Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Citibank India wants credit card, bank account numbers to stop marketing emails

online.citibank.co.in

Post reply on HN
Print view View original

21–30 of 89 posts

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#21

Post by dec0dedab0de »

jessaustin wrote: post #14
dec0dedab0de wrote: post #13

Earlier quoted context omitted.

Sorry, my edit must have came in while you were typing this.

No worries! My typing speed varies. I'd suggest an additional edit, however. "The only problem" is a big enough problem to vitiate any benefit Citi were attempting to provide here. I suspect this page will disappear as soon as the home office sees it.

It will only disappear if someone actually understands the issue. A post that consists of someone linking to a form probably won't educate them. Every interaction with a bank starts with them asking for this type of info. The real issue is them soliciting it via a link in an email, if that is actually what they are doing.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#22

Post by sidcool »

davideous wrote: post #19

This is illegal in the United States under the CAN-SPAM law From: http://www.business.ftc.gov/documents/bus61-can-spam-act-com... "You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request" (…

The link posted here redirects to a co.in domain. It's Citibank India. I have sent them a message on facebook, in an attempt to bring this to their attention.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#23

Post by sidcool »

wavefunction wrote: post #9
raverbashing wrote: post #5

How about you mark their marketing emails as spam and let them deal with the consequences of that?

This. Poison their IP blocks in the SPAM RBL so they get the message.

I don't think that's a smart move. Let's give them some benefit of doubt and bring this to their attention. I have messaged them on their facebook. Hope this will help.

P.S. I am not a Citibank fan or something. Just trying to deal with this sanely.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#24

Post by wrath »

This is a phishing attack waiting to happen! I never worked at a bank but I'm assuming (maybe I shouldn't) that there are a few people working there that know a thing or two about security. I doubt that any person who claims to be a "security expert" would have let this go by, but I always seemed to be proven wrong. Take for example TDBank in Canada who has a 80's password policy:

Passwords must:

- be 5 to 8 characters in length

- not contain spaces or special characters (e.g. #, &, @)

Poor customers if TD ever gets their password database stolen.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#25

Post by manas2004 »

sidcool wrote: post #22
davideous wrote: post #19

This is illegal in the United States under the CAN-SPAM law From: http://www.business.ftc.gov/documents/bus61-can-spam-act-com... "You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request" (…

The link posted here redirects to a co.in domain. It's Citibank India. I have sent them a message on facebook, in an attempt to bring this to their attention.

OP here. I sent them a tweet, and they replied with a link to a complaint form that - guess what - required me to enter my account number :)

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#26

Post by dec0dedab0de »

sp332 wrote: post #17
dec0dedab0de wrote: post #7

I don't understand the issue, from the banks perspective those are basically your username. It's not like they need to trick you into giving them a number they issued you. EDIT: The only problem I can think of is that it may encourage users to be loose with their info, and therefore be more susceptible to phishing attacks.

What if a customer put in the wrong email address, and the person getting the marketing emails doesn't have any account number with the bank?

That might be interesting indeed, but it does bring up another question. Is this form for other forms of communication as well? Such as postal mail? Is it a way for all customers including those do not have an online account to opt-out of marketing communications? If it is, how else could they implement something like this?

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#27

Post by jessaustin »

dec0dedab0de wrote: post #21
jessaustin wrote: post #14

Earlier quoted context omitted.

No worries! My typing speed varies. I'd suggest an additional edit, however. "The only problem" is a big enough problem to vitiate any benefit Citi were attempting to provide here. I suspect this page will disappear as soon as the home office sees it.

It will only disappear if someone actually understands the issue. A post that consists of someone linking to a form probably won't educate them. Every interaction with a bank starts with them asking for this type of info. The real issue is them soliciting it via a link in an email, if that is actually what they are doing.

I'm pretty sure that Citibank International have someone on staff (perhaps a secretary? maybe even a VP...) who would immediately see the problem with this page. It's been some time since I banked online with a "big" bank, but do they routinely ask for one's account number in order to get off spam lists?

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#28

Post by gardarh »

wrath wrote: post #24

This is a phishing attack waiting to happen! I never worked at a bank but I'm assuming (maybe I shouldn't) that there are a few people working there that know a thing or two about security. I doubt that any person who claims to be a "security expert" would have let this go by, but I always seemed to be proven wrong. Take for example TDBank in Canada who has a 80's password policy: Passwords must: - be 5 to 8 characte…

They might be running AS/400 as their backend systems, I recently saw a terminal to one of those in a bank and to my shocking surprise the passwords were not even encrypted on that system.

I imagine that passwords are kept in the same database as transactions so I'm not sure the passwords would be the primary concern in the case of a break in.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#29

Post by nodata »

wrath wrote: post #24

This is a phishing attack waiting to happen! I never worked at a bank but I'm assuming (maybe I shouldn't) that there are a few people working there that know a thing or two about security. I doubt that any person who claims to be a "security expert" would have let this go by, but I always seemed to be proven wrong. Take for example TDBank in Canada who has a 80's password policy: Passwords must: - be 5 to 8 characte…

Or the classic bank telephones you and asks to verify your identity by answering your secret questions and answers. facepalm

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#30

Post by chaz »

To be ever so slightly more fair to Citibank, this is the page after you've already said you have a relationship with them. This is where you choose: http://www.online.citibank.co.in/customerservice/DND.htm. The other option asks for your email and phone number. Still, poorly designed and surprised it's considered to be in compliance. Phone and email inputs should be enough.
Post reply on HN