirements compared to Singapore, Canada, Japan, and increasingly the EU. In many jurisdictions you need to prove liveliness, do photo verification, sometimes video interviews with an agent showing your documents.
- Andrex 2y ago> In many jurisdictions you need to prove liveliness, do photo verification, sometimes video interviews with an agent showing your documents. When vtuber-esque deepfakes become trivial for the average person, I wonder what the next stage in this cat-and-mouse becomes. DNA-verficiation-USB-dongles?
- krapht 2y agoWhy do straight to dystopia when notary publics exist?
- lazide 2y agoOnline notaries have been a thing for awhile now. Don’t worry, we can still have dystopias with Notaries.
- vkou 2y agoMaybe you could just, you know, show up to a bank branch? Like people have done for centuries?
- brendoelfrendo 2y ago
- BenjiWiebe 2y agoAnother cool thing that some companies do: refuse to deal with me because the family business account is in my dad's name, despite me knowing all the correct information to pretend to be my dad. Like, the only reason I don't answer the phone and say "this is <Dad's name>", is because I'm honest. You'll never keep a bad guy out that already knows all the information that you ask for - he'll just lie and claim to be the business/account owner.
- codedokode 2y agoTechnically they might be right, because your father might not trust you to access the account, so you need some kind of written permission. > he'll just lie and claim to be the business/account owner. He can lie, but he doesn't have another person's passport to prove his lies.
- luckylion 2y agoThat written permission is worthless unless notarized & verified (which isn't going to happen for ordinary things) because you can just write it yourself. And you don't need a passport. I've never met a company that will require full KYC-level video-identification with you on every call. You say that you're you (it doesn't matter whether you actually are you), you give them the secret code and they're happy.
- BenjiWiebe 2y agoThey literally want me to hang up and him to call back from the same line. Actually, just the other day I encountered this and Dad just came on the line and authorized me. If I'd have lied, it would have went more smoothly. In all the cases this has happened to me, the most verification they've ever needed is the last 4 of his SSN, which he has told to me.