Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Some financial institutions are bizarrely inept when it comes to security.

I had one once that had an authentication question in their phone banking script that asked how a certain system was set up, option A or option B. Given that I was calling to set up that exact system, neither answer made sense. The agent I was speaking to was seemingly unable to comprehend this, and I got sent to a branch having failed the ID check.

I went to my local branch with enough ID bearing photos and recent addresses to pass all the usual KYC/AML checks to open a new facility at any major financial institution in my country. Having explained the situation and showed that ID to a bemused but sympathetic member of staff, they called their magic phone number to speak to the relevant team, gave their staff credentials, and confirmed that I was present in person with them and they had personally verified my ID. They were then transferred to apparently the same phone system I’d called from home myself, which got stuck at exactly the same ID check.

Didn’t stay there long, though longer than the place whose “security team” called me and started the conversation with, “Good morning, I’m calling from the security team at (my bank). Before I can talk to you any further, I need to verify some personal details to confirm your identity. Can you please tell me (the top three things I’d need to know if I were an identity thief and wanted to impersonate you with other services)?” I particularly liked the anonymous phone number they were calling from. And in case anyone’s wondering, I did call the bank back at one of their public phone numbers, and they confirmed that the call I’d rejected was from them.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: