Hacker News Reader

Comment by rwmj | Hacker News Reader

In the UK, if you log in to your bank account on the phone, pass the required verification checks, and say you want to transfer all your available funds to your long lost aunt's account in Russia, then your money is transferred, irretrievably. It's going to be up to you to prove that the bank's verification is faulty, so good luck with that.

View on HN

Depending on the bank the controls vary. For example Natwest require multiple factor to setup the destination bank account the first time you do a transfer and then less authentication on subsequent transfer. Multiple factor because you would need to know my online account number, online pin code, online password be in possession of my bank card, use a Natwest card reader that authenticates me using chip and pin. Yes it's a frustrating way to pay a mate £5 but does make it a lot harder to be attacked.

In practice, I should imagine fraud protection would kick in and prevent the transaction.

Exactly. A transaction like this would likely trigger multiple risk indicators and require manual intervention by the bank/3rd party before a transfer of this nature would be allowed.

Not saying it can't happen, of course, but it shouldn't.

I've had several much less dodgy transfers flagged up and recieved phone calls to confirm them. Though, that doesn't answer the question of what happens if they miss one. Could be 0.001% for them, but your whole life savings could be gone.

These sorts of services usually have limits on what can be transferred, or extra verification needed for transfers to new accounts etc

Reply on news.ycombinator.com