Hacker News Reader

Comment by signal11 | Hacker News Reader

> Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'”

In the UK, banks have put in quite a lot of messaging around the fact that they'll never ask for a password -- so the above line from the article ought to set off alarm bells in most customers' minds.

Of course, there are people, particularly older or vulnerable users, who are impacted by this as they might not be aware. Phone scams to get 2FA codes aren't going away anytime soon, sadly.

Also, as an industry, I wish we could move away from SMS-based 2FA. It's kind of amazing that SMSes these days are a barren wasteland -- mostly automated messages, scams, ... and two-factor codes. And some institutions still use SMSes to deliver two factor codes ... including Paypal in the UK.

View on HN

I think that’s the genius of the scam.

“We’ll never ask for your password. And we’re not asking for your password. This is just a one-time authentication token. Your password is safe!”

In Europe, regulation prevents or at least places strong barriers on SIM card theft, which makes SMS 2FA pretty secure. You can't just go and transfer a phone number in a matter of minutes to someone else - it is always a multiple days long process involving numerous SMS notifications prior to the actual transfer.

Every time I read post-mortems on hacks and scams in the US, my mind is a bit blown on just how easy most could have been prevented by tiny bits of government regulation that we Europeans take for granted.

Touche, mister, touche..

We mostly need to sue the hell out of companies that don’t identify correctly their customers when making important changes to their account (like transfering a phone number)!

SMS is not, and never has been, a secure means of communication.

Do not hold the carriers responsible for shit we've done.

Hold the carriers and ISPs responsible for their actual crimes, like selling our data to the government and marketing companies like the world is about to end.

I’m not talking about SMS technology but company policies.

> You can't just go and transfer a phone number in a matter of minutes to someone else - it is always a multiple days long process involving numerous SMS notifications prior to the actual transfer.

I was a phone store monkey working on close to minimum wage a few years back in the UK. I could absolutely swap someone's SIM with no problems what-so-ever and it typically took only a few minutes for the new one to become active and start receiving SMSes (the old one will still have signal - though no more traffic - for a few hours making detection difficult unless you actively try to place an outbound call).

While we're supposed to verify someone's identity, a dedicated fraudster could absolutely trick us and we were never given any proper identity verification solutions, nor enough training, and frankly not being paid enough to care anyway (which also exposes us to bribery/insider threats).

SMS 2FA will absolutely not be secure as long as minimum wage employees hold the keys to the kingdom, and I'm only talking about in-store employees making UK minimum wage. I'm sure the situation is much worse in offshore call centres.

The technical term for this is “insider risk” and it’s not just confined to phone store workers. Ops People working in mobile phone companies in NOCs and so forth have a lot of power too. Lucky they don’t have any bad apples, right… right? Or a bad actor wouldn’t seek to join them for a contracting job or seek to subvert an existing employee?

The reality is, mobile phone companies never started out to be identity providers. App developers did that.

> Of course, there are people, particularly older or vulnerable users, who are impacted by this as they might not be aware.

It always fascinates me how poorly people understand the nature of scamming and confidence fraudsters. The banks could have every customer recite on video that they have heard and understood the message - many of them will still be vulnerable.

Each small step along the pathway is only a little more wrong than the last - so by the time the guy on the phone says "and we need you to confirm this code with is" on the phone... yeah. The victim isn't really objective anymore. They are not considering this in isolation, but as part of a relationship the scammer has been building for hours if not days.

It isn't that the messaging is pointless, but it simply cannot and will not protect people from their own fallibility.

Honestly, it is a terribly hard problem - and I actively do not know the right way to manage it without simultaneously restricting access to peoples own resources

Reply on news.ycombinator.com