Liability for data breaches limited to companies over X size would be a good idea though.
Also, only investigating fraud when there's lots of money involved means we're only helping rich people, who need the least help. Losing less money doesn't mean less impact on someone's life if that's all they have.
[1] http://ag.nv.gov/News/PR/2017/Attorney_General_Laxalt_Announ...
If your whole account is $2k it might be a different world for you and you might relying on these to pay rent, medical expenses which is more serious than an investor not having access to his $250k.
Not meaning it is fine to steal $250k from wealthy people but that poor ones being affected (at $2k) is more urgent from a humanitarian perspective.
Or it might be your entire life's savings and if you can't get it back you kill yourself from the stress of losing 40+ years of work. It's very dangerous to make assumptions about other people's money.
I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.
>>I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.
Absolutely not. Ignore the case when this 250k was your entire life savings (30-40 years of saving remainder of your salary every month and slowly building savings for retirement).
It could be mortgage money which you are about to buy a house with or it could be company money for payroll. Suddenly employees of a small business don't get paid. Those employees of course have to pay mortgage/rent/medical bills and suddenly paycheck they counted on doesn't come. This could affect many people in very negative ways.
I think $250k stolen should definitely get a priority to be investigated by agents over $2k stolen as it is more likely it will mess up lives of many people in a bad way.
I am going away from SMS based 2FA where I can. For services where it is used, anyone have opinions on using 2FA via a SMS to VOIP number with a provider who has better account security/authentication tools than most telcos (e.g. google, etc)?
Why not? Higher net worth equates to higher taxes paid - the 250k victim has been paying the investigators a more substantial sum, and should receive a more substantial response from them. "Size matters" sums it up to me.
Are you sure? Maybe you believe they shouldn't work that way, but do you believe they truly are blind to the net worth of the offended party?
This is all guessing though, I'd love to see more data on it.
>>I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.
I'd argue that it's a lot more urgent. What if you were paying for a house tomorrow, and the money is gone, so you lose the house? Or you are a small company that has to pay its tax bill for the year, but the money is gone? Or you have to pay for an expensive operation that won't go forward otherwise?
2k is not as important in a way that if you are really short of 2k, then there is a plethora of options to come up with 2k on a short notice(some astonishingly bad like payday loans but there are options) - while if you are out of 250k and need 250k then most likely you are absolutely screwed.
Again, to repeat my final point - don't make assumptions about people's money.
Because it is their job.
We are in dire need of specific cyber security public divisions are people can go to. FBI I believe will have many problems to deal with, and as far as I know, there isn't any cyber-police division capable at the city/state level.
Atleast nothing capable of handling incidents like the one mentioned above. The debate of who's job it is can get hairy. Especially with the future where internet is becoming more pervasive, there can be more damage.
They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.
adb backup com.google.android.apps.authenticator2
there are also more user friendly backup apps such as helium, but adb works quite nicely.
If you're into cryptocurrency, the Trezor will also act as a U2F device.
Mobile signature (SIM-based)(0) is the most secure method as far as I've seen in banks. Citing wiki: "supporting the authentication on the Internet with a parallel closed network like mobile/GSM and a digital signature enabled SIM card is the most secure method today against the man in the middle attack."
You can manage your risk somewhat by:
1) Using credit and not debit cards for day to day spending.
2) Maintaining your long term wealth in separate accounts at separate institutions and not linking them directly to anything except your checking account. This minimizes what can be stolen if your checking account is compromised, and makes it less likely that your savings can be stolen directly (account number is used in fewer places).
3) Turning on all the alerting and notification settings you can find, so that you'll hear about unauthorized activity immediately.
In US it seems #freemarket is putting externalities (security) on the customer.
It also provides wire transfers, which are a little more secure because they're push only, but also less secure because they're instantaneous and irreversible. All banks charge at least ~$15 per transaction and they're really only used for high value, time sensitive deals.
Many companies (and individuals) in Europe publish their account numbers on their letter head and website, it really isn't a big deal.
Anything else seems security by obscurity.
And even if you enable it someone needs to forge your signature under direct debit order to allow someone to charge you.
So still no.
I had somebody buying products on Amazon using my company's IBAN numbers. Amazon were super frustrating to deal with. They kept asking for my amazon account details and I kept explaining that the company doesn't have an amazon account. They didn't know how to proceed ! But in the end they did reverse the charge.
My girlfriend had somebody buying groceries using her numbers. They just write numbers in and signed the sheet of paper at the store. The store refused to take responsibility for doing this without ID-ing the person. The police were more understanding.
More like corporatist government regulations are putting the burden on the customer.
I don't deny that there are _corporatist government regulations_ (which largely prevent the best qualified engineers/entrepreneurs from wanting to tackle the consumer fintech problems), but banks are dragging their feet and the #freemarket hasn't developed a viable alternative yet.
A requirement "out-of-band communication [..] before any outbound wire transaction can be attempted" easily turns the processing cost (not price) from $0.02 to $20+ per transaction, a thousandfold increase, and that's assuming that this'd be offered as standard product and not a special case for a single customer.
If it's not made as a standard product, then it's really painful - it would mean that either the whole staff&systems would have to be trained for that customers needs (not likely unless you're bringing 10+% of the whole bank's revenue) or the customer wouldn't be able to use any standard banking channels ever, not the normal branches, not the normal online services, not the normal call centres, only directly through your private bankers.
If you keep your PIN secret it's a very secure system (unless the attacker is very lucky).
If you have enough dollars, a private bank type thing works too.
Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction.
If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".