Live data from Hacker News

A bank security check that leaves you guessing your own name

theguardian.com

11–20 of 67 posts

Re: A bank security check that leaves you guessing your own name

#12

The Thai version of this doesn’t require you to enter the recipient name, you just enter a number and a bank ... and it tells you the recipient name for you to check. Pretty fool proof except that it leaks names for bank account details

Seems like a good way to get war-dialed account numbers.

Re: A bank security check that leaves you guessing your own name

#13
post #11

Time to add a Falsehood[] Programmers Believe About Names: that it's even remotely possible to "match" them. That's just not how names work, frankly.

As a sanity check it’s not a bad system. If you’re expecting you send money to a John Doe it makes sense to be able to tell the bank this so they can compare and come back with “uhh this account is owned by a Mary Sue, are you sure?” As far as catching mistakes I’m sure it’s fantastically good. The odds that a mistyped account number happened to land on someone with the same name is probably vanishingly low.

And that really seems to be all this is except that it uses the naivest process to do the check.

Re: A bank security check that leaves you guessing your own name

#14
Singapore has this figured out, it's not THAT hard, especially when you have a solid national identity / SSO design.

You can use phone number or national ID number to register and that's all that is needed but you can set a display name freely if you don't want your name to leak via reverse lookup.

Generating QR also is available right in app and accepted pretty much universal via the same app you can check in for contact tracing or logging into government services or banks. Opening an account now is as simple as confirming a personal data sharing request sent to your app - no more paper forms

https://www.straitstimes.com/tech/singpass-to-be-upgraded-to...

Re: A bank security check that leaves you guessing your own name

#15

The Thai version of this doesn’t require you to enter the recipient name, you just enter a number and a bank ... and it tells you the recipient name for you to check. Pretty fool proof except that it leaks names for bank account details

Seems like a good way to get war-dialed account numbers.

In most countries, bank account numbers are not sensitive information. That is an american oddity.

Re: A bank security check that leaves you guessing your own name

#16

Earlier quoted context omitted.

Seems like a good way to get war-dialed account numbers.

In most countries, bank account numbers are not sensitive information. That is an american oddity.

> In most countries, bank account numbers are not sensitive information. That is an american oddity.

They're not really secret in America either. I mean, the account details are on every check for instance.

Re: A bank security check that leaves you guessing your own name

#17
At least this is explainable by designers not anticipating hard cases.

I remember the shittiest app from HSBC (who, by the way, seem to be sleepwalking their way through retail banking, with no direction from anyone who cares), which asked:

"What is the answer to your chosen secret question?"

Re: A bank security check that leaves you guessing your own name

#18
post #16

Earlier quoted context omitted.

In most countries, bank account numbers are not sensitive information. That is an american oddity.

> In most countries, bank account numbers are not sensitive information. That is an american oddity. They're not really secret in America either. I mean, the account details are on every check for instance.

Yeah, but I dare you give out your account number to a random person. The bank security system here is ridiculous.

I always stick to cashier's check for this very reason (and for accounting purpose).

Re: A bank security check that leaves you guessing your own name

#20

Singapore has this figured out, it's not THAT hard, especially when you have a solid national identity / SSO design . You can use phone number or national ID number to register and that's all that is needed but you can set a display name freely if you don't want your name to leak via reverse lookup. Generating QR also is available right in app and accepted pretty much universal via the same app you can check in for c…

[deleted]
Post reply on HN