Hacker News Reader

Comment by bennyp101 | Hacker News Reader

Most banks here (UK) have a mobile app, so I've always wondered why they don't use that to auth the call?

    Bank: Hey I'm calling from HSBC, want to verify it?
    Me: Sure
    Bank: Ok, so open you mobile app, and enter 637482
    Me: Ok, cool thats given me 274893
    Bank: Yep, that's all confirmed so ...

View on HN

That would save you giving out personal details to authenticate yourself, but may lull people into dropping their guard & divulging personal details before the bank authenticates on _their side_ — as in, nothing in that script prevents a scammer saying "Yep, that's all confirmed" no matter what the person says & then a lay person may feel more secure even though they've proved nothing

This is exactly why I’ve thought of giving a fake reply, since the only way for me to know that they’re who they say they are is to see if they can recognize both an invalid response and a valid one.

I was thinking more that once you put the code in, it says that it is a valid call (or not) then you get the response code to give back - at that point they can continue as normal

I feel like training users to input codes into their banking app could lead to other less safe practices.

Should even be possible for the apps to trigger a notification saying a valid inbound call is about to happen.

Reply on news.ycombinator.com