Earlier quoted context omitted.
Wow exactly the situation in india! We’ve had 2FA, mobile alerts, etc. ever since the dawn of the Internet banking in late 90s. Wasn’t so in the US even as recently as 2010.
But in other respects things are stuck in the past in India too, like your account being tightly coupled to a particular branch of the bank, and many commercial establishments charging extra for card transactions.
Your Mother’s Maiden Name Is Not a Secret
111–120 of 274 posts
Re: Your Mother’s Maiden Name Is Not a Secret
#112My bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".
BMO in Canada is the same, but six characters. And although you can use alphanumeric characters, it automatically doubles as a phone banking password, so (at least at one point) they were all translated into characters 2-9 in their system. So even online, you could log in with the phone digit equivalent of your exactly 6 digit password.
Re: Your Mother’s Maiden Name Is Not a Secret
#113Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…
Australia is fairly similar to this. Particularly the fee free transfers between banks (for both private and business) What’s interesting is that next year most of the banks seem to be launching an instant bank transfer system - big interbank implementation. Right now it takes generally 1 business day if you’ve transacted with that account before and 3 business days if you haven’t. I assume that’s some kind of anti f…
There's the most kickass Bill Pay system ever and DEFT, which allows paying by several methods including the credit card, potentially gaining reward points for paying rent. (Reward credit cards may be pricey though.)
Overseas wire cost a measly flat AU$20 a few years ago in WestPac, local transfer was free and quick to a low-risk recipient (and most recipients are reasonable enough to go on with a transaction if you send them a PDF proving you sent the money). If you run a business, your company account can be accessed via the same customer ID.
Suspicious transactions are spotted and the bank calls you if they suspect foul play; the false alarms are rare. Fraudulent transactions (at least minor) are reversed - happened to me once and to my wife several times. No US-like secrecy for bank account numbers, you normally publish your bank account for the people to make transfer to. Tokens are used for business accounts, while the consumers don't have to bother with these.
There's generally no banking fee unless the account is dormant, and then it's about $5 or something (not $20 - $40 like in the US or Singapore).
Nobody uses cheques, obviously (although they do exist).
In terms of foreign currency transfer, there is also OFX, a nifty service where you can keep your incoming funds until the exchange is more favourable (nope, Transferwise doesn't have it), and that charges you the fraction of what the banks take.
Re: Your Mother’s Maiden Name Is Not a Secret
#114Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…
- ACH in the USA is free and fast (one business day)... and that's the main way of receiving salary, paying bills, etc. Is Europe really any better in this regard?
- No one uses paper checks here either...
Re: Your Mother’s Maiden Name Is Not a Secret
#115Earlier quoted context omitted.
Is it still that slow? Since a few months 95% of my transactions between Germany, the Netherlands and the UK (EUR account) happen the same day. It's not like banks actually can earn interest right now anyway. If anything it costs them to hold money currently.
It probably happens same day only if you send the transfer early in the morning.
I don't do transactions after 6pm or so, therefore no experience that late. All of this only applies to banking days, no transactions get processed on the weekend.
Re: Your Mother’s Maiden Name Is Not a Secret
#116Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…
- We don't use 2FA authentication, I guess because there are more cost effective ways of verifying our identity (probably not going to last much longer with all the breaches) - ACH in the USA is free and fast (one business day)... and that's the main way of receiving salary, paying bills, etc. Is Europe really any better in this regard? - No one uses paper checks here either...
Re: Your Mother’s Maiden Name Is Not a Secret
#117Earlier quoted context omitted.
Online banking isn’t a serious attack vector for fraud, it’s just a faster-updating alternative to a paper monthly statement. 2FA is a silly red herring in these discussions. The problem is fundamentally the transaction model where you pull money from someone’s account simply by knowing some widely-shared secret numbers. These systems are sticky due to network effects. There’s no reason to sign up for an alternative…
When you say fraud, do you mean theft or identity fraud? 2FA is extraordinarily relevant when it comes to theft with regard to online banking. The purpose of 2FA is mostly to prevent automated attacks or remote account entry via password resets by email or something similar. I'm not sure if you're aware, but Europe has proper 2FA in the form of a dongle type device, and not this SMS BS many companies in the US use ou…
If theft through online banking even exists, it's at such a low volume as to be irrelevant. Most online banking interfaces are a read-only view of recent transactions. Some provide the ability to transfer funds between your own linked accounts at the same bank. Fewer still provide bill pay for a specific set of partner institutions, and a tiny proportion of the most technologically sophisticated banks provide the ability to transfer money to any arbitrary person. When they do, adding a new payee is loud (sends a bunch of notifications) and requires SMS verification and/or digits off your debit card. The transfer is loud and takes several days to actually happen (so you can cancel it), and is limited to a couple thousand dollars at most. This is a fringe thing that a handful of people use occasionally. Most peer-to-peer transfers are going to happen through Venmo, which piggy-backs off a debit card, or through paper checks. Most online bill pay is going to happen by giving the biller your account and routing number.
The largest vector by far for stealing from a bank account is capturing a debit card number in some legitimate transaction, and reusing it to make fraudulent transactions. The strength of the communication channel between payer's bank and payer is irrelevant, because you don't get to weigh in on debit card transactions (or checks) against your account. They just happen, and then you can dispute them later.
Re: Your Mother’s Maiden Name Is Not a Secret
#118Earlier quoted context omitted.
Online banking isn’t a serious attack vector for fraud, it’s just a faster-updating alternative to a paper monthly statement. 2FA is a silly red herring in these discussions. The problem is fundamentally the transaction model where you pull money from someone’s account simply by knowing some widely-shared secret numbers. These systems are sticky due to network effects. There’s no reason to sign up for an alternative…
Perversely, initiating an ACH credit is apparently seen as more risky than receiving an ACH debit. I believe this is ultimately due to the originator being responsible for any transaction that turns out to be fraudulent. In general I think the US is comfortable to limp along putting band-aids on broken systems, because the failings are seen as being intrinsic to the "natural state" of things (see also: common law and…
Re: Your Mother’s Maiden Name Is Not a Secret
#119Earlier quoted context omitted.
Note that this rule doesn't apply to the whole SEPA area. Switzerland is a notorious exception, Euro SEPA transfers to there often incur a charge.
Euro SEPA transfers between Switzerland and EU are typically free. At least the major Swiss banks don't charge anything extra. International transfers in other currencies (e.g., CHF, GBP) still incur a fee, though.
Re: Your Mother’s Maiden Name Is Not a Secret
#120Earlier quoted context omitted.
Oh european banks also like to keep the money for a day. Other than that day of interest it's free though :) no 25 dollar wiring fee as seen in US
Since November EU regulation mandates that SEPA transfers should finish within 10 seconds[0]. In practice we're not quite there yet since some smaller regional banks have trouble moving from batch processing to streams, but their deadline extension ends june 2018. [0] https://www.europeanpaymentscouncil.eu/sites/default/files/K...