Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we secure Monzo's banking platform

monzo.com

Post reply on HN
Print view View original

101–110 of 148 posts

Re: How we secure Monzo's banking platform

#101

Post by Milner08 »

nvarsj wrote: post #65
mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

Happy Monzo customer here with it as my primary account for the last 2 years. Haven’t had any issues, and neither have any of my friends. It’s the best possible banking experience imo. I’m happy they are proactive about suspicious activity.

Same here. Its funny that you get accused of being a paid shill, yet the people who so loudly complain get taken seriously. I dont know anyone who's had an issue and I would say 90% of my friends have monzo.

Re: How we secure Monzo's banking platform

#102

Post by Milner08 »

drcongo wrote: post #73
mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

Disgruntled former Monzo customer here too. Froze my account after I cashed out some bitcoin on Coinbase, held on to all my money for over a year and refused to answer support requests. Only got my money back off them when I brought the financial ombudsmen into it. Don't touch them with a ten foot pole.

They explicitly tell you that Cypto is banned tbf.

Re: How we secure Monzo's banking platform

#103

Post by KptMarchewa »

drcongo wrote: post #84
KptMarchewa wrote: post #81

Earlier quoted context omitted.

You know that it does not happen to 99,9% of their customers either? For some reason everyone here thinks they are a snowflake.

You're rather contradicting yourself there. If it's not happening to 99.9% of their customers then we obviously are special snowflakes. Maybe you could think through your attempts at insults a bit better.

It's you who claimed that nothing happens at your other accounts and that has to be "proof" of anything.

Re: How we secure Monzo's banking platform

#104

Post by cameronh90 »

andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

Not Monzo but I can tell you SOME ways we deal with this kind of risk.

* Work laptops are all using trusted computing, tamper detection and remote attestation which, while imperfect, does provide some verification that the hardware isn't being tampered with.

* Additionally it means if you try to access any service from a non-work laptop (or a work laptop failing remote attestation), it doesn't let you in. Even if you have all the credentials.

* Passwordless authentication means capturing PIN codes with a keylogger is of very limited value unless you also steal the laptop. Even then, an additional factor is required such as mobile push or biometric.

* No developer should have access to any AWS keys that would grant access to production data. But in any case, we use AWS SSO which only returns temporary AWS keys.

* There are lots of systems that monitor for anomalous activity. For example if a user account suddenly starts hitting lots of access denied errors or accessing things they don't normally access, that's a hint they've been compromised.

Re: How we secure Monzo's banking platform

#105

Post by smnrchrds »

acallaghan wrote: post #98
Nextgrid wrote: post #91

Earlier quoted context omitted.

The concerning thing is that the other commenter says it took him a year and a complaint to the financial ombudsman to recover his money. False positives are one thing, but it shouldn't take a year to resolve?

I suspect this is more to do with the financial regulation & the bodies that investigate these things, rather than Monzo.

So if we pick any UK bank we will see the exact same issues?

Re: How we secure Monzo's banking platform

#106

Post by drcongo »

KptMarchewa wrote: post #103
drcongo wrote: post #84

Earlier quoted context omitted.

You're rather contradicting yourself there. If it's not happening to 99.9% of their customers then we obviously are special snowflakes. Maybe you could think through your attempts at insults a bit better.

It's you who claimed that nothing happens at your other accounts and that has to be "proof" of anything.

No, I didn't. Try reading it again.

Re: How we secure Monzo's banking platform

#107

Post by nnx »

mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

Most likely some automated AML check...

You are simply a false positive of this ineffective policy that has a success rate of 0.2% according to recent United Stations study: https://www.effectiveaml.org/un-slams-aml-success-rate/

Globally, it has almost zero impact on crime for an infinite cost.

Re: How we secure Monzo's banking platform

#108

Post by avianlyric »

xyst wrote: post #89
jagged-chisel wrote: post #55

Earlier quoted context omitted.

Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

It’s definitely their anti money laundering (AML) detection system kicking in. However it’s clearly getting false positives and their internal AML team is getting hit with a high amount of them thus causing the delays in resolving them. This is why you don’t build your own solutions to well solved problems.

Monzo’s system is a little unique in that it runs fraud and AML checks in real-time while the transaction is being processed, and thus able to block a high risk transaction before it completes. As a result Monzo is frequently able to return stolen funds to victims.

Other banks run their AML systems in batch at the end of the day, and will only freeze an account after the money has left.

So yeah, you’ll see a lot more people complaining about Monzo, because their money will be frozen while they’re trying to exfiltrate it. That doesn’t mean Monzo has an unusually high false positive rate, it just means that people are used to being able to get away with fraudulent behaviour, and have their accounts frozen empty. Rather than being stopped mid-act and having their accounts frozen while they still contain illegitimate funds.

Re: How we secure Monzo's banking platform

#109

Post by nvarsj »

stuckkeys wrote: post #80
nvarsj wrote: post #65

Earlier quoted context omitted.

Happy Monzo customer here with it as my primary account for the last 2 years. Haven’t had any issues, and neither have any of my friends. It’s the best possible banking experience imo. I’m happy they are proactive about suspicious activity.

Sounds like a paid “amazon” review. lul

Haha, I just wanted to provide a counter example to the complaint. Yeah, it did sound a bit like a shill. Just a happy customer though.

Re: How we secure Monzo's banking platform

#110

Post by GordonS »

mrtksn wrote: post #86
andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

Not Monzo, but I have a friend who works at a large global bank HQ in a mid-senior position. They do remote desktop connection into their PC at the office. The work laptops given to them can't connect to anything but the PC in the office(so, it's merely a thin client). A fingerprint reader device connected through the USB port and a physical device for generating single use codes are used in addition to username/pass…

I did some work for a Dutch bank a while back, they had a similar setup.

The lag from remote access (Citrix) drove me nuts!

Post reply on HN