But sending you an SMS is a lot more security than no 2FA at all, right?
I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
Paypal makes it hard to remove a mobile number from your account once it's on there too...
If a bank "MUST" have a phone number, I lean towards providing my good ol landline number since in theory thats a "little" harder to instantly take over or port out.
Worthwhile to "test" what it takes to reset a password on your various critical services...
Please explain, sorry I did not hear about this.
If you must provide a phone number, another tip is to call customer service on your cellular service provider and ask them to put a "port out block" or "port protect" on your account. Before anyone can do a sim swap on your account, they'd have to call the cellular service provider and give a password or PIN. (It's amazing that this isn't the default.)
But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible.
You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.
If your wide net lets you see 2FA codes, sometimes you can do stuff.
My recollection is that we had that once incident in Germany with 02, but never really heard how much was lost and it was the result of a bad policy at 02 that they fixed and was particular to 02.
I assume if you pwn a bank, you don't really need 2fa codes, but I dunno
It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings.
According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack.
[1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...