Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we secure Monzo's banking platform

monzo.com

Post reply on HN
Print view View original

81–90 of 148 posts

Re: How we secure Monzo's banking platform

#81

Post by KptMarchewa »

drcongo wrote: post #76
samjmck wrote: post #54

Earlier quoted context omitted.

> Sure, but that doesn't explain the sheer scale on which it happens How do you know the scale and how are you not sure that it's a vocal minority? After all, Monzo does target more tech-savvy users that might be more likely to voice their frustration online than with other high-street banks. > One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability for a broken system t…

I've switched to Starling. I still use Coinbase yet Starling have never frozen my account or held on to my money for a year.

You know that it does not happen to 99,9% of their customers either? For some reason everyone here thinks they are a snowflake.

Re: How we secure Monzo's banking platform

#82

Post by KptMarchewa »

jagged-chisel wrote: post #55
YawningAngel wrote: post #39

Earlier quoted context omitted.

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

Generally when your account is locked any complaint against that doesn't even touch customer service, but compliance department.

Re: How we secure Monzo's banking platform

#83

Post by axg11 »

andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

How else would you scale to meet peak demand without being wasteful?

Banking has a fairly predictable usage pattern, but there will be black swan financial events that cause 100-1000x load. On top of that, how else could you serve customers around the globe with reasonable latencies?

These are genuine questions. I’ll admit I’m an engineer whose entire career has been during the cloud era. I don’t see how cloud’s advantages of scaling and worldwide “edge” locations can be replicated by the average bank’s tech team.

Re: How we secure Monzo's banking platform

#84

Post by drcongo »

KptMarchewa wrote: post #81
drcongo wrote: post #76

Earlier quoted context omitted.

I've switched to Starling. I still use Coinbase yet Starling have never frozen my account or held on to my money for a year.

You know that it does not happen to 99,9% of their customers either? For some reason everyone here thinks they are a snowflake.

You're rather contradicting yourself there. If it's not happening to 99.9% of their customers then we obviously are special snowflakes. Maybe you could think through your attempts at insults a bit better.

Re: How we secure Monzo's banking platform

#85

Post by maattdd »

Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

They are the actual inspiration for my blog post against microservices 2 years ago (https://blog.matthieud.me/2019/microservices-considered-harm...).

At least, they've only added 500 microservices in 2 years (not even 1 per day, how sad!)

Re: How we secure Monzo's banking platform

#86

Post by mrtksn »

andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

Not Monzo, but I have a friend who works at a large global bank HQ in a mid-senior position.

They do remote desktop connection into their PC at the office. The work laptops given to them can't connect to anything but the PC in the office(so, it's merely a thin client). A fingerprint reader device connected through the USB port and a physical device for generating single use codes are used in addition to username/password.

At the start of the pandemic they used their own laptops to VPN into the work network and then connect to the remote desktop but not too much later they switched to complete solution.

I know this because I helped with troubleshooting connection issues. Does look quite secure to me, the only difference to an office environment security seems to be the possibility of an intruder to make an employee do something at a gunpoint.

Re: How we secure Monzo's banking platform

#87

Post by dazc »

bostik wrote: post #70
mocko wrote: post #62

Earlier quoted context omitted.

Searched and I can't find any. I did, however, find a Which? article that says "Resolver found almost three-quarters of complaints about frozen bank accounts mentioned ‘digital’ banks". Statistically it doesn't seem likely that Monzo and its ilk would be so overrepresented merely because their customers are more fazed than others about having their money taken away. Still, if the FCA have published meaningful statist…

I can't tell which way the arrow of causality points, but all the digital banks in the UK are in various stages of still growing to reach the scale where they can become sustainably profitable. This in turn means that they will have their risk assessments inverted from the usual high-street banks: optimise signup/account creation flow, and deal with AML requirements in a slightly delayed fashion. Making it really eas…

As a former Barclays customer I can confirm this. Last year I changed from self-employed to limited company and changing my business account at Barclays proved to be impossible despite always previously being in credit with no issues at all. I was able to open a monzo business account in less than 20 minutes.

This, I should add, at a time when there was a high incidence of fraud with people trying to open business accounts for dormant and non-existent companies simply so they could claim Govt backed loans where it was clear that very few checks were actually being carried out.

Re: How we secure Monzo's banking platform

#88

Post by [deleted] »

tawaypol wrote: post #79
YawningAngel wrote: post #39

Earlier quoted context omitted.

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

This happens in the US too. This kind of thing is why I'm using crypto for as much as I can, I always feel like my bank account might disappear one night and all the money in it will be tied up for a month or so. It's already happened to me once.

[deleted]

Re: How we secure Monzo's banking platform

#89

Post by xyst »

jagged-chisel wrote: post #55
YawningAngel wrote: post #39

Earlier quoted context omitted.

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen... . Source: used to work on Monzo's financial crime team.

Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

It’s definitely their anti money laundering (AML) detection system kicking in. However it’s clearly getting false positives and their internal AML team is getting hit with a high amount of them thus causing the delays in resolving them.

This is why you don’t build your own solutions to well solved problems.

Re: How we secure Monzo's banking platform

#90

Post by Nextgrid »

xyst wrote: post #89
jagged-chisel wrote: post #55

Earlier quoted context omitted.

Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

It’s definitely their anti money laundering (AML) detection system kicking in. However it’s clearly getting false positives and their internal AML team is getting hit with a high amount of them thus causing the delays in resolving them. This is why you don’t build your own solutions to well solved problems.

I wonder if their system, by virtue of being modern, is too good and catches a lot of fraud that would otherwise remain undetected by legacy banks' systems? Not to mention, opening a Monzo account is much easier and can be done remotely, thus it could be attracting a lot of malicious activity that just wouldn't even reach the legacy banks because the laborious account opening process would filter those out?
Post reply on HN