Re:The ‘Zelle fraud’ scam: how it works, how to fight back
by baybal2 on Saturday November 20, 2021 @09:10AM
(#29288201)
SCA will not do a thing. SMSes are hackable, and SS7 network is routinely exploited.
Google has made things worse by making confirmation SMSes very easily identifiable, and interceptable at scale with their SMS verification service which is now being pushed down developer's throats. (Google yr66t3YYkAe that's a Google 2FA ID of some bank, seemingly already actively exploited)
Adding confirmation links inside SMSes is what some money transfer companies did responding to the threat of SMS interception, but I think this made it even worse, at least on Android. It's trivial to coax dozens of popular apps into opening a link in the browser, or webview using Android's "intents," thus completely negating any CSFR protection.
Google has made things worse by making confirmation SMSes very easily identifiable, and interceptable at scale with their SMS verification service which is now being pushed down developer's throats. (Google yr66t3YYkAe that's a Google 2FA ID of some bank, seemingly already actively exploited)
Adding confirmation links inside SMSes is what some money transfer companies did responding to the threat of SMS interception, but I think this made it even worse, at least on Android. It's trivial to coax dozens of popular apps into opening a link in the browser, or webview using Android's "intents," thus completely negating any CSFR protection.