News for hackers. Stuff that matters.

A comment on Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts. Parent comment

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by PeterisP on Monday June 12, 2017 @07:35PM (#14541979)
In such cases the bank would offer to send new tokens by physical mail to the registered address or receive them in a branch with proper ID.

I recall a case where an important customer was stuck abroad with everything stolen; they were sent replacement tokens and cards to be received at the embassy, which could properly ID them.

[ Parent | on HN ]
Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by agwa on Monday June 12, 2017 @08:19PM (#14542162)
Why can a bank have such a robust procedure for replacing tokens, and be trusted to follow it, but not have a similarly robust procedure for handling password resets?
[ Parent | on HN ]
Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by PeterisP on Monday June 12, 2017 @08:28PM (#14542182)
They definitely can, but some of them don't, especially in USA for various reasons.

I mean, any bank with proper procedures doesn't really have the concept of "online password" that's sufficient to do anything and makes 2FA mandatory; I believe in EU now it would be forbidden for a bank to have simply a username-password authentication.

[ Parent | on HN ]