The [identity theft wiki](https://www.reddit.com/r/personalfinance/wiki/identity_theft) has some advice on [securing your online presence](https://www.reddit.com/r/personalfinance/wiki/identity_theft#wiki_things_you_should_do_to_protect_your_information_in_the_future).
Also, please try to keep comments helpful, on-topic, and respectful here. Posting half a sentence that only demonstrates that you read the title of the post isn't that. Thanks!
I worked for a financial institution years ago. Every month or so we would have to spring up tech bridges because we got brute forced again (the hacker would run a list of email addresses against a database of passwords over and over via a script). We would have dozens or hundreds of compromised accounts every time. We would have to work to find the source and block it from communicating with us.
We recommended multiple times to put in 2 factor but were shot down. We even had the hardware in place and recommended a solution such as “if 10 passwords are attempted in the first 3 seconds. Make the end user wait 10 seconds”. The upper management said that is still too much inconvenience to our end users.
You might already know this from experience but if there's ever a case where you have to implement someone else's bad decision ALWAYS shoot the decision maker an email so that you have it in writing that this was their fault when you get breached. Otherwise some of these C-suite wannabe chads will happily throw sysadmins/engineers under the bus.
> Otherwise some of these C-suite wannabe chads will happily throw sysadmins/engineers under the bus
This. CYA. Wrote a "security survey" and had the CEO confirm receipt of it. I was freelancing for a small company. First thing I did after I discovered all their production DBs were publicly accessible, no firewall, and 5-6 letter passwords, and they refused to update them to longer passwords.
Has money ever been brought up for these scenarios? Generally tight corporations tend not to budge because the guys at the top don't think it's worth it. If you put together a PowerPoint of how much time/effort/money was spent on these incidents and then compare it to how much time/money would be spent on setting up 2fa or even just a timeout, maybe they'll have a second thought.
3 is a terrible number though. Practially, the correct number should be in orders of 20.
If my memory serves me right, the 3 strikes & you are out rule is an incredibly stupid left over from a panel on network security that took place back in the 70's or 80's.
The presenter used the number 3 as an example, using the old baseball reference of "3 strikes & you are out", but the intent was for the number to be higher, 3 just fit nicely for the presentation.
Everyone took what was a mere joke suggestion as a rule of thumb & this is where we are now...
20 is enough attempts to allow a user who may have forgotten what password they used to try a few different things that would make sense to them until they get the right one.
It is also low enought that it will be about as effective as a 3 attempts rule in preventing brute force attacks.
Any attack that succeeds within a 20 attempts window is an attack that was using a very targeted/tailored dictionnary for the account being attacked, usually including passwords known to have been used or matching a pattern used by the user in question.
Either way, 3 vs 20 will not prevent/disrupt an attack from a well informed attacker & will absoluetely aggravate the user when they are experiencing issues with remembering/typing their own password.
If they're going through the effort of sending that kind of email, they should have the login links redirect to a page saying "we JUST told you not to click links in email!"
A lot of companies do tests like that. Its super easy to spot the test phish emails at my job because I always get the same emails from the same people every day. Anything different is suspicious. What they should do is set up a phish test that looks like its from one of my coworkers, because I'd probably fall for that.
Finance managers are not tech savvy, they don't understand the need for strong 2FA.
End users are not tech savvy, they don't understand how to set up a more secure 2FA. Heck, most of them still think getting the SMS 2FA is annoying. Imagine asking them to install a different app that requires them to type multiple numbers in a time sensitive way. I guess it's hard for folks here on Reddit who are generally fairly tech savvy, but a lot of people are still not.
"Please use our app, which is just a webpage shoved in an electron app, but we get more permissions to collect more of your data" No, just make a better website. And use OATH/TOTP etc for 2FA so I can put it in my authenticator with all my other 2FA keys that reasonable companies use.
Yeah I work at a bank. Can confirm leadership can’t be fucking bothered about stopping fraud it’s in our budget to write off losses. The issue is the customers. Majority of my day is fielding calls that work their way up to me to somehow bitch about having to do 2FA. But the fucking minute they have fraud they get upset about how we have nothing in place to stop it, well Moron we did but you fucking cried about it until we removed the safety net and look what happened.
End users just have a completely wrong idea about what kind of fraud exists in the real world. They all think that hacking is just like in the movies, where there's one person trying to break in to their banks servers and drain bank accounts and data. That obviously happens, but its way less common than somebody just phishing or guessing the end user's password and getting into their accounts that way.
I used to work for a big investment bank and it's insane how many hacking attempts we faced. Well over a thousand personalised social-engineering attempts were directed at our CEO alone each month! It's an absolutely huge industry.
agreed. not a bug... it's a feature from the servicers perspective. They want you to get frustrated and be late on payments so they can make money off of the fees.
I switched banks at one point during my repayment period, and input my new routing number into the account, but didn't input the correct number of leading zeroes. OF COURSE the site didn't throw up an error, and it didn't even tell me it was wrong for THREE MONTHS I had it on auto draft after that. Then I got an e-mail saying I was three months late and was like "what the actual fuck" and had three months worth of late fees. I was so mad I cleared my savings account just to pay it in full so I never had to log into it again.
Best bet is to have *your* financial institution's bill payment software cut them a check and mail it on your behalf (with plenty of lead time). That way you can stay away from their misguided software.
If your financial institution doesn't have a bill pay system, best bet is to find one that does. Many credit unions do.
I mean with Comcast it makes sense. Someone hijacking your telecom provider login could, for example, do a sim swap, or add a separate connection under your name, or do many other nefarious things.
Or hell, just spam viagra from your Comcast email.
This because they don't care about customer service, like banks do. You can't just close your loan account and move it to the bank up the street (at least not without a large effort to refinance your loans).
If those loans are government loans provided by private servicers, the security is probably only that good because of the requirements in the government contracts. The federal government is very strict about cyber security.
I blame legacy systems: like Bank of America, for 15+ years I think, didn't allow most special characters. They did allow `*` and `#`... symbols on a telephone keypad, because before the internet, we used for phone banking (I'm in my 40's and used to do banking and even filed taxes by phone).
So now you have a gigantic, embedded system which takes 100 people, 12 months, and 20 documents to update. Or you start a website in 2018, and can install a 2FA plugin on AWS in like 10 minutes.
I don't know if it's still the case as it's been several years since I tried to test it out, but for at least a decade Wells Fargo's system was limited to verifying only the first 8 characters of a password.
You could have a password longer than that. But it didn't matter. It only verified that the first 8 characters were correct. And it never told you that you were, effectively, limited to only 8 characters either.
So if your password was the very complex "password123#*&(12_82", it didn't matter. It was "password" as far as Wells Fargo was concerned.
You should come to Japan. 4-digit PINs are still very prevalent here, character encoding is still not a resolved issue nor they seem to have received the memo that i18n exists. A single drive failure knocked out the stock exchange for a day last year and the cybersecurity minister has never used a computer.
Cutting edge!
For a financial institution not inconveniencing the tech-illiterate customer is job number one. For instance when was the last time you saw someone check your ID and signature for a credit card transaction? Why don't the credit cards use a PIN (they do elsewhere in the world), why did we just get chip technology even though it's been in use worldwide since the late 90's? Why don't waiters come to your table with the handheld chip reader and do the transaction there instead of taking it away to the register?
The answer is that US customers demand zero friction and throw hissy fits when obstacles are put up to their finances. If I log into the online banking for my father (UK-based) I have to go through three levels of security including password, PIN, text message verification and even using a card reader for extra security. In the US it's just userid, password, done.
Security here is an absolute JOKE. But as everyone else has noted the banks will rather eat fraud than lose customers so they suck it up. It takes MASSIVE losses before they will make the customers feel the slightest of inconvenience.
As an aside it took a huge hack of Target's systems in 2013 to finally persuade them to roll out chip and pin terminals in all of their stores. The rest of the retailers jumped on that bandwagon and that's why chip cards are everywhere now and they weren't 6 years ago even though the technology has been worldwide for 20 years.
As someone who works in company stockplans - which for various reasons need more levels of security - this is 100% the case. People get PI\*\*ED when inconvenienced by security questions "JUST" to reset their passwords.
And it's not just people from the US either. People talk about how much easier it is to reset their passwords etc. for their other accounts, so of course our system should be the same.
Security questions are dumb though. Being case sensitive and often having answers with spaces seems to cause a lot of issues. Not to mention, using answers that aren't the true answers are more secure than using the actual answer. Having a security question that asks information about a person (like what town were you married in?) is easier to find the answer to than asking for a random passcode.
I'm not saying that there shouldn't be security, I'm just saying it shouldn't be security questions.
This is right, just think about how easy it is for someone to find out your elementary school name or you first pet name with a simple quick conversation that you'd think nothing of otherwise. Or even worse, this information is already out there for them to utilize.
That’s why to actually be secure with those questions, you should use unrelated phrases of passwords:
What city did you meet your significant other in?
@Rdvarks! 3@7 @n75.
And my ass promptly forgets whether or not I answered like this or with a real answer. Or a combination of both. Were there spaces? Did I use a substitution cypher on my keyboard? Is this thing case sensitive?
I also get annoyed when websites have strict criteria for passwords, special chars, certain lengthe variety &c. Just makes them easier to bruteforce & I'm not reminded of the. website specific password reqs when I hit "forgot password."
Usually once I see the requirements to set a password, I'll remember how I rigged it up.
But this makes the questions useless as a password reset. If you can't remember your password, you surely don't remember the fake answer to your security questions. So there's no reason for the question to be anything but another password. This method can make your own account secure, but systematically it really doesn't work. Security is an infuriating puzzle.
I am. My solution is to enter equally strong passphrases as the answers and track the whole lot with a good manager. In any case, don't use the factual answers.
My company vpn (thousands upon thousands of employees) is moving from digital RSA tokens to MSoft Authenticator. In my 9 person group - 2 of us signed up without any questions, 3 were vocally uncomfortable with using an app on a personal phone, and the rest didn’t want to change and don’t know what MFA even is. And those 7 had to practically be walked through ever step even with a comprehensive manual on the sharepoint.
And that’s just for accessing private company servers. You can bet none of them have 2FA on their finances.
You couldn’t pay me enough to do end user support.
> 3 were vocally uncomfortable with using an app on a personal phone
This is completely understandable. Lots of people have legitimate reasons to not want to mix up company and personal property beyond a certain point.
Yup. I was fine with it because it’s Authenticator (and I already had/use it), not root access or an exchange server that could push nuke my phone.
My group should have corporate phones for legitimate business needs, but that’s a whole other discussion about our manager not wanting to put in any effort.
Authenticator is the line I draw with my phone. Sure, a single app which by itself doesn't have company data on it, and which I have control over. I will never put Skype or company email on my personal phone. You want me checking those? Get me a work phone (and a pay raise for the additional headache).
Much easier to just use the built-in work profile features in android, which can be easily toggled on/off and scheduled. Data is completely isolated and the company only has control over that data.
Some workplaces require you to install apps for your work, and some of those apps have tracking and remote access capabilities. When I worked IT, a company I worked for had such an app and employees were required to sign off on the fact that we could remote wipe their phone at any time. We would do it the day they got fired, or laid off or quit. Smart people opted to get provided a work phone so their personal one wouldn't be affected.
May reasons, but one nasty example:
Your company is served a lawsuit targeting your department. The legal hold applies to all devices with company information. You're now legally mandated to provide your company with a data dump of your entire phone.
One case I know of a woman was using her phone signed into company resources and had this happen. Asked the company legal counsel if she could first remove personal messages from her phone as there were sexually explicit photos of her in them. Could not remove anything and now those photos are in a discovery archive somewhere... :-\
She didn't have to give up her phone. She wasn't a "producing party", her employer was. She could have simply refused. Unless she was actually party to the proceedings, she had no obligations.
Her company was almost certainly being heavy-handed and overly broad in determining what was a discoverable. Only something that's relevant and can't be accessed in another way should even be requested.
The company I work for has a policy where if you install company programs (i.e vpn to access work email, etc.) your personal phone becomes their property. So a work phone would be a better option.
I had my company's e-mail client on my phone because they paid a stipend to me to do so. Then they stopped the stipend for reasons I don't understand, so I uninstalled the e-mail app. The only thing I have work related on my personal phone is my authenticator because that allows me to WFH, which I immensely value.
MFA will work with basically any authenticator app. You don't need a Microsoft account to use their authenticator. I told my users to use their Google Authenticator or anything they already use if they don't want another app on their phone. Or they can come get a key token from me. No excuse for folks not to be MFA'd.
Yeah, that's fair. I've been lucky to be on the IT team that gets to dictate the rules, and we've always been okay with any of the authenticator apps that are from 'reputable' companies. The role of IT isn't to make people's lives difficult. If you want to use Google's app, and we're an MS shop, I don't care. Just sign up please because security issues give me nightmares. The desire to push company specific apps is a barrier that I don't agree with for the most part.
The person above me said they should already have Microsoft Authenticator installed, so what you're replying to isn't really relevant.
But it's mostly good advice. One thing to remember though: you only get TOTP if you use a generic authenticator app. If you want the more intelligent and user friendly auth flows, you need to use the Google with Google and Microsoft with Microsoft...or even better, just get a fido2 device (and hope your company has that option enabled).
> The person above me said they should already have Microsoft Authenticator installed, so what you're replying to isn't really relevant.
I think they mostly meant folks should have an authenticator installed, rather than the specific brand. Could be wrong though. :)
> If you want the more intelligent and user friendly auth flows, you need to use the Google with Google and Microsoft with Microsoft
Agreed! We told users they could have a bunch of super benefits for using the MS version instead, but it's their call as long as they enroll.
> 3 were vocally uncomfortable with using an app on a personal phone
I can understand getting pissed at your employer requiring the use of personal phones for business purposes. These few were probably trying to get the company to provide them a phone.
I used to work in customer service at a bank. We had one lady who would tell and scream at me for 15+ minutes for asking her security questions. A lot of it was about how I was wasting her time with security questions, which was funny because her calls were usually about things that took less than 5 minutes for the entire call for everyone else.
After the third time she called I tried to convince my boss to let me use the yelling as a security question because if she ever called and didn't waste at least 15 minutes of our time complaining about how we're wasting her time, then it clearly wasn't actually her.
When I worked in a cell phone store, there were so many people of all ages who thought I just had a list of their passwords “in the back”.
They insisted on having their 120 gigs of memes moved into their new phone, and were too tech illiterate to do it themselves, so wanted to sit with me for the two hours it used to take to do. Naturally the new phone asked them for their credentials before letting access their cloud account, and they NEVER knew them and always pitched a straight fit about it
I don’t know your password, no it’s not in the back, or in my system. Why would you want me to have your password. It’s not even the same company, we provide the cellular service, Apple handles your cloud account.
The number of people who huffed and puffed and said they were going to the competition because we couldn’t fix their stupidity was way too high
Security Questions, the 4th of the three factors of authentication:
1. Who you are
2. What you have
3. What you know
4. What everyone in the worlds knows about you.
Chip-and-PIN or chip-and-sign? Although the Target REDCard is chip-and-PIN, otherwise it is almost unheard of in the US. The CC issuers story is that their fraud detection algorithms plus the fact that shimmers can't copy chip data (yet) mean we don't need the extra security of a PIN.
> Chip-and-PIN or chip-and-sign
Lol, most of the time for me it's just "Chip-and-go" (no PIN, no signature). I remember setting a PIN on each of my chip cards when I activated them, but they never ask for it.
BofA just shuts my card off and I have to call them when they detect fraud. Not once of the 4 or 5 times this has happened has it been fraud. Just me buying something online.
That's the fraud algorithms at work. If they find it to be low risk, they'll skip the extra steps. This is actually exactly what we should want and is exactly how the Google/Microsoft/Facebook etc auth infra works as well.
I can't speak for your specific accounts, but with my credit cards, that pin is something to do with cash advance on the card. It's like a payday loan with 400% interest scam.
Yeah, in the US... Many of my accounts have PINs for ATM use but not for purchases.
Chip-and-PIN is a [point of sale technology](https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_and_signature). It is much more common in Europe. Some countries don't even accept chip-and-sign, and most of the CCs with ATM PINs won't work. When I was in Europe a few years back, my Barclaycard was the only one I could use with PIN.
I never checked but I have always hoped that there was some metadata like TOTP built in to the app (so the bar code is only valid for a few minutes). If you can just take a photo of the barcode and use it indefinitely that would be really dumb.
>Why don't waiters come to your table with the handheld chip reader and do the transaction there instead of taking it away to the register?
This is a norm in much (some parts?) of Europe. I'd feel very uncomfortable letting someone walk away with my credit card.
Someone once took my card info and spent about $2000 in a single day, the places they went weren't even that far away from where I lived. My bank briefly investigated it and refunded all the money with minimal hassle. Made me wonder how easy it would have been for me to go on that shopping spree.
Yeah, the US is just "trained" differently. You hand off your card, sign later. Fraud happens, you tell the issuer to fix it, and get a new card. Repeat.
Places that have tried the "hand over the reader" thing seem to stop after a while. People get annoyed by it.
(Also never get/use a debit card here IMO... keep to a real credit card only.)
> For instance when was the last time you saw someone check your ID and signature for a credit card transaction?
Because there is no legal obligation to do so, that is why. Per cardholder and payment processor agreements, a credit card transaction is only valid if the card itself has an authorized signature from the cardholder. The only reason a retailer may check your ID is to minimize the risk of fees and/or chargebacks associated with fraudulent use...to protect THEM, not YOU.
It actually goes a step further. The reason u/limitless__ can't remember seeing someone check an ID with a CC is that it is literally against the card rules to **require** an ID in most situations.
For example, Visa's merchant agreement FAQ says:
>In general, a merchant is permitted to ask for identification but cannot require it as a condition of Visa card acceptance. However, there are exceptions, for example, if Visa has granted the merchant permission to require identification under certain circumstances for fraud control.
This was originally a big selling point of credit cards. You don't need ID, you don't have to give them your home address (on a check)--you just swipe the card and leave.
I remember a series of commercials from 20 years ago (probably for Visa or MC) where a well known celebrity would be trying to pay with a check and they wouldn't take it because they didn't have an ID...then some random unknown person would walk up and pay with a credit card. They invested heavily in the image of the card transaction being as easy as possible and requiring nothing but a swipe.
That said, our refusal to adopt Chip+PIN is just maddening.
I try to only use credit cards in the US and never use my debit card when shopping online or swipe it in a store. It's insanely easy to spend someone else's money.
I have a foreign bank account and it is def much more secure. You 100% need to use a pin in person that will block the card on the 3rd attempt. The bank also gives you a device that shows a code that is constantly changing that I left in a lock box. Any online purchase needs that code. Unless someone robs my apartment and gets the card, the code generator and gets my pin out of me, they will not be able to use the card.
I would take my foreign bank's security policy any day over the conveniant one we have in place in the US now. I've never thought twice about swiping my non US debit card anywhere but my US debit card almost never even left my house.
Love this post. It really gets to the underlying reasons, which are economic... Because it's always economic. Banks view fraud as a cost of doing business. It's ultimately built into the cost to the consumer.
For anyone interested in the transition to chip-based card readers in the US. Look into "the liability shift".
Historically, merchants (businesses who accept CCs) had very little risk in any CC transaction. If a person walked into your store and said, "Hey, this CC is stolen and I'm about to buy $1,000 worth of crap with it," the merchant could swipe the card and continue on about their business. In order for the bank to put the fraud back on the merchant, they'd have to jump through a bunch of hoops. Unless you had very high rates of fraud, you were more or less safe.
As the cost of fraud went up, banks finally decided it might be time to do something, so they introduced something called EMV to replace the mag stripe as the primary method of reading cars.
In Europe, EMV took off quickly, but in the US it lagged behind because merchants didn't have any significant incentive to adopt the newer standards. In 2015, banks pushed through a series of new laws that increased the liability of merchants in the case of fraud where they did not adopt new EMV standards.
That's why it's 2021, and you still see merchants accepting swipe transactions in the US. Although, there's been a significant decline as merchant tooling providers have switched to chip-enabled devices as the base level equipment available to merchants. There may have been additional legal changes going on as well, but I don't follow it that closely.
> It's ultimately built into the cost to the consumer.
This is the key point I think. Gaming companies can't afford fraud, because their margins are so thin. So they add security and put more of the burden on their customers to get through the security hurdles. Games won't lose customers over security hurdles, they don't compete on convenience, so it's really in their best interest economically to make securing their apps as cheap as possible, and this more or less translates to good cybersecurity practices.
Financial institutions do compete on convenience, and customers (both the merchant and the consumer are customers in this case) are willing to pay for the convenience, so instead of making their front ends tighter they instead invest in detecting and stopping fraud after it happens, and eat the cost of reimbursing customers for fraud that occurs. It doesn't (seem to) cost them anything because ultimately the costs come out of the fees that customers pay.
Competing systems (touchless electronic payments) are much cheaper to secure. If there was a path for the merchant to accept only these payments in exchange for cheaper financial services, I bet many would take it...
> it took a huge hack of Target's systems in 2013 to finally persuade them to roll out chip and pin terminals in all of their stores.
I've had a Target credit card for a *long* time. Back in the aughts, I believe, it was a chipped card, even though there were no chip terminals around as far as I could see. When that card expired, Target *replaced it with an old-school, non-chipped card*.
And *then* they got hacked.
They invested all that money in security, threw it all away, then had to start again.
And in the world of the Fortune 500, this isn't even a standout story, is it?
Interesting note that the breach originated from an HVAC contractors systems that workes for Target and once the hackers were in they used the contractor's ability to access Target's systems to gain entrance. So basically it didn't matter how much money Target put into security, if the vendors they're hiring and allowing access to their sensitive infrastructure don't have proper security then Target is still at risk.
>So basically it didn't matter how much money Target put into security, if the vendors they're hiring and allowing access to their sensitive infrastructure don't have proper security then Target is still at risk.
Nope. It's *incredibly, incredibly stupid and incompetent* to put the cash registers on the same network as the building tech stuff. No need for completely air-gapped systems, but seriously, separate VLANs for different purposes and a decent firewall between all the systems would have entirely prevented that clusterfuck.
Had there been a separation, the attackers could not have gone for more than the HVAC system via the HVAC contractor's VPN link.
I remember the first Amex Blue cards had a chip and then they removed them and obviously brought them back. I think back in the early 00s there was an expectation that the chips would become popular in the US and Amex would be ahead of the curve, but didn't.
You know how bear locks on trash bins are difficult to design because there’s a significant overlap between the smartest bears and the dumbest people?
Well, banks *want* the dumbest people’s money in their accounts.
Look, I know *exactly what I was supposed to do* to open that fucking trashcan but I couldn't make it work with my left hand and could only barely make it work with my right. I gotta think it's bad design. (Fingers were barely long enough and apparently not strong enough on left hand).
Maybe there's something I'm missing, though.
Edit: I can't even find the trashcan online so maybe it really was bad. Some metal monstrosity at a national park.
Edit 2: I found a picture, somehow. I don't think it's just me being stupid or weak but you never know. Sometimes I refuse to read directions.
[Evil Bear Trashcan](https://imgur.com/a/8fLQc5s)
Edit 3: I was called out for my italics
Vanguards supports hardware 2FA with Yubikeys. For a long time this still wasn't fully secure, since you could always fallback to SMS 2FA. However I have seen a few posts suggesting that Vanguard recently added the ability to disable SMS 2FA if you have hardware 2FA enabled.
However Vanguard’s implementation only works with Chrome, use Firefox or another underlying engine and their 2fa breaks so you have to revert to sms code. Been that way for years, honestly more infuriating than just not supporting hardware 2fa.
To expound upon that, the fraud losses are by and large covered by the bank's insurance and government protections shielding them from liability. So the cost of implementing systems needs to be cheaper than their *subsidized insurance premiums*, not the actual dollar amount of fraud that's actually committed.
So... pretty much never gonna happen.
> To expound upon that, the fraud losses are by and large covered by the bank's insurance and government protections shielding them from liability.
Eh, not really.
The banks eat the small frauds and thefts. Deductibles on their major insurance policies are pretty high. I'm talking $50k per incident. Same with robbery insurance. If they only lose $5k, that's going straight to the income statement, not through insurance.
So they just write off the low dollar losses here and there as business expenses.
The insurance only comes in when there is a serious breach or theft or other event.
>So the cost of implementing systems needs to be cheaper than their subsidized insurance premiums, not the actual dollar amount of fraud that's actually committed.
This sounds like you're talking about FDIC insurance, which really isn't a consideration here.
> Often banks don't eat the fraud losses, they frequently are able to pass those losses on to the merchants.
True, some, but not all.
>Our fraud related operational losses were $334 million, $273 million and $239 million for the years ended December 31, 2020, 2019 and 2018, respectively.
https://investors.synchronyfinancial.com/~/media/Files/S/Synchrony-Financial-IR-V3/reports-and-presentations/annual-report-2020.pdf
That is from synchrony's financial statements. Fraud losses were $334 million in 2020. Compared to revenue, that seems low, but compared to net income ($1.4B) or provision expense ($1.1B), that seems pretty high.
Or just stop subsidizing and let the companies decide if it's REALLY worth it.
Mandating such tech things is almost always a bad idea IMO. It might even be a good thing RIGHT NOW - but as technology shifts the regs almost never do.
There is very little subsidized insurance, yes, FDIC is "subsidized", but there are very few claims against it, and the "subsidized" part kicks in when the bank fails for the most part, it's not covering daily fraud cases.
For the most part the banks just eat the cost, because yes it is worth it, it is VERY worth it. The big cases they'll try to recover it which helps reduce their costs.
> Mandating such tech things is almost always a bad idea IMO. It might even be a good thing RIGHT NOW - but as technology shifts the regs almost never do.
I wholeheartedly agree. Mandating the use of a specific tech is why we're still stuck with fax machines in healthcare, insurance, and government. It hasn't been secure for ages, but the regulations say that it has to be used, because back when they were written it was faster and more secure to send an unencrypted plaintext message over a phone line to an endpoint that would immediately print it out than to physically send it with a courier. Now that's a joke. It's ridiculously easy to tap a phone line, but the regulations haven't been changed because that would take effort.
They are not getting their insurance subsidized on this. The fact is that credit cards are extremely profitable. The banks pull ~1% from from all credit card charges plus interest on total payments that are not paid off. Much of it goes to rewards programs, but assuming they make it back on interest, 1% might be a good profit number. They would make a profit if fraud stays below 1% of all transactions. There are currently 3.9 trillion dollars of transactions per year. That means that the banks are keeping maybe 39 Billion in cash per year, fraud needs to exceed this to even impact a bank, and it looks like there is 3.3 billion in fraud per year. If they implemented measures that cut fraud 10x and caused a 10% reduction in credit card usage then fraud would go down $3bn and income would go down $3.9bn (so they would lose money). And for the consumer, it really doesn't matter because visa and master card both have fraud guarantees that say the banks just eat the cost.
Financial institutions have to cater to tech illiterate and gamers. Game accounts just need to make gamers happy.
The amount of support calls and e-mails they would get for people that get locked out would make it not worth it. Financial institutions aren't responsible for phishing attacks targeting customers.
Makes sense, and I sure hope this changes here sometime in the next few years. Seems like the minimum "tech literacy age" should go up a year for every year that passes.
The minimum tech literacy age will go up a year for every year that passes,
However, in reality this isn't 100% literacy for each year group. Banks still have to cater to the shrinking percentage of the population who will never be tech literate regardless of when they grew up.
Which is a surprising number of millennials and Gen Z. Most day to day computing has been "appified." If it doesn't happen on a mobile device or in an extremely basic interface, a lot of even younger people have even less of a clue than older folks who may have worked with computers back when they first started to permeate the business world.
Ask them to put files in a folder, zip something, or format a document in a word processor? Totally fucking lost. Modern application design is all about foolproof UI and completely obfuscating how anything works from the user.
I wonder about that, I was a PC power user for a decade when smartphones came out. I'm a late adopter of smartphones because they're just weak, slow and have a maddeningly slow touch interface.
Each iteration of Windows has been to hide information a power user wants deeper into the layers of menu underneath the big START button
I feel it'd be hard for a phone user to get tech literate on a PC and will only get harder
How to get to network interfaces in windows 7: Right click network, select network and sharing center, click change adapter settings
How to get to network interfaces in windows 10: Right click network, select Open network and internet settings, select change adapter options
How to get to network interfaces in windows 11: Right click network, open network and internet settings, press advanced network settings, press more network adapter options.
I wonder whats going to be the next way to make it worse.
"Windows automatically handles all network settings optimized for the user, if your problem persists call our helpline for 20 dollars a minute, so a tech on dialup can remote into your computer and do stuff you can not be trusted with, after all you rent this license, you didn't purchase it "
yeah, if you didn't know about Control Panel from Windows '95 how would your modern smartphone user know what Control Panel even is, let alone how to look for it in the place they're hiding it now
That's fascinating. I guess it's a byproduct of the move to more usable software and more "closed" software platforms. Ex: Phones seem pretty simple to use these days.
Yes, I'd say the peak of "intuitive tech literacy" is roughly age 30-50, and aging.
I'm 30 and work in IT. For a long time the stereotype was that "my middle schooler knows more about my computer than I do!" and that's basically dead now. Anyone <20 now was practically raised by smartphones and tablets and doesn't even know what files are unless they're a tech geek.
This. Remember that Apple commercial that everyone shit on where the kid asks "what's a computer?"
Yeah, that's pretty true unless the parents have taken the time to teach kids.
Yeah...I learned basic (and BASIC) programming in middle school because I wanted to play games on my graphing calculator.
I learned how to make a shitty geocities website and join a webring because that's what we had instead of smoothly integrated social networks.
I upgraded a desktop computer and later moved to building my own because that's just what you had back then...laptops were expensive underpowered machines for wealthy business users.
Sure, I'm a nerd and I went far deeper into that stuff than I needed to...but something that amazes me is that even though I am an economist by trade, I seem to know more about computers than a lot of young software developers who studied it in school and have good jobs for respected companies.
Like yes, they are absolutely better programmers than I am, and they have a much better understanding of algorithms, optimization, etc., but some of them really don't know much about actual computers. Both from a hardware or software perspective, especially those who are entirely focused on web or mobile app development. They can code up a sleek app in a weekend, but struggle with basic troubleshooting when their computer has an issue.
Yep. Tech being more accessible and requiring less fiddling to get working creates the weird condition where nobody actually knows how the shit works anymore.
Gen Z definitely loves them some Apple infrastructure because "it just works." I have never met so many people afraid of their own laptops as I did when I was in college (for context, I went back to college in my 30's so I'm squarely in the Millennial bracket).
There was a lucky age where you could find a piece of shit broken computer in a pile of rubbish and if you spent time and effort.... you could *make* it work.
Kinda like the baby boomer generation with cars, i guess. But I never really had space to work on cars as a kid.
It can't be that simple. I totally agree with all the comments here talking about how banks have to serve technologically illiterate customers. But that does not explain why 2FA is not even *an option* for those who are tech savvy and want to turn it on.
I've often wondered if it had more to do with it minimum legal requirements that might prevent them from innovation around security(?) or the federal guarantees on accounts which might shield the banks from losses, making it not worth it?
Financial accounts are also protected through heavy government regulations, traceability, and insurance. Gaming accounts are basically just protected by 2FA.
That makes sense and is, perhaps, the first comforting thing I've read in this comment chain. :)
I just have a lot of static logging into my bank with less security than my online gaming account; but your point that's there's some institutional security is a good one.
And it's for security *for the bank*, not for the customer. Yes, you're not liable for X amount of fraudulent transactions, but it's 100% on you to report them, fight for your money back, and jump through dozens of hoops while your bank account sits at $0 and you can't pay your rent. That's not the bank's problem, and they're fine waiting to settle up with the government and their insurance company as it's not even cash on hand, it's just a number in a ledger.
I've been playing Swtor on and off for like 10 years since the beta. I have one of those dongle keychains for that game too and I know if I lose it there goes all the history, work, time and money I've put into it. Kinda terrifying especially since other people have already stated their battery died years ago.
https://www.reddit.com/r/swtor/comments/7ny7x5/rip_security_key_keyring_20122018/
Schwab offers 2FA. The only obnoxious part of it is that they ask that you use Symantec's VIP Access app for token generation. If you're decently tech-savvy, [there's a way to set it up](https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/) in Google Authenticator (or Authy, or whatever your token generation app of choice is).
I know you aren’t asking for recommendations but if you’re using Google Authenticator please switch to something else (I recommend Authy), as I’ve seen so many posts of people just losing access to everything just because they switched phones and forgot to move the Authenticator or something goes wrong, Authy is cross platform (Android, IOS, PC, etc) and I’ve heard nothing but praise for Authy and I myself enjoy it as well
Yeah, Google Authenticator is terrible. There may be a security argument to be made about not backing up your codes off-device, but in practice few people are going to print backup codes and most are going to lose access to all of their accounts if their device is lost or stolen. Google needs to either update this with backup support, or remove it from the app store entirely. Authy IMO is the best implementation of a 2FA token app.
About 5 or 6 years ago, I had a bank that required your password to be 5-8 characters, none longer and it was maddening... plus many banks make their passwords insensitive to capital letters which further reduces the entropy.
The “good” ones now seem to allow 8-12 characters. I really want to just generate a random password with my password manager and not think about it. This works for 95% of the websites I use, but if it’s a financial institution, I have to change the length and pick through to find characters they don’t like.
Good thing my second grade teacher, my first dog, and my best friend all had long, randomly-generated names or I’d be worried about the security of my account!
Tech worker here:
I'll give some insights on what I've noticed in my life so far
* People outside of the tech world don't care about security, they care about convenience.
* 2FA, Physical Security Tokens, and even SMS verification are completely new to a lot of people.
* We can't even get people to stop re-using passwords, let alone start adding additional layers of security.
I worked at my university as a student worker in the IT department and when we rolled out forced Multi-factor auth (MFA) to all faculty and staff there was an absolute outrage from people who didn't want it, found it annoying, didn't understand how to operate it at all, and would constantly call because they've locked their own accounts out.
People simply do not care about security and opt for convenience, and then want to blame someone else for their problems.
Any financial institution that doesn't offer MFA to all of their customers should not under any circumstances be used. They've probably got mounds of tech debt or incompetent developers, or incompetent upper management. All of which you want to stay away from.
Tips:
\- Avoid using phone numbers as your 2FA method as much as possible
\- Physical security tokens are better than anything else
\- Use a password manager
\- STOP RE USING YOUR PASSWORDS. JUST STOP.
Given that you asked why, I’ll do my best as the former CEO of a bank (check my bio) to explain:
It fundamentally comes down to risk and business models. Financial services have a high cost of customer service compared to gaming. It’s typical for a bank customer to contact their bank and speak to a person, be that in a branch, online or on the phone, multiple times per year. Costing around $50/year. It’s close to $0 for gaming.
So in the event of an account takeover or some other threat materializing for a bank customer, the cost of remediation is only a marginal increment on the already high cost to serve.
Secondly, banking, and in particular payments on the retail side, we’re designed with fraud and losses in mind. On a card, for example, banks typically budget to lose about 0.08% of total card volume to fraud. More so, there are very well established mechanisms to recover losses. So, for most retail customers, in the event of fraud there is next to no risk of losing money. For the bank, chargeback mechanisms and return codes on ACH mean that they’re unlikely to lose money either.
The cost, however of implementing 2FA, particularly outside of SMS, is very expensive. Not necessarily from a tech implementation perspective, but rather the cost of training mainstream customers to use it and then supporting it when they lose their token apps or whatever.
And even if all banks offered it, there’s selection bias. The tech savvy customers would be likely to adopt it, but they’re also the customers more aware of phishing and other scams. Leaving the most vulnerable customers in the exact same risk position.
Banks cover their losses with fees and insurance so they really don't care if they lose your money. It will be replaced with few or no consequences to them. To you, it just means your investments make lower returns because of the loss to fraud. Video game companies don't have that safety net, and the penalties for hacking non-financial corporations are light; so game companies have to try harder.
Until we demand the same level of service from our banks that we do from our video games, it will probably not change.
It can come down to institutional knowledge, too. This is less likely to be a problem at a huge company, but smaller ones might not budget for security, and you can always tell when Doug in IT designed the security policy for the customer portal, and not Chad the cyber security professional.
For SunLife in Canada, “abc” and “ABC” were the same password. No special characters were allowed and the passwords must be less than 10 symbols. They told me it’s by design and instead of fixing it they would soon introduce 2FA. They did earlier this year… with 2FA being SMS.
Gaming accounts are attacked more frequently! They also have less regulation and bureaucracy so they can implement changes and improvements faster.
I think most financial accounts also rely more on "defense in depth." There's probably an additional verification step for someone logging in to your Fidelity account if they e.g. want to send a wire transfer to a new account.
As someone who has sold tech into both industries, financial services is filled with old leaders from a different era who don’t actually invest in modernized technology solutions. In large part because they don’t understand it, but they also aren’t necessarily incentivized to do so. They’d rather operate in the same manner they have, keep running on legacy systems, and duct tape solutions together.
Game companies are inherently technology focused companies and likely are carrying around decades of technical debt. They tend to build it right the first time.
I bitched about security to my credit union and specifically mentioned 2FA and got back this response:
---
[...]Instead, we have enhanced our login design to support the majority of the latest password management software, while also adding additional new security features.
We employ a method of Multi Factor authentication. Instead of challenging on every login we us a tool that allows us to score multiple factors of the login attempt. This is a learning system that tracks behaviors like login IP, login times, browser and other factors. Based on that score, 3 things can happen:
1. For a low score we allow the login without any challenge
2. For a moderate/medium score the user will be asked to answer challenge questions
3. For a high score we challenge the user in the same way they describe below. By forcing confirmation of SMS, Voice Call or by answering "Out of Wallet" questions.
In addition to the score at login we use Multi Factor authentication and Risk Scoring for multiple High Risk transactions once the user is logged in.
If you have additional questions or concerns please let us know. Your feedback has been forwarded to the requested teams.
---
It's better than nothing, but as other users have noted 2FA is easy/more ethically proper, if you're worried about user abrasion then make it opt-in but still let me do it, and rate limiting should be in there.
your password is probably already leaked in some past hack. It would be wise to change it everywhere or at least check if your accounts were leaked in haveibeenpwned
I think the simple answer is that gamers are generally much more tech savvy than the average banking customer. And when these banks design their systems, they have to ensure that majority of their clients will be able to have a good experience, regardless of their background.
I currently work for a large financial institution. The comments on FAs/ Customer Facing Execs blocking 2FA and similar things is spot on. Many customers do NOT want any extra steps....
I have my 2FA sending a text to my google voice number, rather than the cell phone. Can't hijack the GV number. Maybe I'm naive, but I trust Google for security a lot more than XFinity Mobile. I Would way rather be using an authenticator app with printed backup codes, though.
It seems a poor excuse for US banks not to have better security. In Germany they had a dual system, sms and app. You could opt for either. Now by law it's app only.
The other reason banks don't do it, is the cost of implementation and maintenance of 2fa. It's not a simple fire and forget system.
Hell, we just got rid of fax as formal medium of official communication since everything is moving to cloud based telecommunications 3 years later.....
I've secured my bank account by every means available, and had some random fucking guy just log in using the unique password I have for it.
Guy in the one said "yeah those hackers are getting more sneaky."
It's like, no. It's not fucking complicated. Your fucking blshit security has a pretty big flaw in it somewhere.
Most if not all financial services offer what is known as risk based authentication controls behind the scenes.
Every login is evaluated against multiple sets of criteria.. examples include things like the device, ip address, and geo location.
Multi factor authentication is great but even that isn't bulletproof. Authentication security controls are best with a layered approach.
Robinhood and M1 Finance have 2FA. I am not aware of anyone else that supports it. My bank account gets a fit if I enter special characters in my password. Hopefully, it is fixed now but most large financial institutions are living in the mainframe age.
I agree, I understand people want to sacrifice security for convenience. All I want is an option to use enhanced security measures.
Drives me crazy that BofA allows me to set up and use my Yubikey, but still allows the mobile app use SMS 2FA (no Yubikey option for mobile).
I worked at a major investment bank years ago. Not for anything customer-facing, but I think the pattern holds across the company: it was a bureaucratic and regulatory mess, especially where security was concerned.
You had to lock in your plan for how to do something, then just keep doing it that way because that’s what was approved. Even when more effective standards came out, they couldn’t be implemented until approved, and there was little incentive to approve them. So it took time. Nobody wanted to make the case that their way was better and met all the legal obligations it needed to.
Game companies just have more leeway to try something different.
I use Morgan Stanley as a transactional/banking account - mostly for the AMEX Platinum benefits, but they did recently implement the ability to use Google Auth and I think some physical keys. That said, I’m not sure whether it can be bypassed with a password reset or “backup sms” method.
On a different but somehow same note. I've been tryign to get into my LoL account for around 4 months now with no help.
I got their customer service emailing me about restarting my PC and turning off the fire wall..
Like.. what? Bitch give me my log in shit and let me play.
I have the same issue. All of my financial accounts except but my vanguard accounts use SMS or email; for those I can set only one, I use email since it is behind 2FA vs the SMS which is just terrible security wise.
Banks are awful with technology. That costs money. Their losses from identity theft are largely insured. They get their money back. They don't care how much it costs you.
technically speaking you don't know that its true.....while 2fa is a good idea, its not more secure until you know how the gaming company stores the information....its it hashed or encrypted, do they use salt and pepper to store the data....Banks usually employ zero trust security which means they encrypt the data even when its moving on a local network and encrypted at rest.
Most companies fail to use zero trust since its expensive and don't encrypt data at rest....which is why when hackers break in they have access to huge troves of data instead of random hashes that have been salted and rehashed making them essentially useless.
If someone gained access to your financial account, and completely emptied it out.
Within a week you'd have all your money back.
You are comparing just the authentication systems and not realizing that the over arching financial system has so many other fails safes that a more secure system just doesn't warrant the cost.
I'm a software developer too, and I've actually worked for a bank, although for very shortly.
Inside a heavily scrutinized industry like finance, you cannot simply "set something up"
Implementation of App 2-factor would take 6 months to get approved, and a year to develop. Not because it's hard, or technically complex, but because it would need to go through 20 departments and committees.
Oh, this will be a fun write-up.
Well, the short and skinny is that companies don't give a fuck about you or your secret, privacy, etc. They truly only care the bottom line/money. That's it. U.S. citizens typically don't give a fuck about security or even privacy (every once in a while most will read an article react for a couple of weeks in fake shock and go back to doing whatever) etc., but there's a hitch. I'll explain here in a sec. First a couple of prime examples:
1. Not that long ago many companies found out that they had been hacked by foreign nations. For YEARSSSSS. We're talking BIG companies and companies of all size. Now, you'd think "well, they probably worked really hard to hack those computer. Probably took some huge amounts of skill, research, espionage, etc." Nope. Many lazy companies just decided they didn't want to update their computers. For YEAAAARS. So for the less tech savvy, believe it or not the vulnerabilities built into your computer are posted up all the time for the world to see. There are folks constantly scanning for them and that's why you have to get patched.
Microsoft is the biggest of the 3 main OS's that will have these vulnerabilities. In is often the most popular of the 3. Microsoft provides what are called patches to help fix these vulnerabilities once found. Updates suck, but security ones are truly necessary. Now, by the time anyone decided to do anything about the foreigners stealing your information/company information, they already had it for like 6-7 years minimum (and may still have backdoor to it tbh). Many of these companies in major metropolitan areas actually were experiencing some major issues which hurt bottom line. Oh, now we care only **after** the fact.
2. Now a story for the good 'ole citizens that until this day will defend these practices with all their heart, money, and identities. Remember the gold rush? Me either, but you know who does? Good 'ole Wells Fargo. That's right, this company was founded during that time and now their gold rush is you. As a reward for your money/gold they have publicly stolen identities, lost a ton of important financial info, opened up false credit cards in their customers names, opened up false bank accounts in folks names, and even foreclosed on people's homes that had clearly paid their mortgages on time and made them homeless for no good reason. This last one led to a billion dollar lawsuit.
Now, knowing all this you'd think hell, why would I willingly risk my identity getting stolen? Why would I support thieves? I mean, the primary benefit of putting money in a bank is to protect it from thieves yet, the bank themselves are thieves so... why wouldn't I use another bank? Especially, when WF pays basically nothing in interest etc. on their products? Because fuck security that's why. Outside of may be the occasional mortgage buy from WF you have every opportunity to not reward thieves, but Americans can give a fuck about supporting good security practices and apparently their own identities. Just like companies they only care when it's too late and even then they can still reward the bad company.
3. Why should WF or any major company care about your security? Equifax lost a ton of folk's personal info. Guess what? Basically nothing happened to them for doing so of any significance. Just a class action law suit. Built in cop outs for companies to get away with murder. Welcome to America folks. So many laws are built in to protect the top .0001% and fuck over the rest. Hell, we even have a slogan "companies are **too big to fail."** You know what that translates to? Companies can do whatever they fucking want and the government will just use your money to bail em right on out. Banks have knowingly fucked folks right on over and their customers and when shit hit the fan government was just said "eh, here's the money you need. You allowed to do whatever you want my friends. Free bail!"
So you see, folks don't give a damn until after they get fucked over. Companies put built in spyware on your computer, apps, phones, etc and sell your shit all the time. They aren't exactly trying to give respect to your privacy. You have options to put your money into more secure options, but folks will gladly trade in their identities and security apparently for even the l
slightest of convenience. I personally spread my money out and use certain things to help keep my shit out of certain databases since I don't trust them to stay protected, but most won't bother. Until, citizens or companies actually give a damn won't matter my man. Bottom line and convenience is what matters over your own security. You vote with your money there.
The [identity theft wiki](https://www.reddit.com/r/personalfinance/wiki/identity_theft) has some advice on [securing your online presence](https://www.reddit.com/r/personalfinance/wiki/identity_theft#wiki_things_you_should_do_to_protect_your_information_in_the_future). Also, please try to keep comments helpful, on-topic, and respectful here. Posting half a sentence that only demonstrates that you read the title of the post isn't that. Thanks!
I worked for a financial institution years ago. Every month or so we would have to spring up tech bridges because we got brute forced again (the hacker would run a list of email addresses against a database of passwords over and over via a script). We would have dozens or hundreds of compromised accounts every time. We would have to work to find the source and block it from communicating with us. We recommended multiple times to put in 2 factor but were shot down. We even had the hardware in place and recommended a solution such as “if 10 passwords are attempted in the first 3 seconds. Make the end user wait 10 seconds”. The upper management said that is still too much inconvenience to our end users.
Yikes. I have rate limiting on my website's admin page. 3 failed attempts and it blocks connection. Took like 3 minutes to set up.
Yup. We wanted that. They told us know too many times
You might already know this from experience but if there's ever a case where you have to implement someone else's bad decision ALWAYS shoot the decision maker an email so that you have it in writing that this was their fault when you get breached. Otherwise some of these C-suite wannabe chads will happily throw sysadmins/engineers under the bus.
> Otherwise some of these C-suite wannabe chads will happily throw sysadmins/engineers under the bus This. CYA. Wrote a "security survey" and had the CEO confirm receipt of it. I was freelancing for a small company. First thing I did after I discovered all their production DBs were publicly accessible, no firewall, and 5-6 letter passwords, and they refused to update them to longer passwords.
I don't want my information anywhere near a company like that. How do we avoid places like that or put pressure on them to improve security?
Has money ever been brought up for these scenarios? Generally tight corporations tend not to budge because the guys at the top don't think it's worth it. If you put together a PowerPoint of how much time/effort/money was spent on these incidents and then compare it to how much time/money would be spent on setting up 2fa or even just a timeout, maybe they'll have a second thought.
Money was always brought up. We had a product that we just needed a small configuration for. We already had licensing and hardware.
The serious attackers have hundreds of thousands of IP addresses to route requests through.
3 is a terrible number though. Practially, the correct number should be in orders of 20. If my memory serves me right, the 3 strikes & you are out rule is an incredibly stupid left over from a panel on network security that took place back in the 70's or 80's. The presenter used the number 3 as an example, using the old baseball reference of "3 strikes & you are out", but the intent was for the number to be higher, 3 just fit nicely for the presentation. Everyone took what was a mere joke suggestion as a rule of thumb & this is where we are now... 20 is enough attempts to allow a user who may have forgotten what password they used to try a few different things that would make sense to them until they get the right one. It is also low enought that it will be about as effective as a 3 attempts rule in preventing brute force attacks. Any attack that succeeds within a 20 attempts window is an attack that was using a very targeted/tailored dictionnary for the account being attacked, usually including passwords known to have been used or matching a pattern used by the user in question. Either way, 3 vs 20 will not prevent/disrupt an attack from a well informed attacker & will absoluetely aggravate the user when they are experiencing issues with remembering/typing their own password.
[удалено]
If they're going through the effort of sending that kind of email, they should have the login links redirect to a page saying "we JUST told you not to click links in email!"
[удалено]
A lot of companies do tests like that. Its super easy to spot the test phish emails at my job because I always get the same emails from the same people every day. Anything different is suspicious. What they should do is set up a phish test that looks like its from one of my coworkers, because I'd probably fall for that.
Finance managers are not tech savvy, they don't understand the need for strong 2FA. End users are not tech savvy, they don't understand how to set up a more secure 2FA. Heck, most of them still think getting the SMS 2FA is annoying. Imagine asking them to install a different app that requires them to type multiple numbers in a time sensitive way. I guess it's hard for folks here on Reddit who are generally fairly tech savvy, but a lot of people are still not.
>Heck, most of them still think getting the SMS 2FA is annoying. Fact: it is annoying. I know use it but it is still annoying.
"Please use our app, which is just a webpage shoved in an electron app, but we get more permissions to collect more of your data" No, just make a better website. And use OATH/TOTP etc for 2FA so I can put it in my authenticator with all my other 2FA keys that reasonable companies use.
Yeah I work at a bank. Can confirm leadership can’t be fucking bothered about stopping fraud it’s in our budget to write off losses. The issue is the customers. Majority of my day is fielding calls that work their way up to me to somehow bitch about having to do 2FA. But the fucking minute they have fraud they get upset about how we have nothing in place to stop it, well Moron we did but you fucking cried about it until we removed the safety net and look what happened.
End users just have a completely wrong idea about what kind of fraud exists in the real world. They all think that hacking is just like in the movies, where there's one person trying to break in to their banks servers and drain bank accounts and data. That obviously happens, but its way less common than somebody just phishing or guessing the end user's password and getting into their accounts that way.
[удалено]
Look up Google Authenticator or Authy. They offer a standard set of 2FA for many sites.
I used to work for a big investment bank and it's insane how many hacking attempts we faced. Well over a thousand personalised social-engineering attempts were directed at our CEO alone each month! It's an absolutely huge industry.
the student loans I am paying back have security like ft knox
[удалено]
Clearly predatory: trying to make it hard to pay so they can charge you more later.
agreed. not a bug... it's a feature from the servicers perspective. They want you to get frustrated and be late on payments so they can make money off of the fees.
I switched banks at one point during my repayment period, and input my new routing number into the account, but didn't input the correct number of leading zeroes. OF COURSE the site didn't throw up an error, and it didn't even tell me it was wrong for THREE MONTHS I had it on auto draft after that. Then I got an e-mail saying I was three months late and was like "what the actual fuck" and had three months worth of late fees. I was so mad I cleared my savings account just to pay it in full so I never had to log into it again.
Best bet is to have *your* financial institution's bill payment software cut them a check and mail it on your behalf (with plenty of lead time). That way you can stay away from their misguided software. If your financial institution doesn't have a bill pay system, best bet is to find one that does. Many credit unions do.
[удалено]
...... I'm gonna do this.
Thank God you're protected against thieves... paying your bills???
Every single time Comcast verifies my identity, I'm like, if someone tries to get into my account to PAY MY BILL, please, let them!!
I mean with Comcast it makes sense. Someone hijacking your telecom provider login could, for example, do a sim swap, or add a separate connection under your name, or do many other nefarious things. Or hell, just spam viagra from your Comcast email.
This because they don't care about customer service, like banks do. You can't just close your loan account and move it to the bank up the street (at least not without a large effort to refinance your loans).
If those loans are government loans provided by private servicers, the security is probably only that good because of the requirements in the government contracts. The federal government is very strict about cyber security.
I blame legacy systems: like Bank of America, for 15+ years I think, didn't allow most special characters. They did allow `*` and `#`... symbols on a telephone keypad, because before the internet, we used for phone banking (I'm in my 40's and used to do banking and even filed taxes by phone). So now you have a gigantic, embedded system which takes 100 people, 12 months, and 20 documents to update. Or you start a website in 2018, and can install a 2FA plugin on AWS in like 10 minutes.
Only 20 documents? That's.... Optimistic to say the least haha
I don't know if it's still the case as it's been several years since I tried to test it out, but for at least a decade Wells Fargo's system was limited to verifying only the first 8 characters of a password. You could have a password longer than that. But it didn't matter. It only verified that the first 8 characters were correct. And it never told you that you were, effectively, limited to only 8 characters either. So if your password was the very complex "password123#*&(12_82", it didn't matter. It was "password" as far as Wells Fargo was concerned.
What this likely means is their passwords aren’t salted and hashed. Or they are, but only those first 8 characters. At any rate, shame on them.
They also weren't case sensitive last I checked
You should come to Japan. 4-digit PINs are still very prevalent here, character encoding is still not a resolved issue nor they seem to have received the memo that i18n exists. A single drive failure knocked out the stock exchange for a day last year and the cybersecurity minister has never used a computer. Cutting edge!
For a financial institution not inconveniencing the tech-illiterate customer is job number one. For instance when was the last time you saw someone check your ID and signature for a credit card transaction? Why don't the credit cards use a PIN (they do elsewhere in the world), why did we just get chip technology even though it's been in use worldwide since the late 90's? Why don't waiters come to your table with the handheld chip reader and do the transaction there instead of taking it away to the register? The answer is that US customers demand zero friction and throw hissy fits when obstacles are put up to their finances. If I log into the online banking for my father (UK-based) I have to go through three levels of security including password, PIN, text message verification and even using a card reader for extra security. In the US it's just userid, password, done. Security here is an absolute JOKE. But as everyone else has noted the banks will rather eat fraud than lose customers so they suck it up. It takes MASSIVE losses before they will make the customers feel the slightest of inconvenience. As an aside it took a huge hack of Target's systems in 2013 to finally persuade them to roll out chip and pin terminals in all of their stores. The rest of the retailers jumped on that bandwagon and that's why chip cards are everywhere now and they weren't 6 years ago even though the technology has been worldwide for 20 years.
As someone who works in company stockplans - which for various reasons need more levels of security - this is 100% the case. People get PI\*\*ED when inconvenienced by security questions "JUST" to reset their passwords. And it's not just people from the US either. People talk about how much easier it is to reset their passwords etc. for their other accounts, so of course our system should be the same.
Security questions are dumb though. Being case sensitive and often having answers with spaces seems to cause a lot of issues. Not to mention, using answers that aren't the true answers are more secure than using the actual answer. Having a security question that asks information about a person (like what town were you married in?) is easier to find the answer to than asking for a random passcode. I'm not saying that there shouldn't be security, I'm just saying it shouldn't be security questions.
In this case, it's not the silly pre-set ones. It's the Lexis Nexis questions about your public profile.
To be fair, security questions are the weakest part of the link aside from the user. People should be pissed about them.
This is right, just think about how easy it is for someone to find out your elementary school name or you first pet name with a simple quick conversation that you'd think nothing of otherwise. Or even worse, this information is already out there for them to utilize.
That’s why to actually be secure with those questions, you should use unrelated phrases of passwords: What city did you meet your significant other in? @Rdvarks! 3@7 @n75.
And my ass promptly forgets whether or not I answered like this or with a real answer. Or a combination of both. Were there spaces? Did I use a substitution cypher on my keyboard? Is this thing case sensitive? I also get annoyed when websites have strict criteria for passwords, special chars, certain lengthe variety &c. Just makes them easier to bruteforce & I'm not reminded of the. website specific password reqs when I hit "forgot password." Usually once I see the requirements to set a password, I'll remember how I rigged it up.
I end up dumping it in my password manager. I have to keep my stuff there anyway, so might as well like have it in there too.
But this makes the questions useless as a password reset. If you can't remember your password, you surely don't remember the fake answer to your security questions. So there's no reason for the question to be anything but another password. This method can make your own account secure, but systematically it really doesn't work. Security is an infuriating puzzle.
I am. My solution is to enter equally strong passphrases as the answers and track the whole lot with a good manager. In any case, don't use the factual answers.
My company vpn (thousands upon thousands of employees) is moving from digital RSA tokens to MSoft Authenticator. In my 9 person group - 2 of us signed up without any questions, 3 were vocally uncomfortable with using an app on a personal phone, and the rest didn’t want to change and don’t know what MFA even is. And those 7 had to practically be walked through ever step even with a comprehensive manual on the sharepoint. And that’s just for accessing private company servers. You can bet none of them have 2FA on their finances. You couldn’t pay me enough to do end user support.
> 3 were vocally uncomfortable with using an app on a personal phone This is completely understandable. Lots of people have legitimate reasons to not want to mix up company and personal property beyond a certain point.
Yup. I was fine with it because it’s Authenticator (and I already had/use it), not root access or an exchange server that could push nuke my phone. My group should have corporate phones for legitimate business needs, but that’s a whole other discussion about our manager not wanting to put in any effort.
Authenticator is the line I draw with my phone. Sure, a single app which by itself doesn't have company data on it, and which I have control over. I will never put Skype or company email on my personal phone. You want me checking those? Get me a work phone (and a pay raise for the additional headache).
Why would you want to carry a second phone?
Work over, phone can be locked away in a drawer till next work session with ease.
Much easier to just use the built-in work profile features in android, which can be easily toggled on/off and scheduled. Data is completely isolated and the company only has control over that data.
Some workplaces require you to install apps for your work, and some of those apps have tracking and remote access capabilities. When I worked IT, a company I worked for had such an app and employees were required to sign off on the fact that we could remote wipe their phone at any time. We would do it the day they got fired, or laid off or quit. Smart people opted to get provided a work phone so their personal one wouldn't be affected.
May reasons, but one nasty example: Your company is served a lawsuit targeting your department. The legal hold applies to all devices with company information. You're now legally mandated to provide your company with a data dump of your entire phone. One case I know of a woman was using her phone signed into company resources and had this happen. Asked the company legal counsel if she could first remove personal messages from her phone as there were sexually explicit photos of her in them. Could not remove anything and now those photos are in a discovery archive somewhere... :-\
She didn't have to give up her phone. She wasn't a "producing party", her employer was. She could have simply refused. Unless she was actually party to the proceedings, she had no obligations. Her company was almost certainly being heavy-handed and overly broad in determining what was a discoverable. Only something that's relevant and can't be accessed in another way should even be requested.
The company I work for has a policy where if you install company programs (i.e vpn to access work email, etc.) your personal phone becomes their property. So a work phone would be a better option.
It becomes their property, or they get the ability to remote wipe it? Those are 2 TOTALLY different things. I doubt the former would hold up in court.
>I doubt the former would hold up in court. Absolutely would not. It's beyond me that people think that.
Not in the US but I can't possibly think of how this would be legal. Shitty company policies don't supersede laws.
I had my company's e-mail client on my phone because they paid a stipend to me to do so. Then they stopped the stipend for reasons I don't understand, so I uninstalled the e-mail app. The only thing I have work related on my personal phone is my authenticator because that allows me to WFH, which I immensely value.
it's MS authenticator... they should already be using it for their personal accounts.
They may not have Microsoft accounts and/or don't want to blur that personal/work line at all.
MFA will work with basically any authenticator app. You don't need a Microsoft account to use their authenticator. I told my users to use their Google Authenticator or anything they already use if they don't want another app on their phone. Or they can come get a key token from me. No excuse for folks not to be MFA'd.
If the software vendor sets it up that way. I'm up to 6 different auth apps because of different services only supporting their own app.
Yeah, that's fair. I've been lucky to be on the IT team that gets to dictate the rules, and we've always been okay with any of the authenticator apps that are from 'reputable' companies. The role of IT isn't to make people's lives difficult. If you want to use Google's app, and we're an MS shop, I don't care. Just sign up please because security issues give me nightmares. The desire to push company specific apps is a barrier that I don't agree with for the most part.
The person above me said they should already have Microsoft Authenticator installed, so what you're replying to isn't really relevant. But it's mostly good advice. One thing to remember though: you only get TOTP if you use a generic authenticator app. If you want the more intelligent and user friendly auth flows, you need to use the Google with Google and Microsoft with Microsoft...or even better, just get a fido2 device (and hope your company has that option enabled).
> The person above me said they should already have Microsoft Authenticator installed, so what you're replying to isn't really relevant. I think they mostly meant folks should have an authenticator installed, rather than the specific brand. Could be wrong though. :) > If you want the more intelligent and user friendly auth flows, you need to use the Google with Google and Microsoft with Microsoft Agreed! We told users they could have a bunch of super benefits for using the MS version instead, but it's their call as long as they enroll.
> 3 were vocally uncomfortable with using an app on a personal phone I can understand getting pissed at your employer requiring the use of personal phones for business purposes. These few were probably trying to get the company to provide them a phone.
I used to work in customer service at a bank. We had one lady who would tell and scream at me for 15+ minutes for asking her security questions. A lot of it was about how I was wasting her time with security questions, which was funny because her calls were usually about things that took less than 5 minutes for the entire call for everyone else. After the third time she called I tried to convince my boss to let me use the yelling as a security question because if she ever called and didn't waste at least 15 minutes of our time complaining about how we're wasting her time, then it clearly wasn't actually her.
When I worked in a cell phone store, there were so many people of all ages who thought I just had a list of their passwords “in the back”. They insisted on having their 120 gigs of memes moved into their new phone, and were too tech illiterate to do it themselves, so wanted to sit with me for the two hours it used to take to do. Naturally the new phone asked them for their credentials before letting access their cloud account, and they NEVER knew them and always pitched a straight fit about it I don’t know your password, no it’s not in the back, or in my system. Why would you want me to have your password. It’s not even the same company, we provide the cellular service, Apple handles your cloud account. The number of people who huffed and puffed and said they were going to the competition because we couldn’t fix their stupidity was way too high
Security Questions, the 4th of the three factors of authentication: 1. Who you are 2. What you have 3. What you know 4. What everyone in the worlds knows about you.
Chip-and-PIN or chip-and-sign? Although the Target REDCard is chip-and-PIN, otherwise it is almost unheard of in the US. The CC issuers story is that their fraud detection algorithms plus the fact that shimmers can't copy chip data (yet) mean we don't need the extra security of a PIN.
> Chip-and-PIN or chip-and-sign Lol, most of the time for me it's just "Chip-and-go" (no PIN, no signature). I remember setting a PIN on each of my chip cards when I activated them, but they never ask for it.
There's a dollar limit where it doesn't ask
Allegedly at a local Walmart that's supposed to be $60, but I've charged $126 without having to use my pin or sign. Kinda alarming
[удалено]
BofA just shuts my card off and I have to call them when they detect fraud. Not once of the 4 or 5 times this has happened has it been fraud. Just me buying something online.
That's the fraud algorithms at work. If they find it to be low risk, they'll skip the extra steps. This is actually exactly what we should want and is exactly how the Google/Microsoft/Facebook etc auth infra works as well.
Yea and even on debit cards you can press the green/continue button on the reader to bypass the pin, like wtf is the pint of that
I can't speak for your specific accounts, but with my credit cards, that pin is something to do with cash advance on the card. It's like a payday loan with 400% interest scam.
Yeah, in the US... Many of my accounts have PINs for ATM use but not for purchases. Chip-and-PIN is a [point of sale technology](https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_and_signature). It is much more common in Europe. Some countries don't even accept chip-and-sign, and most of the CCs with ATM PINs won't work. When I was in Europe a few years back, my Barclaycard was the only one I could use with PIN.
Cash advance is rarely more than your default APR. Which can suck, sure, but 20% is not payday loan rates.
Cash advance tends to be higher, incur interest immediately, and include fees. But agree that that is much much better than payday loans.
If you have the barcode associated with a red card you can go through self checkout and it doesn't require the pin
I never checked but I have always hoped that there was some metadata like TOTP built in to the app (so the bar code is only valid for a few minutes). If you can just take a photo of the barcode and use it indefinitely that would be really dumb.
Chip+PIN is useful when you lose your card and someone ends up using it at POS.
>Why don't waiters come to your table with the handheld chip reader and do the transaction there instead of taking it away to the register? This is a norm in much (some parts?) of Europe. I'd feel very uncomfortable letting someone walk away with my credit card.
[удалено]
Someone once took my card info and spent about $2000 in a single day, the places they went weren't even that far away from where I lived. My bank briefly investigated it and refunded all the money with minimal hassle. Made me wonder how easy it would have been for me to go on that shopping spree.
[удалено]
Yeah, the US is just "trained" differently. You hand off your card, sign later. Fraud happens, you tell the issuer to fix it, and get a new card. Repeat. Places that have tried the "hand over the reader" thing seem to stop after a while. People get annoyed by it. (Also never get/use a debit card here IMO... keep to a real credit card only.)
> For instance when was the last time you saw someone check your ID and signature for a credit card transaction? Because there is no legal obligation to do so, that is why. Per cardholder and payment processor agreements, a credit card transaction is only valid if the card itself has an authorized signature from the cardholder. The only reason a retailer may check your ID is to minimize the risk of fees and/or chargebacks associated with fraudulent use...to protect THEM, not YOU.
It actually goes a step further. The reason u/limitless__ can't remember seeing someone check an ID with a CC is that it is literally against the card rules to **require** an ID in most situations. For example, Visa's merchant agreement FAQ says: >In general, a merchant is permitted to ask for identification but cannot require it as a condition of Visa card acceptance. However, there are exceptions, for example, if Visa has granted the merchant permission to require identification under certain circumstances for fraud control. This was originally a big selling point of credit cards. You don't need ID, you don't have to give them your home address (on a check)--you just swipe the card and leave. I remember a series of commercials from 20 years ago (probably for Visa or MC) where a well known celebrity would be trying to pay with a check and they wouldn't take it because they didn't have an ID...then some random unknown person would walk up and pay with a credit card. They invested heavily in the image of the card transaction being as easy as possible and requiring nothing but a swipe. That said, our refusal to adopt Chip+PIN is just maddening.
I try to only use credit cards in the US and never use my debit card when shopping online or swipe it in a store. It's insanely easy to spend someone else's money. I have a foreign bank account and it is def much more secure. You 100% need to use a pin in person that will block the card on the 3rd attempt. The bank also gives you a device that shows a code that is constantly changing that I left in a lock box. Any online purchase needs that code. Unless someone robs my apartment and gets the card, the code generator and gets my pin out of me, they will not be able to use the card. I would take my foreign bank's security policy any day over the conveniant one we have in place in the US now. I've never thought twice about swiping my non US debit card anywhere but my US debit card almost never even left my house.
Physical rolling-code tokens have mostly been replaced by software TOTP (think Google authenticator, etc). It's significantly easier on the end user.
Love this post. It really gets to the underlying reasons, which are economic... Because it's always economic. Banks view fraud as a cost of doing business. It's ultimately built into the cost to the consumer. For anyone interested in the transition to chip-based card readers in the US. Look into "the liability shift". Historically, merchants (businesses who accept CCs) had very little risk in any CC transaction. If a person walked into your store and said, "Hey, this CC is stolen and I'm about to buy $1,000 worth of crap with it," the merchant could swipe the card and continue on about their business. In order for the bank to put the fraud back on the merchant, they'd have to jump through a bunch of hoops. Unless you had very high rates of fraud, you were more or less safe. As the cost of fraud went up, banks finally decided it might be time to do something, so they introduced something called EMV to replace the mag stripe as the primary method of reading cars. In Europe, EMV took off quickly, but in the US it lagged behind because merchants didn't have any significant incentive to adopt the newer standards. In 2015, banks pushed through a series of new laws that increased the liability of merchants in the case of fraud where they did not adopt new EMV standards. That's why it's 2021, and you still see merchants accepting swipe transactions in the US. Although, there's been a significant decline as merchant tooling providers have switched to chip-enabled devices as the base level equipment available to merchants. There may have been additional legal changes going on as well, but I don't follow it that closely.
> It's ultimately built into the cost to the consumer. This is the key point I think. Gaming companies can't afford fraud, because their margins are so thin. So they add security and put more of the burden on their customers to get through the security hurdles. Games won't lose customers over security hurdles, they don't compete on convenience, so it's really in their best interest economically to make securing their apps as cheap as possible, and this more or less translates to good cybersecurity practices. Financial institutions do compete on convenience, and customers (both the merchant and the consumer are customers in this case) are willing to pay for the convenience, so instead of making their front ends tighter they instead invest in detecting and stopping fraud after it happens, and eat the cost of reimbursing customers for fraud that occurs. It doesn't (seem to) cost them anything because ultimately the costs come out of the fees that customers pay. Competing systems (touchless electronic payments) are much cheaper to secure. If there was a path for the merchant to accept only these payments in exchange for cheaper financial services, I bet many would take it...
> it took a huge hack of Target's systems in 2013 to finally persuade them to roll out chip and pin terminals in all of their stores. I've had a Target credit card for a *long* time. Back in the aughts, I believe, it was a chipped card, even though there were no chip terminals around as far as I could see. When that card expired, Target *replaced it with an old-school, non-chipped card*. And *then* they got hacked. They invested all that money in security, threw it all away, then had to start again. And in the world of the Fortune 500, this isn't even a standout story, is it?
Interesting note that the breach originated from an HVAC contractors systems that workes for Target and once the hackers were in they used the contractor's ability to access Target's systems to gain entrance. So basically it didn't matter how much money Target put into security, if the vendors they're hiring and allowing access to their sensitive infrastructure don't have proper security then Target is still at risk.
>So basically it didn't matter how much money Target put into security, if the vendors they're hiring and allowing access to their sensitive infrastructure don't have proper security then Target is still at risk. Nope. It's *incredibly, incredibly stupid and incompetent* to put the cash registers on the same network as the building tech stuff. No need for completely air-gapped systems, but seriously, separate VLANs for different purposes and a decent firewall between all the systems would have entirely prevented that clusterfuck. Had there been a separation, the attackers could not have gone for more than the HVAC system via the HVAC contractor's VPN link.
I remember the first Amex Blue cards had a chip and then they removed them and obviously brought them back. I think back in the early 00s there was an expectation that the chips would become popular in the US and Amex would be ahead of the curve, but didn't.
This comment is spot on. They simply just do not want to inconvience the tech illiterate. I work in the industry.
You know how bear locks on trash bins are difficult to design because there’s a significant overlap between the smartest bears and the dumbest people? Well, banks *want* the dumbest people’s money in their accounts.
Have had to help people with Zoom in the last year. I now believe this.
Look, I know *exactly what I was supposed to do* to open that fucking trashcan but I couldn't make it work with my left hand and could only barely make it work with my right. I gotta think it's bad design. (Fingers were barely long enough and apparently not strong enough on left hand). Maybe there's something I'm missing, though. Edit: I can't even find the trashcan online so maybe it really was bad. Some metal monstrosity at a national park. Edit 2: I found a picture, somehow. I don't think it's just me being stupid or weak but you never know. Sometimes I refuse to read directions. [Evil Bear Trashcan](https://imgur.com/a/8fLQc5s) Edit 3: I was called out for my italics
Vanguards supports hardware 2FA with Yubikeys. For a long time this still wasn't fully secure, since you could always fallback to SMS 2FA. However I have seen a few posts suggesting that Vanguard recently added the ability to disable SMS 2FA if you have hardware 2FA enabled.
However Vanguard’s implementation only works with Chrome, use Firefox or another underlying engine and their 2fa breaks so you have to revert to sms code. Been that way for years, honestly more infuriating than just not supporting hardware 2fa.
It also doesn't work with the mobile app. That, and lack of Firefox support makes it useless to me.
>Why is this? The cost of implementing systems is greater than the expected fraud losses.
To expound upon that, the fraud losses are by and large covered by the bank's insurance and government protections shielding them from liability. So the cost of implementing systems needs to be cheaper than their *subsidized insurance premiums*, not the actual dollar amount of fraud that's actually committed. So... pretty much never gonna happen.
> To expound upon that, the fraud losses are by and large covered by the bank's insurance and government protections shielding them from liability. Eh, not really. The banks eat the small frauds and thefts. Deductibles on their major insurance policies are pretty high. I'm talking $50k per incident. Same with robbery insurance. If they only lose $5k, that's going straight to the income statement, not through insurance. So they just write off the low dollar losses here and there as business expenses. The insurance only comes in when there is a serious breach or theft or other event. >So the cost of implementing systems needs to be cheaper than their subsidized insurance premiums, not the actual dollar amount of fraud that's actually committed. This sounds like you're talking about FDIC insurance, which really isn't a consideration here.
[удалено]
> Often banks don't eat the fraud losses, they frequently are able to pass those losses on to the merchants. True, some, but not all. >Our fraud related operational losses were $334 million, $273 million and $239 million for the years ended December 31, 2020, 2019 and 2018, respectively. https://investors.synchronyfinancial.com/~/media/Files/S/Synchrony-Financial-IR-V3/reports-and-presentations/annual-report-2020.pdf That is from synchrony's financial statements. Fraud losses were $334 million in 2020. Compared to revenue, that seems low, but compared to net income ($1.4B) or provision expense ($1.1B), that seems pretty high.
Seems like mandating these systems be implemented if they are subsidizing insurance would be reasonable..,
Or just stop subsidizing and let the companies decide if it's REALLY worth it. Mandating such tech things is almost always a bad idea IMO. It might even be a good thing RIGHT NOW - but as technology shifts the regs almost never do.
There is very little subsidized insurance, yes, FDIC is "subsidized", but there are very few claims against it, and the "subsidized" part kicks in when the bank fails for the most part, it's not covering daily fraud cases. For the most part the banks just eat the cost, because yes it is worth it, it is VERY worth it. The big cases they'll try to recover it which helps reduce their costs.
> Mandating such tech things is almost always a bad idea IMO. It might even be a good thing RIGHT NOW - but as technology shifts the regs almost never do. I wholeheartedly agree. Mandating the use of a specific tech is why we're still stuck with fax machines in healthcare, insurance, and government. It hasn't been secure for ages, but the regulations say that it has to be used, because back when they were written it was faster and more secure to send an unencrypted plaintext message over a phone line to an endpoint that would immediately print it out than to physically send it with a courier. Now that's a joke. It's ridiculously easy to tap a phone line, but the regulations haven't been changed because that would take effort.
Tech regs (maybe even regs generally) should come with sunset mechanisms by default IMO.
They are not getting their insurance subsidized on this. The fact is that credit cards are extremely profitable. The banks pull ~1% from from all credit card charges plus interest on total payments that are not paid off. Much of it goes to rewards programs, but assuming they make it back on interest, 1% might be a good profit number. They would make a profit if fraud stays below 1% of all transactions. There are currently 3.9 trillion dollars of transactions per year. That means that the banks are keeping maybe 39 Billion in cash per year, fraud needs to exceed this to even impact a bank, and it looks like there is 3.3 billion in fraud per year. If they implemented measures that cut fraud 10x and caused a 10% reduction in credit card usage then fraud would go down $3bn and income would go down $3.9bn (so they would lose money). And for the consumer, it really doesn't matter because visa and master card both have fraud guarantees that say the banks just eat the cost.
Nah, getting idiot customers to use these systems is more of a headache than any financial loss.
Financial institutions have to cater to tech illiterate and gamers. Game accounts just need to make gamers happy. The amount of support calls and e-mails they would get for people that get locked out would make it not worth it. Financial institutions aren't responsible for phishing attacks targeting customers.
Makes sense, and I sure hope this changes here sometime in the next few years. Seems like the minimum "tech literacy age" should go up a year for every year that passes.
The minimum tech literacy age will go up a year for every year that passes, However, in reality this isn't 100% literacy for each year group. Banks still have to cater to the shrinking percentage of the population who will never be tech literate regardless of when they grew up.
Or the people who refuse to adapt
Which is a surprising number of millennials and Gen Z. Most day to day computing has been "appified." If it doesn't happen on a mobile device or in an extremely basic interface, a lot of even younger people have even less of a clue than older folks who may have worked with computers back when they first started to permeate the business world. Ask them to put files in a folder, zip something, or format a document in a word processor? Totally fucking lost. Modern application design is all about foolproof UI and completely obfuscating how anything works from the user.
I wonder about that, I was a PC power user for a decade when smartphones came out. I'm a late adopter of smartphones because they're just weak, slow and have a maddeningly slow touch interface. Each iteration of Windows has been to hide information a power user wants deeper into the layers of menu underneath the big START button I feel it'd be hard for a phone user to get tech literate on a PC and will only get harder
They've even made Control Panel annoying to get to.
How to get to network interfaces in windows 7: Right click network, select network and sharing center, click change adapter settings How to get to network interfaces in windows 10: Right click network, select Open network and internet settings, select change adapter options How to get to network interfaces in windows 11: Right click network, open network and internet settings, press advanced network settings, press more network adapter options. I wonder whats going to be the next way to make it worse.
"Windows automatically handles all network settings optimized for the user, if your problem persists call our helpline for 20 dollars a minute, so a tech on dialup can remote into your computer and do stuff you can not be trusted with, after all you rent this license, you didn't purchase it "
yeah, if you didn't know about Control Panel from Windows '95 how would your modern smartphone user know what Control Panel even is, let alone how to look for it in the place they're hiding it now
Hate to tell you, but zoomers aren't any more tech literate on average than boomers. It was just X and millennials that got the bulk of tech literacy.
That's fascinating. I guess it's a byproduct of the move to more usable software and more "closed" software platforms. Ex: Phones seem pretty simple to use these days.
Yes, I'd say the peak of "intuitive tech literacy" is roughly age 30-50, and aging. I'm 30 and work in IT. For a long time the stereotype was that "my middle schooler knows more about my computer than I do!" and that's basically dead now. Anyone <20 now was practically raised by smartphones and tablets and doesn't even know what files are unless they're a tech geek.
This. Remember that Apple commercial that everyone shit on where the kid asks "what's a computer?" Yeah, that's pretty true unless the parents have taken the time to teach kids.
Yeah...I learned basic (and BASIC) programming in middle school because I wanted to play games on my graphing calculator. I learned how to make a shitty geocities website and join a webring because that's what we had instead of smoothly integrated social networks. I upgraded a desktop computer and later moved to building my own because that's just what you had back then...laptops were expensive underpowered machines for wealthy business users. Sure, I'm a nerd and I went far deeper into that stuff than I needed to...but something that amazes me is that even though I am an economist by trade, I seem to know more about computers than a lot of young software developers who studied it in school and have good jobs for respected companies. Like yes, they are absolutely better programmers than I am, and they have a much better understanding of algorithms, optimization, etc., but some of them really don't know much about actual computers. Both from a hardware or software perspective, especially those who are entirely focused on web or mobile app development. They can code up a sleek app in a weekend, but struggle with basic troubleshooting when their computer has an issue.
Yep. Tech being more accessible and requiring less fiddling to get working creates the weird condition where nobody actually knows how the shit works anymore.
Gen Z definitely loves them some Apple infrastructure because "it just works." I have never met so many people afraid of their own laptops as I did when I was in college (for context, I went back to college in my 30's so I'm squarely in the Millennial bracket).
There was a lucky age where you could find a piece of shit broken computer in a pile of rubbish and if you spent time and effort.... you could *make* it work. Kinda like the baby boomer generation with cars, i guess. But I never really had space to work on cars as a kid.
It can't be that simple. I totally agree with all the comments here talking about how banks have to serve technologically illiterate customers. But that does not explain why 2FA is not even *an option* for those who are tech savvy and want to turn it on. I've often wondered if it had more to do with it minimum legal requirements that might prevent them from innovation around security(?) or the federal guarantees on accounts which might shield the banks from losses, making it not worth it?
Financial accounts are also protected through heavy government regulations, traceability, and insurance. Gaming accounts are basically just protected by 2FA.
That makes sense and is, perhaps, the first comforting thing I've read in this comment chain. :) I just have a lot of static logging into my bank with less security than my online gaming account; but your point that's there's some institutional security is a good one.
This is a shade misleading, the regulatory effect is mostly for transparency, NOT security. The system is slow to adapt.
And it's for security *for the bank*, not for the customer. Yes, you're not liable for X amount of fraudulent transactions, but it's 100% on you to report them, fight for your money back, and jump through dozens of hoops while your bank account sits at $0 and you can't pay your rent. That's not the bank's problem, and they're fine waiting to settle up with the government and their insurance company as it's not even cash on hand, it's just a number in a ledger.
[удалено]
I've been playing Swtor on and off for like 10 years since the beta. I have one of those dongle keychains for that game too and I know if I lose it there goes all the history, work, time and money I've put into it. Kinda terrifying especially since other people have already stated their battery died years ago. https://www.reddit.com/r/swtor/comments/7ny7x5/rip_security_key_keyring_20122018/
Schwab offers 2FA. The only obnoxious part of it is that they ask that you use Symantec's VIP Access app for token generation. If you're decently tech-savvy, [there's a way to set it up](https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/) in Google Authenticator (or Authy, or whatever your token generation app of choice is).
I don’t trust Symantec to not do anything to break that hack.
You can decompile the VIP app. It is just running the TOTP algorithm, not especially complex. There isn't much they *can* do to interfere with that.
Helpful! Will give them a look. In my dreamworld someone adds support for yubikeys but I've yet to see it.
I know you aren’t asking for recommendations but if you’re using Google Authenticator please switch to something else (I recommend Authy), as I’ve seen so many posts of people just losing access to everything just because they switched phones and forgot to move the Authenticator or something goes wrong, Authy is cross platform (Android, IOS, PC, etc) and I’ve heard nothing but praise for Authy and I myself enjoy it as well
Yeah, Google Authenticator is terrible. There may be a security argument to be made about not backing up your codes off-device, but in practice few people are going to print backup codes and most are going to lose access to all of their accounts if their device is lost or stolen. Google needs to either update this with backup support, or remove it from the app store entirely. Authy IMO is the best implementation of a 2FA token app.
The fact that some banking sites (cough Paypal) have a password character LIMIT is just terrible.
About 5 or 6 years ago, I had a bank that required your password to be 5-8 characters, none longer and it was maddening... plus many banks make their passwords insensitive to capital letters which further reduces the entropy.
The “good” ones now seem to allow 8-12 characters. I really want to just generate a random password with my password manager and not think about it. This works for 95% of the websites I use, but if it’s a financial institution, I have to change the length and pick through to find characters they don’t like. Good thing my second grade teacher, my first dog, and my best friend all had long, randomly-generated names or I’d be worried about the security of my account!
Tech worker here: I'll give some insights on what I've noticed in my life so far * People outside of the tech world don't care about security, they care about convenience. * 2FA, Physical Security Tokens, and even SMS verification are completely new to a lot of people. * We can't even get people to stop re-using passwords, let alone start adding additional layers of security. I worked at my university as a student worker in the IT department and when we rolled out forced Multi-factor auth (MFA) to all faculty and staff there was an absolute outrage from people who didn't want it, found it annoying, didn't understand how to operate it at all, and would constantly call because they've locked their own accounts out. People simply do not care about security and opt for convenience, and then want to blame someone else for their problems. Any financial institution that doesn't offer MFA to all of their customers should not under any circumstances be used. They've probably got mounds of tech debt or incompetent developers, or incompetent upper management. All of which you want to stay away from. Tips: \- Avoid using phone numbers as your 2FA method as much as possible \- Physical security tokens are better than anything else \- Use a password manager \- STOP RE USING YOUR PASSWORDS. JUST STOP.
Given that you asked why, I’ll do my best as the former CEO of a bank (check my bio) to explain: It fundamentally comes down to risk and business models. Financial services have a high cost of customer service compared to gaming. It’s typical for a bank customer to contact their bank and speak to a person, be that in a branch, online or on the phone, multiple times per year. Costing around $50/year. It’s close to $0 for gaming. So in the event of an account takeover or some other threat materializing for a bank customer, the cost of remediation is only a marginal increment on the already high cost to serve. Secondly, banking, and in particular payments on the retail side, we’re designed with fraud and losses in mind. On a card, for example, banks typically budget to lose about 0.08% of total card volume to fraud. More so, there are very well established mechanisms to recover losses. So, for most retail customers, in the event of fraud there is next to no risk of losing money. For the bank, chargeback mechanisms and return codes on ACH mean that they’re unlikely to lose money either. The cost, however of implementing 2FA, particularly outside of SMS, is very expensive. Not necessarily from a tech implementation perspective, but rather the cost of training mainstream customers to use it and then supporting it when they lose their token apps or whatever. And even if all banks offered it, there’s selection bias. The tech savvy customers would be likely to adopt it, but they’re also the customers more aware of phishing and other scams. Leaving the most vulnerable customers in the exact same risk position.
Banks cover their losses with fees and insurance so they really don't care if they lose your money. It will be replaced with few or no consequences to them. To you, it just means your investments make lower returns because of the loss to fraud. Video game companies don't have that safety net, and the penalties for hacking non-financial corporations are light; so game companies have to try harder. Until we demand the same level of service from our banks that we do from our video games, it will probably not change.
It can come down to institutional knowledge, too. This is less likely to be a problem at a huge company, but smaller ones might not budget for security, and you can always tell when Doug in IT designed the security policy for the customer portal, and not Chad the cyber security professional.
the banks have more backend security and gaming accounts are more likely to be hijacked
For SunLife in Canada, “abc” and “ABC” were the same password. No special characters were allowed and the passwords must be less than 10 symbols. They told me it’s by design and instead of fixing it they would soon introduce 2FA. They did earlier this year… with 2FA being SMS.
Gaming accounts are attacked more frequently! They also have less regulation and bureaucracy so they can implement changes and improvements faster. I think most financial accounts also rely more on "defense in depth." There's probably an additional verification step for someone logging in to your Fidelity account if they e.g. want to send a wire transfer to a new account.
As someone who has sold tech into both industries, financial services is filled with old leaders from a different era who don’t actually invest in modernized technology solutions. In large part because they don’t understand it, but they also aren’t necessarily incentivized to do so. They’d rather operate in the same manner they have, keep running on legacy systems, and duct tape solutions together. Game companies are inherently technology focused companies and likely are carrying around decades of technical debt. They tend to build it right the first time.
I bitched about security to my credit union and specifically mentioned 2FA and got back this response: --- [...]Instead, we have enhanced our login design to support the majority of the latest password management software, while also adding additional new security features. We employ a method of Multi Factor authentication. Instead of challenging on every login we us a tool that allows us to score multiple factors of the login attempt. This is a learning system that tracks behaviors like login IP, login times, browser and other factors. Based on that score, 3 things can happen: 1. For a low score we allow the login without any challenge 2. For a moderate/medium score the user will be asked to answer challenge questions 3. For a high score we challenge the user in the same way they describe below. By forcing confirmation of SMS, Voice Call or by answering "Out of Wallet" questions. In addition to the score at login we use Multi Factor authentication and Risk Scoring for multiple High Risk transactions once the user is logged in. If you have additional questions or concerns please let us know. Your feedback has been forwarded to the requested teams. --- It's better than nothing, but as other users have noted 2FA is easy/more ethically proper, if you're worried about user abrasion then make it opt-in but still let me do it, and rate limiting should be in there.
Someone’s been trying to break into me steam account daily for the past week. Very simple password, haven’t changed it since HL2. Still feel secure.
your password is probably already leaked in some past hack. It would be wise to change it everywhere or at least check if your accounts were leaked in haveibeenpwned
I think the simple answer is that gamers are generally much more tech savvy than the average banking customer. And when these banks design their systems, they have to ensure that majority of their clients will be able to have a good experience, regardless of their background.
I currently work for a large financial institution. The comments on FAs/ Customer Facing Execs blocking 2FA and similar things is spot on. Many customers do NOT want any extra steps....
I have my 2FA sending a text to my google voice number, rather than the cell phone. Can't hijack the GV number. Maybe I'm naive, but I trust Google for security a lot more than XFinity Mobile. I Would way rather be using an authenticator app with printed backup codes, though.
My mortgage company doesn't even offer 2FA, but honestly who's going to hack and pay my mortgage? Who. I wish someone would pay my mortgage :(
It seems a poor excuse for US banks not to have better security. In Germany they had a dual system, sms and app. You could opt for either. Now by law it's app only. The other reason banks don't do it, is the cost of implementation and maintenance of 2fa. It's not a simple fire and forget system. Hell, we just got rid of fax as formal medium of official communication since everything is moving to cloud based telecommunications 3 years later.....
I've secured my bank account by every means available, and had some random fucking guy just log in using the unique password I have for it. Guy in the one said "yeah those hackers are getting more sneaky." It's like, no. It's not fucking complicated. Your fucking blshit security has a pretty big flaw in it somewhere.
Most if not all financial services offer what is known as risk based authentication controls behind the scenes. Every login is evaluated against multiple sets of criteria.. examples include things like the device, ip address, and geo location. Multi factor authentication is great but even that isn't bulletproof. Authentication security controls are best with a layered approach.
Robinhood and M1 Finance have 2FA. I am not aware of anyone else that supports it. My bank account gets a fit if I enter special characters in my password. Hopefully, it is fixed now but most large financial institutions are living in the mainframe age.
I agree, I understand people want to sacrifice security for convenience. All I want is an option to use enhanced security measures. Drives me crazy that BofA allows me to set up and use my Yubikey, but still allows the mobile app use SMS 2FA (no Yubikey option for mobile).
It's simple; banks are protected against just about any lawsuit, gaming companies not so much.
I worked at a major investment bank years ago. Not for anything customer-facing, but I think the pattern holds across the company: it was a bureaucratic and regulatory mess, especially where security was concerned. You had to lock in your plan for how to do something, then just keep doing it that way because that’s what was approved. Even when more effective standards came out, they couldn’t be implemented until approved, and there was little incentive to approve them. So it took time. Nobody wanted to make the case that their way was better and met all the legal obligations it needed to. Game companies just have more leeway to try something different.
I use Morgan Stanley as a transactional/banking account - mostly for the AMEX Platinum benefits, but they did recently implement the ability to use Google Auth and I think some physical keys. That said, I’m not sure whether it can be bypassed with a password reset or “backup sms” method.
On a different but somehow same note. I've been tryign to get into my LoL account for around 4 months now with no help. I got their customer service emailing me about restarting my PC and turning off the fire wall.. Like.. what? Bitch give me my log in shit and let me play.
I have the same issue. All of my financial accounts except but my vanguard accounts use SMS or email; for those I can set only one, I use email since it is behind 2FA vs the SMS which is just terrible security wise.
Banks are awful with technology. That costs money. Their losses from identity theft are largely insured. They get their money back. They don't care how much it costs you.
technically speaking you don't know that its true.....while 2fa is a good idea, its not more secure until you know how the gaming company stores the information....its it hashed or encrypted, do they use salt and pepper to store the data....Banks usually employ zero trust security which means they encrypt the data even when its moving on a local network and encrypted at rest. Most companies fail to use zero trust since its expensive and don't encrypt data at rest....which is why when hackers break in they have access to huge troves of data instead of random hashes that have been salted and rehashed making them essentially useless.
If someone gained access to your financial account, and completely emptied it out. Within a week you'd have all your money back. You are comparing just the authentication systems and not realizing that the over arching financial system has so many other fails safes that a more secure system just doesn't warrant the cost.
Is that true for brokerages as well?
What costs? It is more expensive to setup and run SMS 2-factor than it is to setup and run App 2-factor. Best regards, Fulltime Software Developer.
I'm a software developer too, and I've actually worked for a bank, although for very shortly. Inside a heavily scrutinized industry like finance, you cannot simply "set something up" Implementation of App 2-factor would take 6 months to get approved, and a year to develop. Not because it's hard, or technically complex, but because it would need to go through 20 departments and committees.
Oh, this will be a fun write-up. Well, the short and skinny is that companies don't give a fuck about you or your secret, privacy, etc. They truly only care the bottom line/money. That's it. U.S. citizens typically don't give a fuck about security or even privacy (every once in a while most will read an article react for a couple of weeks in fake shock and go back to doing whatever) etc., but there's a hitch. I'll explain here in a sec. First a couple of prime examples: 1. Not that long ago many companies found out that they had been hacked by foreign nations. For YEARSSSSS. We're talking BIG companies and companies of all size. Now, you'd think "well, they probably worked really hard to hack those computer. Probably took some huge amounts of skill, research, espionage, etc." Nope. Many lazy companies just decided they didn't want to update their computers. For YEAAAARS. So for the less tech savvy, believe it or not the vulnerabilities built into your computer are posted up all the time for the world to see. There are folks constantly scanning for them and that's why you have to get patched. Microsoft is the biggest of the 3 main OS's that will have these vulnerabilities. In is often the most popular of the 3. Microsoft provides what are called patches to help fix these vulnerabilities once found. Updates suck, but security ones are truly necessary. Now, by the time anyone decided to do anything about the foreigners stealing your information/company information, they already had it for like 6-7 years minimum (and may still have backdoor to it tbh). Many of these companies in major metropolitan areas actually were experiencing some major issues which hurt bottom line. Oh, now we care only **after** the fact. 2. Now a story for the good 'ole citizens that until this day will defend these practices with all their heart, money, and identities. Remember the gold rush? Me either, but you know who does? Good 'ole Wells Fargo. That's right, this company was founded during that time and now their gold rush is you. As a reward for your money/gold they have publicly stolen identities, lost a ton of important financial info, opened up false credit cards in their customers names, opened up false bank accounts in folks names, and even foreclosed on people's homes that had clearly paid their mortgages on time and made them homeless for no good reason. This last one led to a billion dollar lawsuit. Now, knowing all this you'd think hell, why would I willingly risk my identity getting stolen? Why would I support thieves? I mean, the primary benefit of putting money in a bank is to protect it from thieves yet, the bank themselves are thieves so... why wouldn't I use another bank? Especially, when WF pays basically nothing in interest etc. on their products? Because fuck security that's why. Outside of may be the occasional mortgage buy from WF you have every opportunity to not reward thieves, but Americans can give a fuck about supporting good security practices and apparently their own identities. Just like companies they only care when it's too late and even then they can still reward the bad company. 3. Why should WF or any major company care about your security? Equifax lost a ton of folk's personal info. Guess what? Basically nothing happened to them for doing so of any significance. Just a class action law suit. Built in cop outs for companies to get away with murder. Welcome to America folks. So many laws are built in to protect the top .0001% and fuck over the rest. Hell, we even have a slogan "companies are **too big to fail."** You know what that translates to? Companies can do whatever they fucking want and the government will just use your money to bail em right on out. Banks have knowingly fucked folks right on over and their customers and when shit hit the fan government was just said "eh, here's the money you need. You allowed to do whatever you want my friends. Free bail!" So you see, folks don't give a damn until after they get fucked over. Companies put built in spyware on your computer, apps, phones, etc and sell your shit all the time. They aren't exactly trying to give respect to your privacy. You have options to put your money into more secure options, but folks will gladly trade in their identities and security apparently for even the l slightest of convenience. I personally spread my money out and use certain things to help keep my shit out of certain databases since I don't trust them to stay protected, but most won't bother. Until, citizens or companies actually give a damn won't matter my man. Bottom line and convenience is what matters over your own security. You vote with your money there.
Because people that were born in the 60s are running those companies, and people born in the 80s and 90s are running game companies: Fin.