Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Banks in the UK do all sorts of scammy things, not for that purpose, but as part of their usual business

Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection

They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof

They call customers and ask for security information

They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do

All of the above risk causing customers to lower their guard to fraud

They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard)

They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying



> They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof

Prime example, Santander

From: Santander <santander@email2.yoursantander.co.uk>

Subject: Know more about Facebook Scams

Congratulations Santander, you've now trained your customers to trust emails from domains like "email2.your<business>.co.uk"


I thought that only in my country the banks' "security" turned fucking retarded but it seems it's a global trend. Recently I received legit email from my bank with warning against scammers and the title was "The first step of the scammer will be will be sending an email, text message, or calling you". Is it a double intelligence test or they just admitted to being scammers?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: