Hacker News Reader

Comment by EGreg | Hacker News Reader

This could be prevented SO EASILY if the text message also described the action that will happen as soon as verification is completed, rather than just the verification code. Sheesh. So many banks and merchants, and no one puts that in there? Is it because of the 140 character limit (another dumb limit these days)?

View on HN

For my bank account in Germany, every text message with a security code will list precisely what entering that code will do, so it might read: "Enter code 12345 to send $12.34 to Dr Strange, account 1234 at Mystery Bank."

Mandating that by law in the US would easily make these scams a lot more difficult to pull off.

I feel every bank should default to sending you a notification text and/or email on every transaction.

Most banks have the feature but it can be annoying to setup. Another issue I have had is both email and phone providers may start rate limiting or marking as spam if you get too many automated messages.

My €uro bank does that....within seconds of using my card a notifiction appears with the amount withdrawn/ deposited. Further under the 'push notifications' i opted for 'all', so also my direct debit bills get flagged to me.

Monzo in the UK sends a notification in the app on every transaction. You then even have the option of freezing your card immediately if you think something's up.

Barclays and American Express do this as well. It really should be standard practice now.

Most German banks do it now, I'd say. It's a fantastic feature.

My bank First Direct sends an SMS message every day there is a transaction and has for at least 15 years. Visa updates are weekly.

I asked (at the branch, in person) to get such notifications but was told I'd have to set up online access to my account, to get them. I asked how to get such online access to be "read only" (so it couldn't withdraw from my account) but was told that wasn't possible.

With another financial institution, I did have online access and had set up notifications, but despite doing so, I wasn't getting them. Complained, but employees were unconcerned.

I asked to get notifications if anyone asked to access my safe deposit box, or at least to let me require a password for such access, but was told that's not possible.

My bank does, but only if I install their app and enable notifications. Even then, I still had to slowly tap through layers upon layers of menus to setup rules that actually triggered the alerts.

Latter part is somewhat fine, even if an opinionated default ("report all, no exceptions") would have sufficed.

Former is the annoying part, mostly because Bank of America's app is just slow and still isn't up to par with their website. Notably, the virtual card function is not present on the mobile app, even after many years (imagine a really bad Privacy.com clone, like really bad, but it still has virtual numbers at least).

One suspects if the legal system put liability on the banks, they'd very quickly find some good solutions.

All my bank accounts (UK) have some variant of "Never share this code with anyone, not even us." appended or prepended whenever they send a verification code. It's so universal I assume this is mandated by law. I'm guessing this isn't the case in the states?

That is not going to cut it

Because people just get used to this being boilerplate and anyway services such as Plaid “override” that, so why wouldn’t “the bank’s own employees” do it?

No, we need exactly what I said above

Mine do that as well. I.E they also say use xxxx to log in to online banking. Or use xxx to approve this transaction / new payee / standing order.

Can you elaborate on the "override"?

People think "yeah, the text message SAYS not to give it to anyone, but they say it all the time and this is Plaid, I mean come on, it's Plaid, I can trust them, right?" and they think that even more for a Bank Employee (TM)

Everyone should have a policy of never giving out personal info or confirming any digits until they HANG UP AND CALL BACK on the corporate number to discuss any issue.

There's no such limit anymore. It costs more, but all phones support SMS concatenation

I noticed banks have generally modified their message to warn people: “Please use 123456 as your TD security code to log in. We will never contact you for this code. Do not reveal it to anyone else.”

Only HSBC requires a token to authorize transactions that I have found so far (token +PIN) Most happily let you do anything once logged in.

That said, I am sure we have all heard someone complain, “Why am I getting these login codes from my bank? I am not trying to login”. Most people don’t make the connection to fraud attempts.

I'm not sure they are typically fraudulent attempts - I think many people are unable to remember/enter even their usernames/email addresses consistently.

I gave a then-rarely-used phone number to someone in an organization that regularly deals with elderly people. A day or so later, that phone got a 'fail' text message from a bank that I'm not a customer of. I reported it to them as phishing but didn't hear back.

What's even worse is that the code is used as single factor, eg. No extra security besides this code.

Probably they phished the logins otherwise. Normally those sms are the second factor.

Reply on news.ycombinator.com