Re:Your Mother’s Maiden Name Is Not a Secret
by yawaramin on Friday December 29, 2017 @09:37PM
(#16033491)
Do most websites have call centres where you can try to trick agents? Also, how gullible are call centre agents at financial institutions? If they're really giving out access to random people claiming to have forgotten the security answer, it's pretty clear-cut the bank should be on the hook for damages if money gets stolen. Nothing like the prospect of having to pay out damages for gullible call centre agents to motivate training agents to be smarter.
[ Parent
| on HN ]
Re:Your Mother’s Maiden Name Is Not a Secret
by motherdearest on Friday December 29, 2017 @11:50PM
(#16033899)
Additionally many institution's gaurd against this by having systems that hide the security question from the customer service representative and only authenticate on a correct answer. If they are showing the "secret questions" to their entire customer service department you don't even need to worry about outside attacks because your organization is ripe from the inside
Re:Your Mother’s Maiden Name Is Not a Secret
by shyn3 on Friday December 29, 2017 @09:52PM
(#16033543)
I speak from anecdotal experience here but have seen a bank account password reset using only the confirmation of address, name, DOB and bank card #.
Re:Your Mother’s Maiden Name Is Not a Secret
by always_good on Saturday December 30, 2017 @01:21AM
(#16034124)
The customer support rep once let me into my 2FA Bank of America account when I simply lost my phone. Just had to answer some questions you could find in a WHOIS query.
"Surely financial institutions are more secure" is only a pleasant thought.