Don't give away historic details about yourself

Re:Don't give away historic details about yourself by jackhack on Tuesday April 10, 2018 @02:14PM (#16803656)

In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear.

It's disgusting how twisted these criminal activities have become.

[ Parent | on HN ]

Re:Don't give away historic details about yourself by sitkack on Tuesday April 10, 2018 @07:41PM (#16806731)

I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them.

Every alternative way in is a larger attack area.

[ Parent | on HN ]

Re:Don't give away historic details about yourself by gowld on Wednesday April 11, 2018 @04:09AM (#16809010)

You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.

[ Parent | on HN ]

Re:Don't give away historic details about yourself by packet_nerd on Wednesday April 11, 2018 @02:14PM (#16813839)

I got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.

[ Parent | on HN ]

Re:Don't give away historic details about yourself by aaron_m04 on Tuesday April 10, 2018 @09:08PM (#16807218)

How does the phone number get identified? You would think that'd be confidential.

[ Parent | on HN ]