10 ms·

>How would a user detect that it is fake? I use challenge response. They ask a question, you give them the wrong answer, they confirm that it's wrong. You and

>How would a user detect that it is fake? I use challenge response. They ask a question, you give them the wrong answer, they confirm that it's wrong. You and the banks have shared secrets.

cortesoft 11y ago
What is to stop the bad guy from calling the bank at the same time they call you, and passing your challenge and responses on to the bank teller?
- dublinben 11y ago
  Nothing. This is a classic MITM attack. Only out of band verification or a preshared secret would prevent that.