Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we secure Monzo's banking platform

monzo.com

Post reply on HN
Print view View original

51–60 of 148 posts

Re: How we secure Monzo's banking platform

#51

Post by Milner08 »

mocko wrote: post #44
dwb wrote: post #37

Earlier quoted context omitted.

https://monzo.com/blog/2019/04/04/why-we-block-freeze-close-...

Sure, but that doesn't explain the sheer scale on which it happens (more than other UK banks and with seemingly worse consequences) or how the system actually works. It's also notable that this post was written a year before some of the news articles, indicating that Monzo really hadn't done anything to improve it. One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability…

They are 100% not behind the 'We cant tell you why'. It only takes the smallest amount of reading to figure that out. They have to report it to the FCA and you can read the reports from the FCA that suggest its not actually any worse than other banks. Its just more talked about. (No I am not going to dig them out for you).

Re: How we secure Monzo's banking platform

#52

Post by lnxg33k1 »

mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

the fear of that happening to me was the reason I terminated my account too, reading people having their main account frozen out of nowhere for months was very concerning

Re: How we secure Monzo's banking platform

#53

Post by stavros »

YawningAngel wrote: post #39
mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

The link doesn't really clarify much for me, can you elaborate? Are you saying the GP laundered money?

Re: How we secure Monzo's banking platform

#54

Post by samjmck »

mocko wrote: post #44
dwb wrote: post #37

Earlier quoted context omitted.

https://monzo.com/blog/2019/04/04/why-we-block-freeze-close-...

Sure, but that doesn't explain the sheer scale on which it happens (more than other UK banks and with seemingly worse consequences) or how the system actually works. It's also notable that this post was written a year before some of the news articles, indicating that Monzo really hadn't done anything to improve it. One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability…

> Sure, but that doesn't explain the sheer scale on which it happens

How do you know the scale and how are you not sure that it's a vocal minority? After all, Monzo does target more tech-savvy users that might be more likely to voice their frustration online than with other high-street banks.

> One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability for a broken system that's literally ruining lives.

Because maybe they are being forced to hide behind that? UK banking regulations are notoriously strict when it comes to what banks are allowed to share with their customers.

Re: How we secure Monzo's banking platform

#55

Post by jagged-chisel »

YawningAngel wrote: post #39
mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

Others replying here are jumping to conclusions.

A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything.

Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

Re: How we secure Monzo's banking platform

#56

Post by mocko »

samjmck wrote: post #54
mocko wrote: post #44

Earlier quoted context omitted.

Sure, but that doesn't explain the sheer scale on which it happens (more than other UK banks and with seemingly worse consequences) or how the system actually works. It's also notable that this post was written a year before some of the news articles, indicating that Monzo really hadn't done anything to improve it. One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability…

> Sure, but that doesn't explain the sheer scale on which it happens How do you know the scale and how are you not sure that it's a vocal minority? After all, Monzo does target more tech-savvy users that might be more likely to voice their frustration online than with other high-street banks. > One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability for a broken system t…

> How do you know the scale and how are you not sure that it's a vocal minority?

Read the articles and look for similar experiences for other banks. There's definitely a lot more noise about Monzo doing it. Maybe (as another comment suggested) there's a selection bias at work but I assure you it's a real thing, and appallingly handled by Monzo when it happens.

> Because maybe they are being forced to hide behind that?

That misinterprets what I said. If there are rules that say they don't have to be accountable for a misfiring fraud prevention system that hurts real people, where is the incentive to fix it?

Re: How we secure Monzo's banking platform

#57

Post by tixocloud »

eicnix wrote: post #17
raesene9 wrote: post #9

Earlier quoted context omitted.

On the first point, I don't see any particular reason why banking shouldn't go with cloud. Obviously banking has regulatory hurdles and things like availability are important so it'll require a specific architecture to help achieve that, but in general shouldn't be a problem. On the second point, I'd say it depends on the level of granularity and detail. Here they're describing general mechanisms and they're not sayi…

All you need is a single disgruntled ex-employee to be bribed by hackers to reveal your complete security design.

Social engineering is likely the easiest way to get through security systems.

Re: How we secure Monzo's banking platform

#58

Post by porker »

mocko wrote: post #49
corobo wrote: post #46

Earlier quoted context omitted.

My money is on it being crypto related, but that’s because the only people I’ve seen complaining about this publicly were doing some crypto stuff (tx both in and out) and it looked very laundry-esque out of context when you get into the actual details And yeah as others have said that’s not a Monzo thing not telling you, no UK bank would tell you why they think you’re laundering money

Not in my case - no crypto, no recent large transfers. I'm a boring middle-aged IT consultant, not a terrorist, drug dealer or crypto trader. There was absolutely nothing I'd done with my account that should have caused this to happen. That's what's so kafkaesque (and frankly rather violating) about the experience: you literally haven't the faintest idea what you've done wrong and the bank refuses to tell you.

Use First Direct. They're designed for boring middle-aged IT consultants. :)

Re: How we secure Monzo's banking platform

#59

Post by physicsguy »

jagged-chisel wrote: post #55
YawningAngel wrote: post #39

Earlier quoted context omitted.

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

The law is really strict. If you look on reddit.com/r/ukpersonalfinance there's loads of people complaining that Monzo have frozen accounts and won't tell you way. In pretty much every circumstance, the person involved has been moving large amounts of money around through Crypto, so it's fairly obvious why they might flag that up as potential fraud/money laundering and cause an investigation.

Re: How we secure Monzo's banking platform

#60

Post by tixocloud »

madjam002 wrote: post #35
JMS2021 wrote: post #31

Earlier quoted context omitted.

You wouldn't run or develop code locally. AWS keys would be secrets managed by Vault or something. If you have AWS keys on staff laptops at home, you've already failed. We don't allow any code at all on local machines.

Where is the codebase kept then? Do you have to remote desktop in to your development environment?

Remote desktops are generally the access point for anything sensitive like source code or data.
Post reply on HN