61–67 of 67 posts
Earlier quoted context omitted.
I have written quite a few checks to people I don't know. I don't think too many people think twice about it.
Donald Knuth used to write checks in hexadecimal amounts to people who reported errors in his books (I have $7.68) but had to stop because people post photos of the checks online and the numbers printed on them can be used for fraud.
Earlier quoted context omitted.
Seems like a good way to get war-dialed account numbers.
In most countries, bank account numbers are not sensitive information. That is an american oddity.
I work in the american bank industry. Just the status that 'bob jones has an account here' is considered personal information.
This might seem silly, but there are good reasons for it.
At least this is explainable by designers not anticipating hard cases. I remember the shittiest app from HSBC (who, by the way, seem to be sleepwalking their way through retail banking, with no direction from anyone who cares), which asked: "What is the answer to your chosen secret question?"
It's dumbfounding how awful bank websites are at security. They started with the stupidest conceivable way to implement two-factor--a second clear-text password that is an answer to a very small number of secret questions. Then they limited the secret questions to things people could find out about you on Facebook, then on top of that added secret questions about esoteric crap like your father's mother's childhood ne…
Earlier quoted context omitted.
This is a different issue. It's not about verifying your own identity, it's about verifying the account number when making a payment to somebody else. The name on their account must exactly match the one that you entered or you get a warning.
It solves the same problem by using national identifier/phone number and displaying the nickname which can be easily verified. The national ID has a checksum letter appended so simple typos are not very likely.
Earlier quoted context omitted.
Suggestion: get and save a copy of your credit report from each of the major credit reporting agencies. They are required by to give you a free copy of your report if you request it, and you can ask for a copy annually [1]. Then when you get a question and you aren't sure if it is one of the "ringers" or one of the ones that comes from errors on your credit report, you can check the reports to help decide. I've got a…
It's a catch 22 - in the UK at least, answering those questions is how you sign up for a credit report in the first place.
Unless there is a lot of wrong information in your report, there is a good chance at least one of them won't use the wrong information in their set of questions.
Once you've got one downloaded and saved, you can try again with the others, checking any questions you are unsure about against the first download.
Time to add a Falsehood[] Programmers Believe About Names: that it's even remotely possible to "match" them. That's just not how names work, frankly.
As a sanity check it’s not a bad system. If you’re expecting you send money to a John Doe it makes sense to be able to tell the bank this so they can compare and come back with “uhh this account is owned by a Mary Sue, are you sure?” As far as catching mistakes I’m sure it’s fantastically good. The odds that a mistyped account number happened to land on someone with the same name is probably vanishingly low. And that…