Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My bank keeps on undermining anti-phishing education

moritz-mander.de

Post reply on HN
Print view View original

191–200 of 267 posts

Re: My bank keeps on undermining anti-phishing education

#191

Post by mike_hearn »

cyberbanjo wrote: post #57
mike_hearn wrote: post #42

Earlier quoted context omitted.

Nearly. It almost certainly never even touched IT. The issue is that marketing is organizationally separate from IT and doesn't want to interact with them. IT is probably behind a slow, outsourced ticket based process and will take weeks to do a simple thing. They may also have random opinions about stuff marketing doesn't want them to have opinions about. So building out promos like this is delegated to SaaS service…

Have you tried what you're recommending without an ad block extension recently?

I never use adblockers, so yes.

Re: My bank keeps on undermining anti-phishing education

#192

Post by microtonal »

JoshTriplett wrote: post #102
microtonal wrote: post #63

Earlier quoted context omitted.

One of my former banks handled this pretty well. They called you and would say something like “there is an issue, but since you should never trust a direct phone call pretending to be your bank, please look up our number on our website and call us”. It’s kinda nice because while doing this, they also educate their customers to never trust such a call and to rely on official information to contact them.

That is a great demonstration of best practices. What bank was that?

I was probably the Dutch ING or ABN-AMRO, we went through too many banks and between two countries :D.

The Dutch ING now has a new thing where you can verify in the banking app if it's them calling you:

https://www.ing.nl/de-ing/veilig-bankieren/wat-kan-je-zelf-d...

(I guess in some sense it's a step back because the bank is calling you again, but it's nice that you can verify it live in the app.)

Re: My bank keeps on undermining anti-phishing education

#193

Post by the8472 »

Hackbraten wrote: post #182
the8472 wrote: post #96

Earlier quoted context omitted.

> which tells you not to click links in emails (which is good advice!). Hardly. The company shouldn't have XSRF-vulnerable software, if your browser is vulnerable you have bigger problems and what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. But of course there's an internal "phising test" that penalizes you for clicking on links... links that have been obfuscated…

> what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. Then why even click on it in the first place (and risk your email address getting flagged as active in some illicit database?)

Because the aforementioned built-in link obfuscation makes it hard to even tell if the link goes to one of our work domains. And pretty much all our stuff is behind SSO, so if something asks for creds that's an easier tell than hovering over the link and trying to figure out where it goes. And sometimes they introduce new tools on new domains that may be legit.

Generally clicking on the link is not what gets you compromised (except for some spearphishing involving zero-days...). It's actions following that which might. So they're barking up the wrong tree and penalize people for that. That's just chicanery.

Re: My bank keeps on undermining anti-phishing education

#194

Post by LorenPechtel »

s3p wrote: post #179
meindnoch wrote: post #39

My bank used to call me with random marketing crap, and insisted on telling them my birthday and my mother's name before they can reveal their latest exclusive offer or some other crap. They were always dumbfounded when I retorted that it is them who need to prove that they're really calling from my bank first.

I have this happen all the time in healthcare. I had someone from a specialist office call me and immediately ask me for my date of birth. Their surprise when I said no was incredible. But I agree with you, if THEY are the ones calling, they need to prove their identity.

I've got one that their phone robot says it's a message from my doctor's office, does not identify the office. Almost dismissed it as garbage, then realized it could be related to an upcoming appointment. And it's not even really right--unspecified doctor of mine would be my PCP, not the specialist.

Unfortunately, the medical world is caught between a rock and a hard place in this case. Can't give any info to anybody but the patient--which means they can't identify themselves when they call as the practice name directly reveals their specialty, or the doctor (google will reveal their area of practice.) And the office that's doing this is an area where some patients would want it confidential.

I think maybe it could be resolved by having the medical world go to a correct horse battery staple model--on first contact you're given a set of random words that will be used as an identifier for future contacts. Each patient gets different words so all anyone else can infer is that it's a medical provider.

I much prefer the places that go with don't leave a message/leave a brief message/leave a detailed message. No need to add security to situations that don't need it.

Re: My bank keeps on undermining anti-phishing education

#195

Post by astura »

pyuser583 wrote: post #87

When buying or selling a house, this can get really bad. You have all sorts of entities which extensions of other entities. The bank has a mortgage sector which uses a different domain. I also had to deal with a medical device recall, which was terrible. I had to trust some skeezy domains. This isn't hard to fix, all you need to do is list on your website your "partner domains." My personal security protocol was to s…

>When buying or selling a house, this can get really bad. You have all sorts of entities which extensions of other entities. The bank has a mortgage sector which uses a different domain

Huh? I got my mortgage thru a mortgage broker and I only dealt with a single person.

Re: My bank keeps on undermining anti-phishing education

#196

Post by LorenPechtel »

mike_hearn wrote: post #42
phendrenad2 wrote: post #26

> So the next idea is to register the domain as a subdomain I think the problem is, someone in the IT department understands the high risk associated with handing out subdomains, so they refuse to do it. So other parts of the company "work around" this by registering their own domain name. I wonder how companies like Google handle this. A subdomain of google.com is probably the most valuable hack target in the world,…

Nearly. It almost certainly never even touched IT. The issue is that marketing is organizationally separate from IT and doesn't want to interact with them. IT is probably behind a slow, outsourced ticket based process and will take weeks to do a simple thing. They may also have random opinions about stuff marketing doesn't want them to have opinions about. So building out promos like this is delegated to SaaS service…

Doesn't need to be IT being slow. I've seen it happen--we warned the guy to talk to us before putting up the new website. Admittedly, I was on the other side of the world and only reachable by e-mail, but the other guy was there in his office.

I don't know if he ever truly understood how he took out all company e-mail for nearly a week.

And trust links from Google? Keep up with the times! Sometimes the first hit is the scammers.

Re: My bank keeps on undermining anti-phishing education

#197

Post by LorenPechtel »

GolDDranks wrote: post #132
BobAliceInATree wrote: post #74

Earlier quoted context omitted.

You're giving a MFA number to someone that called you?!

The bank I used to use had a per-verification request code that the app showed. If the party dealing with you knew the code, you could be sure they were the party who initiated the verification request.

But you said you read back the code. It should be the other way around--*you* compare the code they give you with the code the app gives you. Give zero information until identity is confirmed.

Re: My bank keeps on undermining anti-phishing education

#198

Post by _zagj »

taneq wrote: post #32
TheFreim wrote: post #6

My bank uses a fraud detection system that calls you if suspicious activity is detected on your account. It then asks you to call back a number to verify the account activity. Every time they call, they provide a different callback number. Searching for the callback number online yields only one result, which is the fraud detection systems web page telling you to NOT trust phone calls of any kind (their advice is sol…

Just piggybacking on this, if your bank (or eBay or Amazon or whoever) ever calls you to inform you of a suspected hack on your account, and says they're sending you a 2 factor authentication code to confirm your identity, do NOT tell them the code. It sounds obvious when phrased like this, but if you're not familiar with the scam then yeah, it's a scam and they're trying to get your 2FA token in order to access your…

> do NOT tell them the code

When my father calls his bank, they actually verify him by sending a 2FA code to his email that he reads back.

Re: My bank keeps on undermining anti-phishing education

#199

Post by bsoles »

When I got locked out of my mobile banking app, I got a security code in email to reset the app or something, but it didn't work. Then, I've called my customer representative for help, who promptly asked me to tell her the security code in the email so that she can reset the app. Yet, the email, in bold letters, said to never divulge the code to anybody, including the bank personnel...

Re: My bank keeps on undermining anti-phishing education

#200

Post by tempnew »

massung wrote: post #177
mnw21cam wrote: post #160

Earlier quoted context omitted.

That is a really bad idea. That's letting anyone who phones you prove to the bank that they are you. You should only reveal an MFA code to someone that you have called, knowing that it is the right person.

Walk me through the chain you’re thinking of. I want to understand it better. If you’re thinking that - for example - someone is attempting to log into my account online and simultaneously call me pretending to be the bank. They are presented with an MFA check and tell me they initiated it. I give it to them unwittingly, and note they are in. My understanding is that isn’t possible here, because this “MFA check” is d…

The scammer calls the bank rather than trying to login. When calling, they will be asked to verify with info and the code which they will get from you. Think mitm but telephone based. The verification info (maybe just a zip code or last 4 of ssn or something publicly available) can be acquired beforehand so they only need the code to be relayed. Obviously they have to get the timing right, so you might be on the phone for a few minutes before they find a reason to ask for the code.
Post reply on HN