Hacker News Reader

Comment by dev1n | Hacker News Reader

TD Bank recently tried to sell me on how using my voice is a great way to authenticate me when I use their customer service over the phone. Seems banks are still are not getting security right.

View on HN

I called Royal Bank of Canada to update some information, at their normal phone prompt I entered my client card number as usual. After reaching an agent they automatically used my voice to authenticate me, foregoing any security questions or verbal passwords. Normally I considered RBC to be fairly reliable in that they would ask 5-6 personal questions and ask for my verbal password. It made me uneasy knowing that a scammer could call me, record our conversation, and play it back to gain access to my account.

One of my bank authenticates me whenever I call them by asking my date of birth, my id number and a simple question about how I use my account that is easily guessable and that's why I don't put a lot of money in that bank account.

Same here. In response to a question about the most recent transaction, I guessed saying "Umm I took out about 500 dollars, I think." This was good enough to authenticate.

My guess was about $400 off, so now I have $20 in that account

It's like fingerprints as a password. They are immutable so once it is out in the wild, how do you change it like a password?

You could use voice as a screening process, but not for final verification. Lots of podcasters, YouTubers and TV/Radio people would be at risk otherwise.

It comes down to who gets stuck holding the bag if anything happens. As long as it is easy for them to blame you or me for being careless with our account info, they will not tighten security.

...but the customer is very rarely stuck holding the bag. If you report a transaction as fraudulent you get your money back usually within hours...not really sure what you're on about.

Why would you call your bank? I've been a customer at my bank for over 15 years now. I have never spoken to anyone, on the phone or otherwise...

Reply on news.ycombinator.com