My mind is blown. Reflecting on a lifetime of getting declined filling web forms in with a wrong CC number, billing address, expiration or CCV, I...don’t think I’ve ever misspelled my name.
Trying this out on my next purchase for sure.
Trying this out on my next purchase for sure.
Not sure if this is still valid nowadays, but it blew my mind as well.
Absolute quantifiers shouldn't be used in the context of cybersecurity. Yes, it's more difficult and would most likely require a SIM swap. But there are some gullible people who willfully gave their one-time code to attackers identifying as their bank after some initial groundwork had been done (calling them previously from a number identifying as their bank and warning of a fraud, the victim verifying the number is correct, the attacker calling again and redirecting them to a form requiring a validation with the code).
First of all, "stripe" pushes information to the BankID app asking for confirmation, there's no code to input to the site, the verification happens on my phone where I'm asked if i wanna authenticate X or Y to happen (logging in, or transferring money)
But yes, they actually saw an attack vector where people could be fake challenged at the same time they're logging in themselves if someone knows they're about to log in.
This was solved by putting a QR code on the Bank website (and others that have implemented this so far) to be scanned by the BankID app. So now to steal money you would have to pwn the HTTPS between the bank and "me" or pwn my browser, or pwn my entire machine.
Also if you get 2 BankID challenges at the same time they cancel both of them.
Anyways, point is that without my phone and my own personal code being entered after a challenge where I see who's challenging me it's impossible to get money out of my account. It's designed to be REALLY hard to be tricked into authenticating someone else.
This system doesn't care about SIM swaps because it doesn't use the carrier network for anything other than encrypted communications with the BankID service.
I don't think there's a more secure system deployed on this wide of a scale anywhere and I'm quite happy with it. It's a PITA if you lose your phone though since there's no fallback method other than getting a new smartphone.
Nitpicking on words seems a bit below the standard of discussion I want to have though, and it seems like you thought it was just SMS verification. We're not cavemen across the pond, we're people just like you.
A nice benefit of this system is that when I call my bank I'll input my social security number in the system and it'll challenge me with a BankID challenge meaning the bank person knows they're talking to me. It's useful for a lot of things and at the same time VERY privacy invasive. Also doesn't work without a connection on your phone, but we're quite connected here so it's usually fine.
CC purchases in person are not authenticated with this system, we rely on the NFC thingy or chip. Magstrip isn't used anywhere here anymore. The bank covers all fradulent NFC charges without pin entry (which is why they're limited to 40$).
If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks.
We also have electronic mail via a system called "Kivra" that the government will send mail through to me so that i don't have to rely on someone not dropping my mail. Also privacy invasive of course, but quite convenient.
I'm not sure if it's the same technology as in Norwegian banks:
https://link.springer.com/chapter/10.1007/978-3-540-85230-8_...
Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1].
[0] https://en.wikipedia.org/wiki/Talk:BankID
[1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...
https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...
Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money.
So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is.
Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away.
What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.
However, some services go out of their way to check if the address you entered exists and is valid, but that has nothing to do with Visa or MC.