Turn off notification preview on your phone now

bbc.co.uk

7 points·hermitcrab··8 comments

I don't understand the procedure.

I mean, to get access to a bank account through a "new" phone (which is apparently the method used) you need besides the 2FA on the "old" phone also login/password or user/pin to the bank, don't you?

"Once they have the phone and the card, they register the card on the relevant bank's app on their own phone or computer. Since it is the first time that card will have been used on the new device, a one-off security passcode is demanded."

The 2FA code is sent to the stolen phone. If notification preview is on, the thief can see the 2FA code, even though they don't have access to the new phone.

So 1) thief steals card and phone. 2) Thief pretends to be victim and asks to register the stolen card on their own phone. 3) 2FA code is sent to stolen phone, but thief can see it due notification preview. 4) Card is registered on thief's phone and and now be used for fraud.

Maybe here (Italy) it is different, but AFAIK you need to login to the bank in order to do anything like changing the phone or the phone number, i.e. the 2FA is sent for confirmation (on the old phone) only after you are logged in/authenticated (and this needs access credentials+2FA).

Criminals are apparently stealing phones and using notification preview to see 2FA notifications on locked phones. So consider turning off notification preview.

Notification preview when screen is locked. That's a setting in Android, don't know if iOS has something similar?

It does, as mentione in the linked article.

I thought everyone had this turned off already

I think it is on by default on iOS. I hadn't turned it off, because I never thought about it.

Reply on news.ycombinator.com