Citibank India wants credit card, bank account numbers to stop marketing emails • Hacker News Board

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#41

Post by Crito » Sun, Dec 29, 2013, 4:02 PM UTC

raverbashing wrote: post #39

dxgray wrote: post #36

Earlier quoted context omitted.

What about the users who need to get account related email that they signed up for? I understand your disdain for unwanted email, I share it, but why should our opinions have a negative effect on others.

Banks should send ZERO emails, period. It's not secure for that. I do sometimes get emails from them but they're "useless" (usually a simple notification) Several banks have their own message box inside of Internet Banking.

I have my bank send me an email saying "you've made a credit card purchase" every time I make a credit card purchase, just as a low-hassle way of keeping an eye on things, but those emails seem to be sent from completely separate systems from the (very occasional) marketing-ish email. The later they seem to contract out.

Certainly nothing that I need comes through email.

I would expect that they are separate systems for Citibank as well.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#42

Post by mikeash » Sun, Dec 29, 2013, 4:04 PM UTC

dxgray wrote: post #36

Crito wrote: post #33

Earlier quoted context omitted.

What is the downside for the end users that makes this not a smart move?

What about the users who need to get account related email that they signed up for? I understand your disdain for unwanted email, I share it, but why should our opinions have a negative effect on others.

Don't blame the victim. If Citi is sending unwanted e-mails with no good way to unsubscribe then they are sending spam, and the fault lies with them, not with the people who say to themselves, "hey, this is spam, I should report it as such."

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#43

Post by jasonlotito » Sun, Dec 29, 2013, 4:04 PM UTC

dxgray wrote: post #36

Crito wrote: post #33

Earlier quoted context omitted.

What is the downside for the end users that makes this not a smart move?

What about the users who need to get account related email that they signed up for? I understand your disdain for unwanted email, I share it, but why should our opinions have a negative effect on others.

To be fair, me labeling something in my email client as junk doesn't signal my intent to harm other people's experience. If it does that, the blame is on the service providers: namely those signaling intent which I did not wish to signal.

The issue other users have are with their own service providers using a system that apparently can be easily gamed or falsified.

Finally, the problem is on Citibank's end, but sending unwanted email with people who have explicitly requested they stop.

If users don't get account related email they signed up for, it's on Citibank's end to solve, as well as the service providers they are using to retrieve their email. They alone are at fault.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#44

Post by mikeash » Sun, Dec 29, 2013, 4:14 PM UTC

dec0dedab0de wrote: post #7

I don't understand the issue, from the banks perspective those are basically your username. It's not like they need to trick you into giving them a number they issued you. EDIT: The only problem I can think of is that it may encourage users to be loose with their info, and therefore be more susceptible to phishing attacks.

Your edit is correct, but "the only problem" implies (at least to me) that it's not important, while it's kind of like saying "the only problem with getting shot in the head is that your brain gets smashed into a zillion pieces".

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#45

Post by sneak » Sun, Dec 29, 2013, 4:57 PM UTC

raverbashing wrote: post #39

dxgray wrote: post #36

Earlier quoted context omitted.

What about the users who need to get account related email that they signed up for? I understand your disdain for unwanted email, I share it, but why should our opinions have a negative effect on others.

Banks should send ZERO emails, period. It's not secure for that. I do sometimes get emails from them but they're "useless" (usually a simple notification) Several banks have their own message box inside of Internet Banking.

Email is the only universally-accepted federated notification system.

Emails such as "your card has been used 1000km+ from its last use" or "you just made this >$1000 purchase" are very useful indeed, and should be encouraged to detect fraud.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#46

Post by FlyingCocoon » Sun, Dec 29, 2013, 4:58 PM UTC

What did RBI said?

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#47

Post by bhoomit » Sun, Dec 29, 2013, 5:01 PM UTC

nodata wrote: post #29

wrath wrote: post #24

This is a phishing attack waiting to happen! I never worked at a bank but I'm assuming (maybe I shouldn't) that there are a few people working there that know a thing or two about security. I doubt that any person who claims to be a "security expert" would have let this go by, but I always seemed to be proven wrong. Take for example TDBank in Canada who has a 80's password policy: Passwords must: - be 5 to 8 characte…

Or the classic bank telephones you and asks to verify your identity by answering your secret questions and answers. facepalm

I face this problem all the time, I still don't understand why those banks can't understand security risk behind this.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#48

Post by arnabc » Sun, Dec 29, 2013, 5:05 PM UTC

I liked this JS function one of the JS files in that page, specially the name of the cookie "Gabbar":

  function fun() {
    var new_dte= new Date(2005,1,1);
    setCookie("Gabbar","#!#0",new_dte);
    setCookie("hitsscore",hitsscore+"~",new_dte);
  }

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#49

Post by wavefunction » Sun, Dec 29, 2013, 5:21 PM UTC

sidcool wrote: post #23

wavefunction wrote: post #9

Earlier quoted context omitted.

This. Poison their IP blocks in the SPAM RBL so they get the message.

I don't think that's a smart move. Let's give them some benefit of doubt and bring this to their attention. I have messaged them on their facebook. Hope this will help. P.S. I am not a Citibank fan or something. Just trying to deal with this sanely.

I'm just talking about reporting it validly as spam.

This poisons the IP blocks they use to send SPAM from as the IP addresses get recognized as consistent sources of SPAM.

Certain mass-email marketing firms like MailChimp tout their "respectable email server IP addresses" as a feature.

Yep, IP-blocks have reps, good and bad.

Re: Citibank India wants credit card, bank account numbers to stop marketing emails

#50

Post by paragarora » Sun, Dec 29, 2013, 5:22 PM UTC

This forms opens up when you select existing customers. Upon clicking not existing customers, it asks only email and phone.