Hacker News Reader

Comment by mikepurvis | Hacker News Reader

Just before Christmas my Canadian bank (RBC) texted me to say that they'd blocked a suspicious transaction. In the text message they included a phone number that I could call to get more information about the incident. It felt fishy but out of curiosity I called it and they wanted to ask me my "security questions" to confirm my identity.

I hung up and instead called the actual number on the back of the card. The whole thing was real, the bank had actually contacted me by text and sent me a follow up phone number.

Truly I don't understand what they're thinking sometimes.

View on HN

This is solved by them having you do a 2fa via the bank app whenever you and the bank talk regardless who called who.

Disclaimer: my bank does this

The bank app was the first thing I checked when I got the text message, because I was so surprised they wouldn't have just sent me a push notification through there. And there was no indication in there was any kind of problem with the card, no sign of the pending/blocked transaction, nothing.

And they definitely have the 2FA-through-app capability because it's used for auth when I sign into online banking on a computer— the app has to grant permission for the new device. But hilariously they don't seem to have it wired up yet for phone interactions.

Yes, please just read the numbers out to me on the phone so I can confirm who you are...

It’s the other way around - the app shows you who you are talking to on the bank side and asks you to confirm that you’re on a call with that person

Really it should be both, where the app asks you to input a code given from the person on the phone (confirms to you they're actually from the bank), and then gives you a code that you tell the person on the phone (confirms to them that you're really the customer).

Of course the more automation you put around this, the easier it becomes to MITM it, like a scammer simultaneously calls both you and the bank and passes the codes back and forth, pretending to you that the call is about a credit card offer, while using the call with the bank to drain your account. That's a lot harder to pull off with a human in the loop as the real bank person will get suspicious at the delayed responses, even barring some amount of stalling ("oh hang on I left my phone downstairs, let me find it oh god it's updating again, let me just get you that code, give me a sec here"). But it becomes trivial if the authentication is moved to IVR and by the time the human operator is on the line the call is already considered safe.

My bank has a banner at the top of the app if you are on a call with them. It's great if you know to check...

That reminds me of my rant over some recent IRS free-filing stuff. They were basically telling users to go ahead and trust a third-party service named id.me with all their sensitive personal identifying information.

FFS guys, at the bare minimum you should have white-labeled that behind a domain like id.irs.gov! Not just to avoid mis-educating users into terrible security habits, but also to avoid giving some Montenegro DNS folks the ability to intercept or man-in-the-middle all the information.

My bank does the same thing and I tel at them every time.

They did stop putting hyperlinks in email communications though. It’s a start.

Reply on news.ycombinator.com