I would love to get more information about this breach it sounds to simple to be true.
Those two desires are in direct competition. For example, I bank at Citibank in America precisely because their website will allow me to initiate a US to JPY international wire transfer without my physical presence in the US. That class of activities is just about the most dangerous thing a consumer-grade banking website could allow you to do. (International wire transfers are practically non-reversible. If you are induced to send one to a fraudster or they compromise your online account and send one on your behalf, and the bank doesn't catch on within a few seconds, you're pretty much screwed.)
Accordingly, many banks do not offer online international wire transfers and will laugh in the general direction of adding it to their feature lists, despite it being technically not rocket science.
The rock solid feature that lets me eat on a semi-regular basis is also an attack vector against almost every other HNer with a Citi account, most of whom will never send money overseas. So, what should Citi do? Optimize for security and shut down that feature from their website, or optimize for being able to just wire some money in a rock solid fashion?
Perhaps require a setup process to enable the feature on an account-by-account basis. When you set up your Citi account you could have had another piece of paper work that you signed stating you know the risks of international wire transfers and that you authorize Citi to allow them to be processed through the website. Most customers wouldn't set it up and will have exactly the same experience as they do now, some wouldn't get scammed and customers like you also get to sit pretty.
You can change the registered phone number only by calling the bank and passing a set of identification questions posed by a human operator, so there has to be some significant identity theft to get past it. I don't think that would be particularly hard for a determined and experienced thief though.
I guess it hinges on what the meanings of "fancy features" and "everything should just be rock solid" are. I tend to agree with your earlier comment that for the banks this comes down to a risk assessment and a cost/benefit equation.
In practice what Citi does is neither of these absolute extremes; it just flags transactions over a certain amount (I believe it's generally $5K) and any transactions that the Citi systems deem suspicious. Anything in these categories yields a notification to the account holder, and the transfer has to be confirmed via phone before the funds are released. This is a variation of the "Are you sure you want to do this?" messagebox confirmation in programming.
When your phone has a NFC reader and your bank smartcard can talk to each other to handle it, even better. (Well, higher risk of intrusion because it's a multipurpose device, but way ahead in terms of usability)
profits are all they care about.
Honestly, stuff like this burns me up. Large orgs like this lobbied for crap like PCI compliance standards to 'protect' data, but they don't have to follow their own rules. Seriously, if PCI compliance is mandated for anyone who stores CC info, why the hell isn't citi being shut down for this sort of breach? 'too big to fail'?
Something this egregious should have been caught by PCI compliance checks (if not development) in the first place though.
I doubt the penalty will be anything severe enough - something like "no cc processing and management for citi for 180 days" might make them take this a bit more seriously.
Yeah, Citi's greater punishment will likely be in the form of a weakened reputation then it will be in actual damages paid.
Yes, yes you can.
Listen, PCI compliance is something people like to talk about, but you'd be surprised at the number of companies that don't follow even the bare minimum (unencrypted cards and keeping the CVV). We are talking about large, national corporations (and not Sony).
Besides, who do you think is writing this software? Normal people. There isn't a "Programming for Banks" degree you can get. It's programming. They hire contractors for months/years at a time, and then they are done with them.