Columnist asked researchers what they could find out from just his cell number

Re:Columnist asked researchers what they could find out from... by rootusrootus on Thursday August 15, 2019 @11:38AM (#20706138)

There is not really a good answer to social engineering, as far as I can tell. For example -- I do my banking with a big, reputable bank most everyone has heard of (and not one of the banks people like to hate) and I've got passwords, two factor authentication, etc. That's all great. And yet, about a year ago my wife's debit card got cloned at a compromised ATM and armed with that information (bank, and name) someone called up the customer service at my bank and asked them to reset the password to our account. According to a security investigation by the bank, it took them six attempts before they found someone who believed their sob story about being stuck in a hospital somewhere with no access to money, etc. Gave them our account login and reset our password for them. The person logged into the web site, transferred a bunch of money from savings into the compromised debit account and started pulling it out as fast as they could. I got instant notifications as they did it but was driving and didn't see them for about 20 minutes, by then the bank had deduced that something was wrong and shut it down, $5K later. Luckily the bank didn't really argue the point, they knew they were totally at fault for letting it happen, but still -- all the security in the world that I tried to use for that account and all it took was one bank employee to negate 100% of it.

[ Parent | on HN ]

Re:Columnist asked researchers what they could find out from... by ghaff on Thursday August 15, 2019 @12:33PM (#20706762)

Of course, the alternative is that you are actually in a hospital with no access to money, etc. and the bank will unwaveringly stick to a policy that you must show up at a bank office with valid ID or you'll have to wait for a letter to your physical address of record, etc.

Perhaps that's just the way it should go down in a case like this. But there are costs to making the decision to close off the potential for social engineering as thoroughly as possible.

[ Parent | on HN ]

Re:Columnist asked researchers what they could find out from... by rootusrootus on Thursday August 15, 2019 @01:14PM (#20707285)

Agree there should be a way, perhaps, to recover from a bad situation.

As a follow-up to my experience, I guess I should expand on the consequences for us. The bank admitted fault, but to protect themselves from a bad employee doing it again in the future, now when we call we have a special voice-only password and PIN, and we have to answer a battery of questions that are clearly pulled from a credit bureau (you know, the types of questions like "You had a mortgage in 2005, what was the street the property was on" and such things. Takes 10 minutes to get to "Thank you sir, how can I help you today" if we ever have to call customer service.

Based on that experience, I think perhaps the bank should make that the answer to recover a deeply lost account. They gave a stranger the credentials to our account -- not just the password, but they had to tell them the login, and disable two-factor authentication (because the login is built from a PIN and RSA code) based on a plea for help. I can see forgetting your password, but who forgets everything? That should be a huge red flag.

I could rant for a long time. I had a pointed discussion with a manager at the bank about how getting five repeated, fruitless requests to change credentials on an account didn't somehow trigger any protective response. How hard would it be to implement a counter that says "okay, after the second attempt to gain access by voice to an account that is denied for lack of authentication, all future calls for this account go directly to the security department for personal attention"? I got no good answer other than a lot of "yes sir, this was completely wrong, sir, I'm sorry, sir" etc.

[ Parent | on HN ]

Re:Columnist asked researchers what they could find out from... by ghaff on Thursday August 15, 2019 @01:23PM (#20707383)

I don't really disagree with any of that. I was just making the point that there are tradeoffs and the nature of those tradeoffs are going to depend on the situation.

Obviously, access to a banking account should have a pretty high bar even if that means some people may well end up in difficult situations where they've lost access to their money and the bank can't/won't do anything about it based on a phone conversation.

[ Parent | on HN ]