Comment by alias_neo | Hacker News Reader

Comment by alias_neo | Hacker News Reader

> Nothing the bank might want to talk about could be urgent enough to interrupt an unseasonably sunny March afternoon.

Wrong. Some banks, and with certain account types, the bank will absolutely make a courtesy call to you if something unusual is happening.

I had a call from my bank while spending a few hundred on cocktails in Bali (I'm from London), I hadn't used my card yet on that trip as I'd taken cash.

They also called me to check a payment into my account with an "unusual" reference; a joke from a friend returning the money he owed for a holiday I paid for, but which made it look like he was paying me for "special services".

They called me to query a payment at a home furniture store for a couple thousand pounds in a city ~300 miles from where I live only hours after I'd used the card near home; I'd driven to this particular store to check out the furniture.

If you're not sure, the _real_ bank will suggest you hang up and call their number found on your card or their website (or in your contacts list, where I keep it) and will never pressure you to answer or provide them information, and they'll NEVER, EVER ask you to read a security code out to them sent to your phone, or using your banking app.

EDIT: To further clarify; my particular bank's app, has, on rotation, a series of warnings, displayed each time I log in, saying things like "BEWARE; if someone [calls/texts/etc] asking/telling you to do [XYZ] ...", e.g. to get this code or that code, or do something else in this app, you're being scammed, "WE WILL NEVER ASK YOU FOR [XYZ]...".

I'm not at all confident that the real bank will never actually ask for you to verbally read a security code texted to you. This is how little I trust bank's security practices.

Here's a comment from a similar post last month, where the commenter believes the legit bank asked for a verbal confirmation of security code: https://news.ycombinator.com/item?id=30875233

(I suppose it's possible the commenter was actually interacting with a scammer there and still doesn't realize it?)

> I told him, the 2FA message literally says to never give this number out to anyone

He was 100% being scammed.

And still doesn't realize it some time later? (I guess we don't know how much time later).

That would be stunning in it's own way! What a world.

If you called in to Amex using the number on the card for certain things like fraud, for a while they would then text you a code in a message that says:

“Amex Fraud Free Msg: Your requested code is: xxxx. We won't call to ask for it. Don't share it. Call ######## if you didn't request it. Reply STOP to opt out.”

You wouldn’t be the requesting this text and code, the person on the phone would. And it says don’t share it. Maybe I was hoodwinked but it seemed really legit although in principle I refused to give it.

It seems so scammy, but I’d called the number on the back of the card.

Banks are dumb, really dumb, and they don't align. I have personally called the number on the card, and been asked to verify the phone by repeating a number they would send, which came with the standard "nobody will ask for this number".

I presume because I initiated the call they think it's ok, but it's still silly.

I agree with you. I think there might be a distinction btw inbound and outbound.

I think reading any code during inbound call is red flag for fraud. However, more than once i took the initiative to call ccs to unblock a large / international charges. The only way for the bank to verify my identity is for me to read the code.

So it is not true that you NEVER read ever. Maybe for inbound this should be true. But not outbound

Yeah, you can tell a lot by the attitude of the caller. A person once called my wife telling us about a potential fraudulent transaction on one of our credit cards. She was a bit worried so she came over and got me. The person started asking her about whether she made a purchase at this time, etc. I jumped in and told her to stop talking to the guy and call the credit card company back. The person chuckled and said "okay, sounds good."

We called the credit card company and there was indeed a fraudulent purchase, so yeah the real companies don't pressure you into unsafe things.

> I had a call from my bank while spending a few hundred on cocktails in Bali (I'm from London), I hadn't used my card yet on that trip as I'd taken cash.

Mine dit that as well a couple of times (Santander UK; my account was nothing special though I do travel internationally several times a year; it was a mistake every time and I never had any fraud with this card). The first time I took it, but now I would say that I cannot, end the discussion, and then call them to their known number. Also, I’ve never had a human ask me to read numbers from a text message. They (well, another bank, but still) do occasionally ask me to unlock their app using either biometrics or a PIN; they can see it in real time and that can only be done on a single pre-approved device.

Reply on news.ycombinator.com