Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When banks call to verify your details how do you know the call is legitimate?

news.ycombinator.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: When banks call to verify your details how do you know the call is legitimate?

#31

Post by wruza »

pests wrote: post #27

The only time I saw this handled correctly, and I forget the company now, worked like this: They would call you and then want to verify themselves to you. You would be asked to open the companies app. The app noticed you were in a support call and had a link at the top taking you to the support section of the app. The caller would then read you a code you would type in and it would let you know if the call was legit.

Correctly? Try explaining your grandparent that they should open the app and type in some codes while on call. This habit will expose them to a whole class of attacks.

The only proper way is to send push to that app with the information about the issue.

Re: When banks call to verify your details how do you know the call is legitimate?

#33

Post by pests »

wruza wrote: post #31
pests wrote: post #27

The only time I saw this handled correctly, and I forget the company now, worked like this: They would call you and then want to verify themselves to you. You would be asked to open the companies app. The app noticed you were in a support call and had a link at the top taking you to the support section of the app. The caller would then read you a code you would type in and it would let you know if the call was legit.

Correctly? Try explaining your grandparent that they should open the app and type in some codes while on call. This habit will expose them to a whole class of attacks. The only proper way is to send push to that app with the information about the issue.

They would also offer to hang up and when the person finally found the official number and called back, that same code could be given back over the phone to reconnect to the original agent. Or they could go through whatever process they want.

Re: When banks call to verify your details how do you know the call is legitimate?

#34

Post by _ah »

pests wrote: post #27

The only time I saw this handled correctly, and I forget the company now, worked like this: They would call you and then want to verify themselves to you. You would be asked to open the companies app. The app noticed you were in a support call and had a link at the top taking you to the support section of the app. The caller would then read you a code you would type in and it would let you know if the call was legit.

This can be easily attacked with two scammers executing a MITM attack. One calls the bank to impersonate you and steal your money, the other calls you to get your app code.

Re: When banks call to verify your details how do you know the call is legitimate?

#35

Post by creamyhorror »

blurr wrote: post #4
dv_dt wrote: post #2

For info exchanges like this, you should always insist on calling them back at a number listed on their card or website. If they cannot do that then its a scam or you should change banks

Yes, I asked the caller to give me a bank number to call back, to which she replied that they don't have a dedicated line for that purpose (???) and that I had to physically go to a bank to get it done. I'll be changing banks for sure :/

What country is this? It doesn't sound like a banking sector with mature security practices. Major banks in developed markets should have tightened their customer workflows by now.

Re: When banks call to verify your details how do you know the call is legitimate?

#36

Post by carlosjobim »

> Can anyone recommend what best practices banks can follow to ensure safety for both customers and banks in such cases?

You should never entertain any telephone interaction with your bank or any other organization, unless it was you who called them first. Just hang up. You can call them on their officially listed phone number when it suits you, or visit in person.

Re: When banks call to verify your details how do you know the call is legitimate?

#37

Post by bcrl »

TowerTall wrote: post #3

A bank will never call you regarding this. They will send you a letter asking you to call them. In my case when the bank want to get in contact with me they send me a message through their online banking app.

My bank now sends alerts and verification codes via SMS. SMS should be assumed to be completely compromised given that it runs over SS7. 2FA using SMS is worse than an uncompromised password. I am disappointed that more and more banks and websites forcibly allow password recovery using nothing but SMS, but it seems like I'm just tilting at windmills.

Re: When banks call to verify your details how do you know the call is legitimate?

#38

Post by tacostakohashi »

Tell them you don't have a computer or an email address. Say you prefer receiving mailed statements, and have no interest in saving them less than a dollar each month, but they're free to close the account if that's important to them.
Post reply on HN