Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

I run security at a fintech, we reject voip phone numbers due to proven fraud activity. The org has made the business decision based on historical fraud data, what others do is a risk management decision. Lots of customers out there, not a lot who will leave if you reject voip numbers, in my experience. The goal is not serving as many customers as possible, it’s about operating at the intersection of risk appetite and profitability.

We can’t have nice things because of humans in the aggregate. My apologies. It’s certainly not personal.

View on HN

What if someone wants to have different phone numbers for security or privacy purposes. What options are there that wouldn’t get caught up in this?

That is a vanishingly small percentage of the market that it is not worth catering to when the vast majority of such numbers are used for fraud rather than by users who want security and privacy.

Hard-line answers like that are why we're all building our own cages from a privacy perspective.

True, but the original sin was using phone numbers as proof of identity. The fundamental problem is average users cannot use passkeys, manage their own crypto keys, or understand that for identity to work, there cannot be an authority based recovery method.

The market simply does not care, and businesses are acting accordingly and picking the lowest friction option with acceptable levels of fraud.

What’s odd to me is that they dont even have a method for more advanced users to not use numbers. I think perhaps Digital Credit Union may be the only bank in the US using passkeys.

I have an idea, let's just use the other number we all have, perhaps the one for social benefits?

Who is "we all?" Most people outside of HN don't care.

I have a side project that uses Twilio. Probably going to have to face this dragon at some point and go down the same risk assessment.

What values for Twilio line type intel do you block? (or equivalent values if you don't use Twilio)

For example, is it just `nonFixedVoip` that should get the boot? Or are `fixedVoip` also spammy?

https://risk.lexisnexis.com/products/phone-intelligence

https://ekata.com/solutions/phone-intelligence-api/

Thanks! I’ll look into these. Thought it was simpler lookup of metadata, but these seem like robust offerings that make sense for even more protection.

We'd all be better off with no phones at all.

Reply on news.ycombinator.com