Hacker News Reader

Comment by pantulis | Hacker News Reader

Being targeted by unsolicited inbound calls or SMS is absolutely dangerous and I could possibly fall in that trap specially when I have some impending business with my bank (say, renewing my cards).

Subject to regulations, banks take all types of precautions to identify you. Would not regulation force them to comply with how can you identify your bank in one of these touchpoints?

My best suggestion would be to have something like reverse 2FA in the mobile banking app: the calling agent should be able to tell you the number you are seeing in a specific screen on your phone app.

View on HN

My ISP is a nightmare for this.

Every time you call them, they send you a one time code via sms to "prove" it's you. Not perfect but better than asking what my birthdate is.

But they pull the same thing when they call me. I answer the phone and they say they are rep from ISP and ask if they're speaking with me and then send me an sms code to confirm... To the same number I've just answered the call from. It's textbook phishing call as of if they're trying to access my account but lack the one time code.

The first time I thought it was a phishing call.

The operator was surprised when I said "no" and requested what their extension is so I can call them on a number published on ISP website.

Had a similar experience with what I recall was my gas provider - they called me because they needed a reading or similar, and starting asking identifying questions on the phone from me on a call they initiated.

How does anyone think this is a reasonable procedure? I had to politely decline giving the information out to them.

The answer I get, when asking for an extension, is "we can't take incoming calls" (I think this is supposed to hide the call centre locations?) and they say they can't provide a reference.

So then you call a number for the company that you know and the people have no idea who called or why, and then you think it was phishing ... until it becomes apparent it wasn't -- like a transaction is stopped.

The whole thing is so frustrating.

Reverse 2FA is too complex for the demographic most affected by these scams: the elderly and the unskilled. So it would likely provide very little returns on investment from the bank perspective.

This really needs some sort of well-thought-out legal mandate.

Totally right, even my dad in his eighties has serious trouble with regular SMS based OTPs!

I have problem with that too. You get an SMS, try to copy paste the code but the UI for that is terrible and you select all sort of text around the code, paste it in and try to modify it.

Or you go back and forth between the website and the SMS and enter the code manually.

Android is really bad for "multi tasking". And there is a reason ppl share screenshots of articles rather than URLs ...

Both Android and iOS try their best to detect the code and prompt you to use it, but all these messages are different and nonstandard; some even include multiple code-looking strings, like a transaction reference for logging purposes. So both OSes fail at it very regularly.

Things would be easier if 2FA systems agreed on a common format that can be semi-automated better. Which again is probably something that will never happen unless authorities step in.

An Australian bank I interacted with had this: you could preset a key phrase they have to tell you by phone so you can authenticate them.

That makes you vulnerable to an employee who keeps a list of these magic phrases as he is legitimately calling people for the bank. Practically untraceable.

Given that without that kind of reverse password you are also vulnerable to a malicious employee, I'd say it's a simple solution that avoids issues like the ones suffered by the author of the article.

That would imply that it is harmless which it is not, as when an attacker would recite your magic phrase, you’d be much more inclined to trust him. And the attacker doesn’t have to be or know an employee, only an ex-employee.

Renewing cards, don't they just send you a new one in the mail when the old one expires?

For sure. But if I am expecting to receive a new one and a SMS pops up telling me something about the renewal one can get confused and assume the SMS is legitimate.

Reply on news.ycombinator.com