Hacker News Reader

I'm a Monzo client and honestly, I'm surprised they even offer the option. They do everything on-line if they can: it's cheaper for them, and I find it more convenient, on top of all the reasons you listed.

I suspect phone calls only happen at the very edge of rare branches, with elderly or handicapped clients, complex transactions, when ID checks fail, etc. They might not do it at all, and had added that feature in the rares of cases they might — but making it visible as “this changes color if we call you” makes a more compelling story than they previous “we never call you” if you are on the phone with a high-pressure scammer.

Banks in the UK are legally obligated to provide phone support to their customers. Monzo mostly doesn’t do outbound calls at all, pretty much the only situation they’ll do an outbound call is if it’s a pre-arranged call to discuss a complaint, or difficult situation (death of a customer etc).

That's very secure. It's also utterly unusable and will result in customers picking another bank, possibly retrieving their deposit through regulators and the court system in some cases because it's easier than going through your impossible account recovery.

That sounds fantastic for more technically sophisticated users… but I strongly suspect the reason banks continue to use phone, email, and SMS is that most users aren’t that technically sophisticated, and strongly want to use the (admittedly unsuited) communication methods they’re already familiar with. There was a post here a while ago about the debt collection industry that had a section of which the essence was “You’d be shocked at how little many people understand about banking and technology and basic math”.

These are all good ideas, but unfortunately really not that easy to implement, largely due to institutional inertia, but also because it would put the bank at a competitive disadvantage with others: Often, security and convenience really are trade-offs.

> Don't depend on another channel for resetting any of the credentials.

What if a customer's house burns down with their phone and Yubikey in it?

> For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud.

That's not up to a single bank.

> For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period.

"Why are you telling me what I can and can't do with my own money!?"

Sometimes, large value transfers really do need to happen quite spontaneously to a previously-unknown recipient, e.g. for a used car purchase.

> Use a pre-registered and securely couriered FIDO2 token (Yubikey)

That would indeed be great, but not a single bank I've done business with supports FIDO. In fact, I haven't even heard of one that does (I might just open an account with them!)

> use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets.

Does this work with a privacy-respecting ROM like GrapheneOS? If not, then it's nowhere near the best solution for me.

One annoying aspect to app push notifications is that my bank uses them to send marketing too.

The marketing will eventually sneak into every guaranteed channel of customer attention. That's why no app is sending me notifications.

> Use a pre-registered and securely couriered FIDO2 token (Yubikey)

Banks are awful enough with software, I don't want any hardware from them. Increasingly mobile apps are becoming first class citizen for online banking, web browsers second class. There doesn't exist reliable non-infuriating workflow with physical security key and a smartphone.