5 ms·
First, its not off CID, its off ANI (ANI is what is passed to the remote endpoint when you call a toll free number), not that you cant spoof ANI - but often it
by Aloha 14y ago
First, its not off CID, its off ANI (ANI is what is passed to the remote endpoint when you call a toll free number), not that you cant spoof ANI - but often it can be a little harder, as its used in billing on the telco side.
Second, every bank does something like this, I can access my credit card by phone with just the last four digits of my account number, and by calling in from my phone. I can do the same thing with my BofA account number in lieu of my SSN.
Third, again, every bank is like this to some extent - every CC I have, if I call in from my number, and key in the last for digits of my credit card, I can get info. I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have.
- philsnow 14y ago"Second, every bank does something like this" I can't tell if your implying that this makes the practice somehow less bad, but I hope not. "I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have." It's a considerable amount of information for a random stranger to have, but _not_ for an attacker.
- georgeorwell 14y agoJust because I had no idea what your acronyms meant: CID: Caller ID ANI: Automatic Number Identification http://www.egyed.com/faq/cid.htm http://www.egyed.com/faq/cid.htm If this is a widespread vulnerability, why is it left open? Also, my bank wants a 13-digit access card number and a 4-digit PIN, which is secure enough for me.
- mikeash 14y agoCredit cards are a vastly different scenario than bank accounts. To a first approximation, unauthorized credit card access poses zero risk to the cardholder. Bank accounts are vastly different in that respect. Can you access your checking/savings account like this, not just your credit cards?
- ams6110 14y agoSince they hacked it via a common CID spoofing site, that would seem to indicate that it is using caller ID.