In the UK, banks have put in quite a lot of messaging around the fact that they'll never ask for a password -- so the above line from the article ought to set off alarm bells in most customers' minds.

Of course, there are people, particularly older or vulnerable users, who are impacted by this as they might not be aware. Phone scams to get 2FA codes aren't going away anytime soon, sadly.

Also, as an industry, I wish we could move away from SMS-based 2FA. It's kind of amazing that SMSes these days are a barren wasteland -- mostly automated messages, scams, ... and two-factor codes. And some institutions still use SMSes to deliver two factor codes ... including Paypal in the UK.

“We’ll never ask for your password. And we’re not asking for your password. This is just a one-time authentication token. Your password is safe!”

Every time I read post-mortems on hacks and scams in the US, my mind is a bit blown on just how easy most could have been prevented by tiny bits of government regulation that we Europeans take for granted.

I was a phone store monkey working on close to minimum wage a few years back in the UK. I could absolutely swap someone's SIM with no problems what-so-ever and it typically took only a few minutes for the new one to become active and start receiving SMSes (the old one will still have signal - though no more traffic - for a few hours making detection difficult unless you actively try to place an outbound call).

While we're supposed to verify someone's identity, a dedicated fraudster could absolutely trick us and we were never given any proper identity verification solutions, nor enough training, and frankly not being paid enough to care anyway (which also exposes us to bribery/insider threats).

SMS 2FA will absolutely not be secure as long as minimum wage employees hold the keys to the kingdom, and I'm only talking about in-store employees making UK minimum wage. I'm sure the situation is much worse in offshore call centres.

The reality is, mobile phone companies never started out to be identity providers. App developers did that.

Do not hold the carriers responsible for shit we've done.

Hold the carriers and ISPs responsible for their actual crimes, like selling our data to the government and marketing companies like the world is about to end.

It always fascinates me how poorly people understand the nature of scamming and confidence fraudsters. The banks could have every customer recite on video that they have heard and understood the message - many of them will still be vulnerable.

Each small step along the pathway is only a little more wrong than the last - so by the time the guy on the phone says "and we need you to confirm this code with is" on the phone... yeah. The victim isn't really objective anymore. They are not considering this in isolation, but as part of a relationship the scammer has been building for hours if not days.

It isn't that the messaging is pointless, but it simply cannot and will not protect people from their own fallibility.

Honestly, it is a terribly hard problem - and I actively do not know the right way to manage it without simultaneously restricting access to peoples own resources

Like everything, it will require a gigantic scandal before anything is fixed/changed and it will open the door for new issues.

I won’t bore with details, but I’m a lawyer who primarily sues banks for customers. And I’ve seen the lawsuits I file lead/contribute to changes in bank behavior and policy.

The regulatory protections are there. Now lawyers need to punch banks on the nose until they decide they want to do more to stop the fraud in the first instance.

But it’s strange, clients have almost like a Stockholm syndrome with the banks. Their rational is often something like “I don’t want to sue them and make them mad, because that might mean I won’t get my money back”

But you’re not going to get your money back unless you sue. Meanwhile deadlines pass and then you’re screwed (and embarrassed)

1. Credit account are closed without a specific reason being given. (Banks have an obligation to give you a reason).

2. Debit card/checking account fraud. There’s a federal law specifically protecting consumers in those cases.

3. Credit card/. Again, a specific federal law for these cases.

What’s noteworthy for each one of these violations, or, more accurately, for each one of these causes of action, is that there is a right to recover attorneys fees. And whenever you have that, then the consumer has an opportunity to find a lawyer who will forgo any payment unless, and until, there is a recovery. That’s how I pursue the vast majority of my cases. I even cover the filing fee for the consumer.

So when I say consumers need to sue their banks, and they get this response of “well they can’t afford a lawyer,“ i’m pretty sure they can afford free. but this pessimistic mindset seems to have taken hold. And I’d like to try and undo it.

But I’ll include the PSA I posted on the article as well:

Attorney here (not legal advice).

Please be aware that there is a short deadline required for Regulatory disputes (approximately 60 days). That could have an effect on your claim. Time is of the essence.

And depending on how soon you notify the institution before the deadline, you can be stuck losing up to $500.

Again, please just know time is of the essence and you want to reach to an experienced attorney ASAP if you suffer fraud.

Good luck to the bank which would like to enforce this. One tried, I told them I am leaving, they said it is a misunderstanding and that of course they did not mean to make me pay these 150€.

Generally, in the US, its 60-90 days (the fact that it’s variable is obviously not ideal) and $500 loss limit.

I just checked, it is now 50€ only, and only if the payment was done with a PIN or SMS/app confirmation. This is the maximum amount (so if you had, say 3 times 300€ of fraudulent transactions, you would pay a max of 50€ total - and like I said it is not likely that the bank will make you pay anyway)

This has happened many times in Sweden in the last few years. Banks almost always tried to talk their way out of any sort of responsibility even though scammers took advantage of their pretty bad processes. The banks processes as well as the apps' designs have improved, but I think the point is that essentially nothing of what happened there in the US wasn't happening in Sweden as well. I presume it's the same with the rest of Europe.

This quote from the article is key:

> “Consumers — many who never ever realized they had a Zelle account – then call their banks, expecting they’ll be covered by credit-card-like protections, only to face disappointment and in some cases, financial ruin,” Sullivan wrote in a recent Substack post. “Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was recently affirmed by the CFPB here. If you are reading this story and fighting with your bank, start by providing that link to the financial institution.”

Good to see US regulators aren't letting banks off the hook. They should furthermore come down very hard on any bank that even acts like they might not be responsible since that's essentially fraud.

At the end of the day it's an issue of securing human processes as well as regulators holding banks feet to the fire for problems their processes create.

Google has made things worse by making confirmation SMSes very easily identifiable, and interceptable at scale with their SMS verification service which is now being pushed down developer's throats. (Google yr66t3YYkAe that's a Google 2FA ID of some bank, seemingly already actively exploited)

Adding confirmation links inside SMSes is what some money transfer companies did responding to the threat of SMS interception, but I think this made it even worse, at least on Android. It's trivial to coax dozens of popular apps into opening a link in the browser, or webview using Android's "intents," thus completely negating any CSFR protection.

2FA is absolutely the future and I believe globally payments should move in this direction… I’m just pointing out that even in Europe, this has not been the standard for all that long. That said I hope other countries/regions follow the example — the EEA seems to lead the charge on major online issues, e.g. payments and privacy.

Cards can be created to suit most cases such as one-time transactions, monthly subscriptions and "pre-paid" type cards with a defined total which are tied to one merchant. All multiple use cards are valid for a max of 12 months.

Out of 6 banks across 2 EU countries, only two allowed for that.

Another one had dynamic CVV.

I assumed due to convenience and safety that virtual cards were more widespread in Europe, not least because of the requirements such as 3DS for card payments.

At least fintech companies like Revolut and N26 should be available for most Europeans and they offer virtual cards, though with other limitations/costs.

In France I know that Fortuneo gives that possibility, but for instance Boursorama or Credit Mutuel do not.

It is funny how the banking is different between countries in the EU. France is slowly making its way though the 90's while Poland uses a phone based transaction system (BLIK). I always saw Portugal as bing very modern in that way (you had chips on your identity cards for years, we just got them this year, with the new credit-card format of id cards)