Hacker News Reader

I understand why they do it (fraud mitigation in layers) but it's still ridiculous. Most US banks don't even offer TOTP for second factor; they force SMS 2FA which is not secure at all.

Maybe once passkeys or hardware keys are widely adopted they can remove the atrocious fraud detection.

View on HN

Many people (still) don't understand how 2FA works.

Whereas 99.999%? of the users won't use tor/$vpnCompany/cloud provider IPs. It's all in terms of which is less likely to lead to a support request.

I worked with a relatively big bank that used a tool like Akami or Cloudflare. With those tools you can just ban/block entire countries (think any IP from Iran, Russia, etc) or entire ASNs.

Reply on news.ycombinator.com