My bank keeps on undermining anti-phishing education • Hacker News Board

Re: My bank keeps on undermining anti-phishing education

#161

Post by hypersoar » Thu, Jul 17, 2025, 4:49 PM UTC

TheFreim wrote: post #6

My bank uses a fraud detection system that calls you if suspicious activity is detected on your account. It then asks you to call back a number to verify the account activity. Every time they call, they provide a different callback number. Searching for the callback number online yields only one result, which is the fraud detection systems web page telling you to NOT trust phone calls of any kind (their advice is sol…

I briefly worked on a product related to this. It was a chatbot meant to replace the human phonecall in just this situation. The user would get a text from the bank with a link to the chatbot. They ended up not being able to sell; the common complaint from the banks was that they'd been training their users to never click links like that.

Re: My bank keeps on undermining anti-phishing education

#162

Post by cvoss » Thu, Jul 17, 2025, 4:50 PM UTC

RandomBacon wrote: post #140

andrewmcwatters wrote: post #120

Earlier quoted context omitted.

There’s no other way to do it. Not all banks expose an API.

> There’s no other way to do it. Don't they allow you to manually enter the bank routing number and account number, then verify it by depositing and withdrawing a few cents?

You can't query account balances and transactions through ACH.

Re: My bank keeps on undermining anti-phishing education

#163

Post by tharos47 » Thu, Jul 17, 2025, 4:51 PM UTC

Here is american Express "secure email" documentation : https://www.americanexpress.com/us/customer-service/secure-e...

I've mistakenly deleted from our mail quarantine multiple times as spam/phishing. Imho it's wilful négligence toynkeep such a system operating in 2025.

Re: My bank keeps on undermining anti-phishing education

#164

Post by nullc » Thu, Jul 17, 2025, 4:51 PM UTC

RandomBacon wrote: post #142

1shooner wrote: post #103

I left Chase because their anti-fraud detection was so suspicious that Chase's own customer service told me it was fraud and had me close my checking account in the middle of a vacation. Only later I put together it was legitimate fraud detectiontriggering on an unexpected transaction location.

I called the number on the back of my Chase credit card (which goes to a call center in what sounds like India), and the person told me he has to verify me by hanging up, and then not to call anyone because he will call back in a few minutes... (Probably while he's on a "bathroom break" running to the scam center on the next floor of the same building.) All the other times, they just ask for my verbal password to ver…

In some instances where scambaters have hacked the scammers network video recorder you can see them working legitimate calls from the same desks... the outsourced call center can achieve 100% utilization by using all idle capacity for outbound fraud and if data access from the legitimate side helps with the criminal side, well that's just the synergy of horizontal integration for you.

Re: My bank keeps on undermining anti-phishing education

#165

Post by zero_k » Thu, Jul 17, 2025, 4:57 PM UTC

I'm also with Sparkasse and it's the worst. Their digital systems and their technical understanding is the bottom of the barrel. On the other hand, the "most digital bank" in Germany, N26, a so called "neobank" has laughable security [1]. It's a huge mess over here. I used to also bank in Singapore, the difference is night and day. Fun story: Sparkasse has an integration with a stock brokerage, and the stock charts are PNGs generated at the backend. It's literally 1995-level HTML usage, One can only laugh.

[1] https://archive.org/details/33C3-Shut_Up_and_Take_My_Money

Re: My bank keeps on undermining anti-phishing education

#166

Post by mcv » Thu, Jul 17, 2025, 5:04 PM UTC

I would hope your national bank regulatir would slap this down hard, but if the government does exactly the same thing, your country might be doomed.

Training about this kind of thing is mandatory for bank employees in my country, as far as I know.

Re: My bank keeps on undermining anti-phishing education

#167

Post by FireBeyond » Thu, Jul 17, 2025, 5:08 PM UTC

notpushkin wrote: post #55

imzadi wrote: post #18

Earlier quoted context omitted.

My mom was recently phished. The scammer got into her bank accounts and charged a bunch of air india tickets to her credit card and used zelle to transfer money out. When we reported it to the bank they said it wasn't covered because their fraud protection doesn't cover scams. So the banks just don't care. (It was Capital One FYI)

> their fraud protection doesn't cover scams Eh?

One of Zelle's explicit design goals, couched in customer convenience, was as a mechanism to offload as much fraud liability onto the customer and away from the member banks.

Re: My bank keeps on undermining anti-phishing education

#168

Post by mejutoco » Thu, Jul 17, 2025, 5:12 PM UTC

vladvasiliu wrote: post #62

thmsths wrote: post #43

Earlier quoted context omitted.

I wonder if it's because they look at security more globally. Their actions probably keep lowering security for people who understand the risks and are willing to take the extra steps to protect themselves but on the other hand they probably drive up adoption of some extra security for most other folks. Or if you want to be less charitable: they were tired with dealing with support calls from a lot of tech illiterate…

I'm sensible to these considerations. But I don't see how a JS applet where you need to click on a bunch of numbers in plain view of whoever is curious to look over your shoulder helps with this. People have to type in their customer number in a regular text field anyway, so why not use the same thing for the password?

My guess is one field (password) protected from keyloggers is more secure than no fields protected from keyloggers. Although I agree it is counterproductive to limit the number of characters so much.

Re: My bank keeps on undermining anti-phishing education

#169

Post by Gunax » Thu, Jul 17, 2025, 5:12 PM UTC

x0x0 wrote: post #105

diggan wrote: post #100

Earlier quoted context omitted.

Yeah, I think they don't have any people working on the full UX flow, my bank does similarly weird stuff. The example that comes into mind is making transfers to my wife, where every time I do it, they ask me to confirm a bunch of questions to make sure it's not a scam/fraud, which fine, good idea. Once I confirm, they display another notice telling me they won't ask for a confirmation/2FA code because I make transfe…

The idiots at my former credit union apparently subcontract out their credit cards to some east coast bank, whereas my bank and I live on the west coast. I saw some bank from Florida, that I'd never heard of, calling me on my cell. I assumed it was some sort of scam and ignored it. They're too stupid to get a phone number which has caller id set up to read the name of credit union with whom I did business. Just amazi…

Well, afaik caller id is actually unauthenticated and can be trivially impersonated.

Re: My bank keeps on undermining anti-phishing education

#170

Post by mejutoco » Thu, Jul 17, 2025, 5:15 PM UTC

hahn-kev wrote: post #159

mnw21cam wrote: post #155

Earlier quoted context omitted.

If the hashing is done on the client and then sent to the server, then the server is effectively just processing as a plaintext password. If an attacker gets hold of the server password database, then they can just connect to the server and pretend to be the client and hand it the hashed password that they read from the database breach. If you hash the password on the server instead, then if the password database is…

No it's not. Did you ever think that you can hash something twice? Hash it once on the client, then hash and salt it server side, like normal. It means that the server never actually knows your password, but that's about all it gives you.

> It means that the server never actually knows your password

If the client is hashing it without a salt the server could simply check a Rainbow table (https://en.wikipedia.org/wiki/Rainbow_table) to know which password it is. For short inputs this could be trivial.