> Obviously no 2FA.
Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.
Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.
I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings.
According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack.
[1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...
But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible.
You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.
If your wide net lets you see 2FA codes, sometimes you can do stuff.
My recollection is that we had that once incident in Germany with 02, but never really heard how much was lost and it was the result of a bad policy at 02 that they fixed and was particular to 02.
I assume if you pwn a bank, you don't really need 2fa codes, but I dunno
Paypal makes it hard to remove a mobile number from your account once it's on there too...
If a bank "MUST" have a phone number, I lean towards providing my good ol landline number since in theory thats a "little" harder to instantly take over or port out.
Worthwhile to "test" what it takes to reset a password on your various critical services...
Please explain, sorry I did not hear about this.
If you must provide a phone number, another tip is to call customer service on your cellular service provider and ask them to put a "port out block" or "port protect" on your account. Before anyone can do a sim swap on your account, they'd have to call the cellular service provider and give a password or PIN. (It's amazing that this isn't the default.)
Strange thing is it seems to randomly ask for SMS or TOTP now, whichever it feels like at the time.
Still it's weird that an official standard mandates SMS 2FA when more secure methods are available.