“We’ll never ask for your password. And we’re not asking for your password. This is just a one-time authentication token. Your password is safe!”
Every time I read post-mortems on hacks and scams in the US, my mind is a bit blown on just how easy most could have been prevented by tiny bits of government regulation that we Europeans take for granted.
I was a phone store monkey working on close to minimum wage a few years back in the UK. I could absolutely swap someone's SIM with no problems what-so-ever and it typically took only a few minutes for the new one to become active and start receiving SMSes (the old one will still have signal - though no more traffic - for a few hours making detection difficult unless you actively try to place an outbound call).
While we're supposed to verify someone's identity, a dedicated fraudster could absolutely trick us and we were never given any proper identity verification solutions, nor enough training, and frankly not being paid enough to care anyway (which also exposes us to bribery/insider threats).
SMS 2FA will absolutely not be secure as long as minimum wage employees hold the keys to the kingdom, and I'm only talking about in-store employees making UK minimum wage. I'm sure the situation is much worse in offshore call centres.
The reality is, mobile phone companies never started out to be identity providers. App developers did that.
Do not hold the carriers responsible for shit we've done.
Hold the carriers and ISPs responsible for their actual crimes, like selling our data to the government and marketing companies like the world is about to end.
It always fascinates me how poorly people understand the nature of scamming and confidence fraudsters. The banks could have every customer recite on video that they have heard and understood the message - many of them will still be vulnerable.
Each small step along the pathway is only a little more wrong than the last - so by the time the guy on the phone says "and we need you to confirm this code with is" on the phone... yeah. The victim isn't really objective anymore. They are not considering this in isolation, but as part of a relationship the scammer has been building for hours if not days.
It isn't that the messaging is pointless, but it simply cannot and will not protect people from their own fallibility.
Honestly, it is a terribly hard problem - and I actively do not know the right way to manage it without simultaneously restricting access to peoples own resources
In the UK, banks have put in quite a lot of messaging around the fact that they'll never ask for a password -- so the above line from the article ought to set off alarm bells in most customers' minds.
Of course, there are people, particularly older or vulnerable users, who are impacted by this as they might not be aware. Phone scams to get 2FA codes aren't going away anytime soon, sadly.
Also, as an industry, I wish we could move away from SMS-based 2FA. It's kind of amazing that SMSes these days are a barren wasteland -- mostly automated messages, scams, ... and two-factor codes. And some institutions still use SMSes to deliver two factor codes ... including Paypal in the UK.