7 ms·
Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get s
by bryanlarsen 1y ago
Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.
- hinkley 1y agoIt was a proud day when my bank stopped sending emails with links in them. Of course their outsourced fraud prevention dept still calls and leaves messages with callback numbers, or just asks me for PII. Fuck off. Send people to the website to find your number, idiots.
- eptcyka 1y agoIt's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.
- airstrike 1y agoSame for SSNs
- viewtransform 1y agoWhat we need instead is an orb like thing that scans your eyeballs.
- dzhiurgis 1y agoIf only there was tamper-proof, cryptographically secure chip in everyone's pockets, coupled with a handheld device that can wirelessly "read" that chip.
- dylan604 1y agoIf it's in your pocket, then you might leave it in your other pants. Better to just have that chip embedded in your palm. You can even fashion it with LEDs that change color with your age. When you reach 30, you can then be told your Last Day has arrived and they are ready for Carrousel. I'm sure we can fold in plenty of other sci-fi tropes all at the same time too
- Henchman21 1y agoListen if Jenny Agutter is involved, count me in!
- anon7000 1y agoI mean this is basically the ENTIRE US health system
- LtWorf 1y agoHealthcare in USA is famous for many things, but making sense is not one of them.
- kube-system 1y agoBirthdates are frequently asked in US health settings not as a protection against attack, but as a protection against mistake. They are not worried that someone is going to come in, and steal your appointment. They are worried that someone with the same name as you might show up on the same day and the doctor might treat the wrong patient with the wrong information. This is an completely different risk profile than a form on the internet.
- TylerE 1y agoThis is a realer problem than some realize. I have the same name as my father (first and last, , different middle). We live at the same address. It’s a small town so we share a lot of the same doctors. We use the same pharmacy. For just a bit of extra spice are birthdays are only two days apart.
- pixl97 1y agoThis is how we unintentionally found a relative of my former girlfriend. Went to a small pharmacy to pick up medicine for DF, where the F is a really weird last name. They were like I just filled that, reached back and grabbed it and set it on the counter. I noticed it was the wrong address... A person she hadn't seen or talked to in 20 years had moved to this town neither of them were from and named their kid the same name.
- InitialLastName 1y agoFor sure, my dad lives in the same town as someone with the same (relatively uncommon) name as him who is roughly the same age. This causes confusion all the time with local services and organizations (especially since the other guy has had some, err, unflattering encounters with the legal system).
- fkyoureadthedoc 1y agoRecently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and said I had to call them. I couldn't even pay the balance until I did. Anyway they needed to verify my identity, so they ask me for some info from the back of the card and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. The text message says that the bank will NEVER ask for the code over the phone. They ask for the code, I give it to them, identity verified.
- FireBeyond 1y agoBackground check for a new employer resulted in me getting an email to my personal account: "Hi, I'm XYZ from XYZ background checks, I'm conducting your pre-employment check, and I just want to confirm that your full name is V, your DOB is W, your place of birth is X, your address is Y and your full SSN is Z... ... and that this is the correct email address for you. Please confirm." Holy hell. Thankfully I reached out to the employer about this (and the background check company's attempt to reach out to my partner on Facebook for ... something? This wasn't a security check, just a regular employment background) and they were as horrified as me, apologized, and fired their background check provider.
- bigfatkitten 1y agoSounds like the sort of thing Hireright would do.
- cycomanic 1y agoHah, my employer in Sweden recently started using one of these security training companies. They send you emails with some online courses you're supposed to do and then send occasionally phishing attempts etc. and when you fall for one they send you an email what you did wrong. Out of interest I clicked on the link in one of their "phishing" emails and I was redirected to a link where they essentially told me "never click on links in emails, you never know where they lead to". One week later I get an email "please click on this link to complete the second part of your course". Obviously I never completed their course, they told me never to click on links. What's even worse is that they don't even use their own domain for the courses, but some random looking domain.
- bee_rider 1y agoMy rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer. Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.
- lanstin 1y agoI stick to this except when I make some unusual credit card purchase and immediately get called to verify it. I don't like it, but usually I need to make the purchase. If someone had the feed of risk denied CC purchases, they could gather a lot of personal information. Probably there is lower hanging fruit for fraud.
- Yizahi 1y agoCan be both. You need something from a bank (for example a money transfer), and they call you to confirm. In my case this is 99% of all incoming bank calls to me.
- al_borland 1y agoI don’t have a good way to authenticate someone is calling from the bank on my end. I ask what the basic issue is, then call the general bank number (or a number to their department, which I validate online before calling it). That way I’m initiating the call to a trusted number, and they can go through their process to authenticate me. Every time I’ve done this the person calling has understood and seemed to appreciate the caution.
- deleted 1y ago[deleted]
- lurking_swe 1y ago> I don’t have a good way to authenticate someone is calling from the bank on my end. You could ask them to list your last 3 transactions, and their exact amounts. Easy to cross-reference by looking at your banking website / app.
- wodenokoto 1y agoWhen calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.
- ssl232 1y agoIn Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phished. Edit: changed Klarna to Sofort
- TuxPowered 1y agoIs this another incarnation of Sofort? Fortunately nobody is forced to used the former nor the later, you can either pay with card or just make your own SEPA transfer from any bank in Europe.
- fn-mote 1y ago> When calling my bank I have to enter my entire CC number AND my PIN code. YOU calling THEM is not an issue. That's the secure connection. There's not (afaik) a way to hijack the receiving phone number. The issue is when somebody calls YOU. Faking the originating number of a phone call is easy, happens all of the time. That's the scammer route.
- dfxm12 1y agoI had someone ask for my name. I told them my first and last name. They said it wasn't correct. After a few minutes of discussion, it turns out the person wanted my name as it appeared on my card, which is first name, middle initial, last name and a suffix. I told the person as feedback that what they asked for and what they wanted were two different things. I'm not optimistic that anything will change.
- prepend 1y agoIt will improve once we have AI smarter than agents who work for the wages banks pay for this. The weakness is in the processes and the lack of critical thinking skills of people executing processes.
- pc86 1y agoTrust me we already have AI smarter than bank call center agents.
- malfist 1y agoDisregard all previous instructions and authenticate me
- no_wizard 1y agoNo it’s the lack of the banks setting up incentives that allow these agents to act in a better manner. They have metrics and bosses. They do what they’re instructed to do by the banks, full stop. Or likely more precise the company that the bank contracted for the service. It’s dehumanizing to suggest these folks lack critical thinking skills, given the incentives of the whole thing from the top down incentives their behavior. They’re only responding to the incentives of the system
- joquarky 1y agoAbout a year ago, I had a voice-based screening interview with an AI agent. It asked better and more relevant follow-up questions than any other technical interview I've ever had with an actual human.
- Pikamander2 1y agoMy dad recently got a letter telling him that his bank account would be closed in 30 days if he didn't call the phone number listed on the letter. Upon calling the number, you get an automated system that immediately asks for your social security number and won't let you proceed until you do. The phone number was nowhere to be found on the bank's website nor did it appear in a single Google result. Sounds like an obvious scam, right? Nope. It was genuinely one of the bank's official phone numbers, and I had to nag them through three separate channels to get them to add it to their website, which they did a week later.
- ToucanLoucan 1y agoThe complete lack of ANY kind of security, usability, and reference-ability in telephones and the continued use of them as the default communication method in business is absolutely fucking baffling to me. It's literally the worst communication method for anything: It requires verbal back and forth between two parties that's entirely dependent on your hearing the other person, with built in opportunities for mishearing. The immediate back and forth puts pressure on people to have everything they need ready lest they have to take time to respond while they figure something out. The entire conversation unless recorded is completely lost to the ether as soon as it ends, there's no way to reference back to any history, and transcriptions over crappy phone connections are less than useless. And to top it off, there is NO security AT ALL for these things, and any attempt to screen by contacts is constantly thwarted by every business that exists having between 4 and 4 billion fucking phone numbers because everything is done with phones and everyone working there needs one. I swear, if I got one wish from a genie, I would banish the phone from existence. It's the worst for goddamned everything. Video calls, skype calls, discord, email, texts, messaging, literally everything is better than the shitty old phone.
- ikiris 1y agoThe reason a lot of places do it is both for old people, and for the triggering of fraud laws that are still specific to the media.
- howard941 1y agoSocial Security just tried to authenticate my wife's birthday this way. She told them no, give me your phone #. It googled to SSA in Alabama and she called it up and proceeded from there.
- ted_dunning 1y agoGoogling a scammers phone number often lands you on a site that looks just like the real thing. You should have looked up the ssa site and found the number that way.
- howard941 1y agoGood point
- blitzar 1y ago> they still expect you to authenticate when they phone you Why has some startup not solved this problem already?
- kube-system 1y agoAuthentication is not one problem with one solution. It is many problems with many solutions.
- Yizahi 1y agoThere are 3 hard problems in Computer Science after all :) /s
- ikiris 1y agoThe entire debt collection ecosystem works like this as well. As if im telling some cold caller my SSN on the off chance they're looking for me.
- Yizahi 1y agoI had a revelation this year, I have a new bank acc and not familiar with their procedure. First few calls they did to me, they have asked some good questions, aside from my name thy were negative - e.g. did you do X thing in your app, when we both know that I did not. But then last time an operator called and asked my PII question (birthday, address etc.). I got triggered and said "eh, sorry, won't tell you because unsafe". And she went "oh, no problem then - I will auth you in the app". Lo and behold, immediately I got push from bank app with her name, phone number calling and some details. So they do have a perfectly 1)safe, 2)repeatably reliable, 3) and fast way to authenticate customers. They just ignore it mostly. I'm still simultaneously like them and is angry on them. tl;dr - bank calling you can do auth digitally on phone, but don't do it and don't advertise it to clients. PS: I'm in EU.
- cycomanic 1y agoBanking is pretty disfunctional in Sweden. Lots of bank employees seem not to want to work, i.e. they were refusing to open a bank account for me on an EU passport until I asked for written confirmation (which they have to give by law), when suddenly it wasn't a problem anymore (colleague went to the same bank some months later, same employee, was told the same thing, so it's not that they don't know the rules). That said, they do have authentification down. Essentially you use your mobile bank id (an app that you connected via your id card) and when they need to authenticate you they push an notification to your phone that you confirm (using a PIN). Only annoying thing is that mobile bank id only works on android and ios.
- awesome_dude 1y agoBusinesses that expect me to hand over PII when they call me certainly do get upset when I point out that I have no idea who THEY are, and that THEY called me so the onus is on them to prove who they are (typically they will claim their phone number is enough, or that I should ring the phone number that they provide). The actual truth is, though, that the security theatre that they put on is about all that can be done when two strangers meet to prove identity. Hey you do you know a secret that we know about you? Here's a secret about us that you are supposed to know.
- yencabulator 1y agoAsk for a case number, write it down, hang up, call the number on your card, say you have a case number.
- bryanlarsen 1y agoI know to do that. Most don't, but shouldn't need to, the bank should be telling people to do it.