341–350 of 406 posts
I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…
OK this is probably an overstatement, but the 99% to 1% ratio must to be questioned though.
I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…
Earlier quoted context omitted.
I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".
I used to live in Baltimore, where there are numbered streets that include ½ symbol streets, and worse, house numbers including ½ numbered houses.
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
— everyone has a USA taxpayer ID
The only issue is some places now accept UPI payments only.
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
This one is only tangentially related to fraud prevention. But I've never really understood this. Is the Accept-Language header really so inaccurate?
Earlier quoted context omitted.
If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP, I would have nothing but good... well, there was the two times, yes, two times in a month that I had to spend hours on the phone telling them to stop letting people randomly transfer securities into my account without my consent. They assured me that (1) it would be illegal for me to refuse the request to take bac…
> If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP Symantec VIP is just TOTP with a proprietary app/enrollment process. It has been reverse engineered [1], allowing you to use any TOTP app. I have been accessing Schwab and other banking sites this way for years. [1] https://github.com/dlenski/python-vipaccess
I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…
This is your bank's problem. I am Australian, while roaming internationally incoming SMS is free. Next my bank sends in app notifications, not texts.
Earlier quoted context omitted.
I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".
-- No one was born on 4/20/69 -- Forced SMS based MFA should be used to protect logins for mobile phone accounts
I have now closed three remote banking accounts (i.e. no nearby physical locations), after they began requiring 2FA via SMS [which I do not participate/allow/text].
My most-recent bank is literally down the street from me so I can walk over when 2FA becomes ubiquitous. Such an annoying "feature".