Hacker News Reader

Comment by dainiusse | Hacker News Reader

Don't do that for banks. I had a reverse problem. Went to usa (comming from eu) and used vpn for accessing bank portals. I paid using my card somewhere in sf, and then logged in to my bank using VPN. They blocked me because of possible fraud…

View on HN

This is why he is setting up his own exit node and paying for his own instance. Using VPNs is an easy way to get a block from your bank. VPN IPs are frequently added to denylists because they have a high chance of being used by bad actors. Although to be honest, cloud providers also get ban-hammered from time to time.

The best thing would be to have your own physical machine act as an exit node instead of relying on a cloud instance. That would bring a whole series of new problems for keeping a machine up and running while you are away, but doable

It's not about IP reputation, but the bank detecting a payment in one country followed by a login in another. This is exactly what the bank would see if someone stole your card.

I used VPN that was setup in my house not a public one. I clarified with the bank - they saw me logging in from my country and then used my card in SF and blocked me. Private exit node will not help.

Seconded. Banks have all kinds of IP access rules that can bite you. Connecting from an IP allocated to one of the well known clouds will certainly raise a flag as throwaway VPS are often used for fraud.

It's much better to have an exit node at home.

It won't help. That was my case. It is simply geolocation differenxe

I understand why they do it (fraud mitigation in layers) but it's still ridiculous. Most US banks don't even offer TOTP for second factor; they force SMS 2FA which is not secure at all.

Maybe once passkeys or hardware keys are widely adopted they can remove the atrocious fraud detection.

Many people (still) don't understand how 2FA works.

Whereas 99.999%? of the users won't use tor/$vpnCompany/cloud provider IPs. It's all in terms of which is less likely to lead to a support request.

I worked with a relatively big bank that used a tool like Akami or Cloudflare. With those tools you can just ban/block entire countries (think any IP from Iran, Russia, etc) or entire ASNs.

you were almost certainly picked up by the faster-than-flight rule, or as I like to call it ‘the superman rule’.

It’s probably the second most common geo rule after geoblocking.

Reply on news.ycombinator.com