There was a comment on Hacker News, which alas I can no longer locate, where a guy said he'd been called by his bank and the bank wanted him to answer various security questions. He said he was happy to do so, but firstly needed the bank to verify who they were, or to call the bank back on a telephone number on their website. The bank refused, so he refused to give them any details. The bank then blocked his bank account, meaning he couldn't pay his university tuition on time, meaning his student visa was no longer valid as he was no longer "studying", meaning he had to leave the country.

A bank blocked an account because they called someone and that person didn't provide them with personal data? That sounds unlikely.

I've definitely experienced the first half of the story: banks really will do dumb things like this and then be surprised when someone is upset by it (anti-fraud protection tends to be the worst: a text-message from a random unaffiliated number with another unaffiliated number to call, where you must then provide account details in order to get your card unblocked, and trying to call the official number and go through the phone tree does in fact, eventually, tell you that it was legitimate, but only after hours of being batted between departments).

That's not the half I have trouble believing.

Banks do have obligations under AML and KYC laws to get information from their customers. I mean I know a single phone call sounds extreme, but I could believe it.

My bank (in the EU) wrote to me a while back (post, no copy to email, no sms, no phone call, etc.) saying if I didn't provide info on certain recent transactions (my salary) they'd block my account in two weeks. Thankfully I wasn't on vacation and saw the letter and answered and it was all OK.

Having information about you (that you provide when opening the account) is entirely different from calling you out of the blue after you already have an active account for long enough that you trust and depend on it for your migration status. Refusing then is in no way breaching AML/KYC requirements. They would ask them to validate the identity on the call, not to gather regulatory data on their client. If they didn't have any info and were to "call as ask" how would they know it's the right person and data anyway?

How is a bank not validating one phone call grounds for freezing funds?

I am not surprised. I know of a bank that disabled a credit card following a single missed payment for the crime of failing to answer a phone call.

This is one of the reasons I use a local credit union with a handful of branches only in my region. I can always re-establish trust by just walking into a branch to do business, and likewise they can always just ask me to walk in with my driver's license if they need to verify that I'm really me.

A reasonable decision in your case, no doubt.

But the mentions of "his student visa was no longer valid [...] meaning he had to leave the country" make me think walking to a local bank branch might not have been an easy option in the post adrianmsmith recalls.

Absolutely agree! I only brought it up because it seems like, in our quest for efficiency, we are rapidly heading for a world where we try to delegate trust to outside entities (like tech companies, megabanks, or far-off government departments in Washington, D.C.) but, fundamentally, what makes financial transactions work (with anything other than physical currency), is actual real trust between parties. This is how the great banking houses of Europe began, it's how remittance networks still work in much of the global south, and its how the Jimmy Stewart-style small town bank once functioned. National banks with lots of local branches are an approximation of this, but the "branches" keep getting less and less bank-like: there is no "president" at the BoA branch inside Kroger, just somebody with a pulse who can technically pass a background check far enough to get bonded. Finally, many of the big banks are just closing these far-flung branches altogether. Bank of America &co. may get many advantages from their enormous scale, but they may be undermining their own foundations in the name of cost savings by trying to cheap out on "customer service".

They probably know this and don't care because it won't happen this quarter or likely even this fiscal year, so it doesn't matter to anyone in charge. But it does matter to ordinary people trying to conduct their lives without being irreversibly de-personed by a flakey customer service bot.

I understand the desire to be skeptical, but maybe you should give individuals the benefit of the doubt and the giant multinational corporation the skepticism.

I'm being skeptical about something someone wrote online about something the read online. Don't make this about ethics.

That doesn't add up; you're free to call the bank at the telephone number on their website whether the representative who just called you wants you to do that or not.

This.

Also healthcare providers, though they seem to have finally wised up. They would call me from poorly configured phone systems (so unrecognizable caller id) and the first thing they would ask is to confirm full name and date of birth.

Patterns like this do a great deal of damage in desensitizing folks and making them accept dangerous patterns that get exploited by scams.

Even if you recognized it, the number shown by Caller ID is easy for the caller to spoof -- or at least it was a few years ago (the last time I paid attention).

Thankfully that part has vastly improved with STIR/SHAKEN, combined with number reputation management.

The problem with that, at least on my experience with iPhone, is you can only get the authentication signal after you’ve already hung up. The only thing I see is a small checkmark next to the “location” of the call in my recent call log. I can’t find any indication of a stir/shaken status in the active call screen.

So asking people to take the step to confirm the call is legitimate won’t work- they can’t tell until they’ve already terminated the call. It’s useless for purpose imo.

On my Pixel some calls just get auto-rejected. Others will get through but be marked with a red caution symbol for the picture and say "Scam Likely". Then finally sometimes the call will come through with just the number but still have that red caution symbol.

I imagine it is doing something with STIR/SHAKEN along with how many other times similar calls have been flagged as spam calls.

My carrier has a similar “scam likely” feature but afaik that is not directly tied to stir/shaken. I’ve also signed up to have calls rejected and can see them in the carrier app.

I have reported at least a thousand different scam calls over the past two years and so my blocked number list is so large it freezes the phone for a minute or so while it loads. Still the scammers persist…

I remember when I used Ting, I could specify what would appear as caller id. If I had wanted to abuse this, I could easily have had it display whatever number I wanted instead of my name. Since a number of phones would display the caller id instead of the number when caller id was available, nobody would know that the number was not real. I am not sure if this has changed at all.

Banks maybe, but Google? Google only has "AI" support and that doesn't call us yet. So it's safe to assume that any call from Google is fake.

Yeah Google will never call you about your free gmail account, just as Microsoft will never call you about a virus on your home computer.

I have had my telephone company ask me to give them a code sent to my device. It is presumably to prove to the company that the representative is talking to me so that bad actors low in the company cannot start randomly messing with people’s accounts. It is the equivalent of the bad click here. The only real defense is to know the difference between a mechanism meant to authorize someone a the company and a mechanism to authorize you. Confuse the latter for the former like the victim did here and bad things will happen.

Interesting. Was that after you called them or they called you?

It was when I called them.

I called a bank to increase my ATM limit. The agent sent me an SMS code to verify my identity and wanted me to read it back to him. The message said not to give the code to any human. Sigh.