4 ms·

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

ssl232 1y ago
In Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phished. Edit: changed Klarna to Sofort
- TuxPowered 1y ago
  Is this another incarnation of Sofort? Fortunately nobody is forced to used the former nor the later, you can either pay with card or just make your own SEPA transfer from any bank in Europe.
  - ssl232 1y ago
    Ah yes it was Sofort, not Klarna.
  - dzhiurgis 1y ago
    At least in Lithuania the "nobody is forced to used" is partly true. Sometimes in checkout flow you get links to big-5 banks and thats it, even tho technically entire SEPA should be ok.
fn-mote 1y ago
> When calling my bank I have to enter my entire CC number AND my PIN code. YOU calling THEM is not an issue. That's the secure connection. There's not (afaik) a way to hijack the receiving phone number. The issue is when somebody calls YOU. Faking the originating number of a phone call is easy, happens all of the time. That's the scammer route.
- g_p 1y ago
  There are absolutely ways to intercept a call from a targeted user that would be viable to use to gain access to a mid to high value user's funds. SS7 call routing and rogue 2G base stations are some potential approaches. In terms of banking security, a good (ideal) architecture would treat the user PIN as a credential which is not transmitted over insecure means. Unfortunately many banks don't do this right, and still support bank-side PIN verification (with the PIN sent over the wire to the bank), rather than using the bank card's smart card features to carry out on-chip PIN verification. If you built a bank from scratch, for security first, you'd likely still use smart cards as bank cards, but you'd only do PIN verification on-card, so the user PIN is never exposed to even the bank - the card can securely vouch for the PIN in a manner that's far more costly for an attacker to defeat than using a $5 wrench against the user of the card to make them reveal the PIN (h/t to XKCD). Sending the card number and PIN over the phone is just asking for trouble - mobile phone calls are decrypted at the base station and available in the clear, before being transmitted up into the wider telecoms network.
  - danaris 1y ago
    While this is true, this is a completely different threat model than most people face. For 99% of people, 99% of the time, what they need to worry about is someone calling them suspiciously asking for key information. The fact that targeted attacks like that exist does not make it a good idea to treat them as ubiquitous. People with the kind of money that would make executing such an attack worthwhile should be expected to take higher precautions than the rest of us with it.
  - joquarky 1y ago
    Also SS7 isn't secure at all. It relies entirely on good faith.
crazygringo 1y ago
What is the issue? That's literally just your account number and the password. That's what you're supposed to do. That's what security is. That's the sensitive data that ensures it's not a rando calling who stole your card. I'm not sure what alternative you are looking for? You're the one calling them, so it's fine.
- matthewdgreen 1y ago
  The passcode to call your bank for basic customer service probably shouldn’t be the same passcode that lets people spend money on your account. Even TOTP is better than this.
  - crazygringo 1y ago
    Why not? Basic customer service lets you do things like transfer money too, so you need something just as secure as a PIN. So why would you want two different security mechanisms? Either it's you or it's not.
    - shawabawa3 1y ago
      In the UK customer service absolutely cannot transfer money The banking system is so backwards in the US it's actually insane, you've just got used to it
- wodenokoto 1y ago
  It's teaching people to handover their pin code on the phone. It goes against their own security advice of never handing over CC details on the phone > You're the one calling them, so it's fine. Again, normalizing handing over complete CC details on the phone makes it much easier for scammers calling to succeed in asking for those details.
- joquarky 1y ago
  For one thing, DTMF codes are intentionally distinct and easy to pick up and decode within a decent radius of the device.

ssl232 1y ago

In Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phished. Edit: changed Klarna to Sofort

TuxPowered 1y ago
Is this another incarnation of Sofort? Fortunately nobody is forced to used the former nor the later, you can either pay with card or just make your own SEPA transfer from any bank in Europe.
- ssl232 1y ago
  Ah yes it was Sofort, not Klarna.
- dzhiurgis 1y ago
  At least in Lithuania the "nobody is forced to used" is partly true. Sometimes in checkout flow you get links to big-5 banks and thats it, even tho technically entire SEPA should be ok.

fn-mote 1y ago

> When calling my bank I have to enter my entire CC number AND my PIN code. YOU calling THEM is not an issue. That's the secure connection. There's not (afaik) a way to hijack the receiving phone number. The issue is when somebody calls YOU. Faking the originating number of a phone call is easy, happens all of the time. That's the scammer route.

g_p 1y ago
There are absolutely ways to intercept a call from a targeted user that would be viable to use to gain access to a mid to high value user's funds. SS7 call routing and rogue 2G base stations are some potential approaches. In terms of banking security, a good (ideal) architecture would treat the user PIN as a credential which is not transmitted over insecure means. Unfortunately many banks don't do this right, and still support bank-side PIN verification (with the PIN sent over the wire to the bank), rather than using the bank card's smart card features to carry out on-chip PIN verification. If you built a bank from scratch, for security first, you'd likely still use smart cards as bank cards, but you'd only do PIN verification on-card, so the user PIN is never exposed to even the bank - the card can securely vouch for the PIN in a manner that's far more costly for an attacker to defeat than using a $5 wrench against the user of the card to make them reveal the PIN (h/t to XKCD). Sending the card number and PIN over the phone is just asking for trouble - mobile phone calls are decrypted at the base station and available in the clear, before being transmitted up into the wider telecoms network.
- danaris 1y ago
  While this is true, this is a completely different threat model than most people face. For 99% of people, 99% of the time, what they need to worry about is someone calling them suspiciously asking for key information. The fact that targeted attacks like that exist does not make it a good idea to treat them as ubiquitous. People with the kind of money that would make executing such an attack worthwhile should be expected to take higher precautions than the rest of us with it.
- joquarky 1y ago
  Also SS7 isn't secure at all. It relies entirely on good faith.

crazygringo 1y ago

What is the issue? That's literally just your account number and the password. That's what you're supposed to do. That's what security is. That's the sensitive data that ensures it's not a rando calling who stole your card. I'm not sure what alternative you are looking for? You're the one calling them, so it's fine.

matthewdgreen 1y ago
The passcode to call your bank for basic customer service probably shouldn’t be the same passcode that lets people spend money on your account. Even TOTP is better than this.
- crazygringo 1y ago
  Why not? Basic customer service lets you do things like transfer money too, so you need something just as secure as a PIN. So why would you want two different security mechanisms? Either it's you or it's not.
  - shawabawa3 1y ago
    In the UK customer service absolutely cannot transfer money The banking system is so backwards in the US it's actually insane, you've just got used to it
wodenokoto 1y ago
It's teaching people to handover their pin code on the phone. It goes against their own security advice of never handing over CC details on the phone > You're the one calling them, so it's fine. Again, normalizing handing over complete CC details on the phone makes it much easier for scammers calling to succeed in asking for those details.
joquarky 1y ago
For one thing, DTMF codes are intentionally distinct and easy to pick up and decode within a decent radius of the device.