Invisible ATM Card skimming
-
@scottalanmiller said:
@Dashrender said:
Instead, I'm simply choosing to live a 'harder' life to try to keep myself a bit more secure.
That you think it makes you more secure is where he is equating it to the head in the sand. Is it more secure? Why is phone access harder to hack? Isn't it easier in most cases? That's normally the fastest path to breaking into someone's account.
You've made your life harder, by a lot, for sure. But the question is, is it to make you more secure?
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
-
@Dashrender said:
I think sticking your head in the sand would be comparable to the people who in the article where warned that the ATM they were about to use was hacked, yet they used it anyhow.
Why? Cars have accidents but we still drive them. Understanding that risks exists is very important. Not panicking and treating them reasonably is a key thing that we do in IT. There are risks everywhere. Some are big, some are small. Knowing what they are and just how risky they are is very important. Extremely important.
There are tradeoffs. And often reacting too much to one threat can create another risk that we overlooked.
Knowing that I can get skimmed by an ATM is very important. Knowing which ATMS to use, where to use them, how to use them, etc. is important. Recognizing that I was skimmed and having my card shut off before it could be used was important. Having the available money in my account low was important. But I would not call that putting my head in the sand. I would call it a reasonable response to a small risk. I'm a high risk traveler and it's still a minor threat for me.
-
@scottalanmiller said:
@Dashrender said:
Before that attempt to access my bank account, I did not have a password requirement on my account. In fact I had called the bank in the past for account information, providing recent payments/deposits as additional proof of ownership, and felt those safeguards where good enough. Up to that point, they appeared to be, and in reality they still were - because the bank denied them access to my information for lack of this information, but it was really no bother to add the additional password for over the phone access.
So it sounds like you have far less security than we do with our online accounts. Why do you feel the extra effort is worth it to be less secure? What's the end goal?
It's all personal stuff, so do what makes you happy. But I think you are imagining a security that you are not achieving.
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
-
@Dashrender said:
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
Honestly, I'd think not having one before that was completely reckless. That's what's odd, to me your system is not very secure but you are going through a lot of pain based on the hope for more security.
-
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
-
@scottalanmiller said:
@Dashrender said:
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
Honestly, I'd think not having one before that was completely reckless. That's what's odd, to me your system is not very secure but you are going through a lot of pain based on the hope for more security.
OK I'll blame that one on my bank (and myself for not correcting it sooner) - as I've never had any bank account I've setup require/request a password for phone access. But then again I opened that account in 1984 as a savings account only, then added services as I got older.
So I assume everyone here has a password/phrase on their accounts for phone access?
-
To me, phone security is like car safety. We all know that airplanes are far safer than cars, but cars feel safer so we often trust them out of an emotional response even when logically we know that they are the most dangerous form of transportation that we can take. People are emotionally terrified of airplanes, no matter how safe they are. They point to rare crashes that make the news as validation for this, but it is purely anecdotal. People die in car crashes constantly to the point that the news does not report them.
Phones are not very secure, they are extremely difficult to make secure. Yes, you can add a password, but online we don't consider just a password to be all that secure, right? And computers cannot be social engineered, but people can. Using the phone to talk to a person is the best way to be exposed.
I don't see you being extra secure here. I only see extra effort. Giving up the luxuries of modern life but not gaining anything. And is there really much to gain?
-
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
-
@scottalanmiller said:
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
I do it with my monthly statements. But really my bank account is used for three things - receiving my paycheck and paying my CC and my mortgage. There is so little traffic on the account as to not make it an issue.
Now my CC - that's a whole different story.
-
@scottalanmiller said:
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
Try calling your bank and see if you can at minimum get information about your account over the phone. If nothing else it would be an interesting test.
-
Another factor that you may not have considered, often banks block phone calls from outside of the country. Sounds good for a security standpoint, but it isn't. For someone attempting to hack an account faking an internal number is trivial. But for you as a customer when traveling outside of the country being blocked from accessing your own account could be a really big deal. You can't check your balance, you can't disable your card, you can't verify an attack, etc.
For me going internationally, giving up online access would be another total degree of risk and exposure.
-
Just so we're on the same page, I couldn't tell you the last time I called the bank for any account information. It's just not something I need, and frankly I could disable it and it would probably be just fine.
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
I do it with my monthly statements. But really my bank account is used for three things - receiving my paycheck and paying my CC and my mortgage. There is so little traffic on the account as to not make it an issue.
Now my CC - that's a whole different story.
So your CC is online, just not the bank?
-
@Dashrender said:
Just so we're on the same page, I couldn't tell you the last time I called the bank for any account information. It's just not something I need, and frankly I could disable it and it would probably be just fine.
How do you verify that there are no malicious transactions? That's why I often log in.
-
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
Try calling your bank and see if you can at minimum get information about your account over the phone. If nothing else it would be an interesting test.
Without basic information, you will not be able to get it from my bank. Same as with yours. My bank will require a few pieces of information about the account and the answer to a security question (one of 3) setup. The security question is the "password" part of the puzzle and is how all banks I have used for a decade or more operate. I would suspect that almost all banks operate this way.
The point is that you did these things and someone still tried. So why make it so hard on yourself when people are still going to try and get into your account?
Make proper use of the technology at hand. Same as with anything else in IT.
-
@scottalanmiller said:
@Dashrender said:
Just so we're on the same page, I couldn't tell you the last time I called the bank for any account information. It's just not something I need, and frankly I could disable it and it would probably be just fine.
How do you verify that there are no malicious transactions? That's why I often log in.
I don't worry about my bank account because I use it so infrequently except as I mentioned to pay the CC and the mortgage. Both of which are done through electronic direct withdrawls. I check my statements monthly when I get my statements from the bank.
As for the CC, living where I do where fraud is pretty darned low - I don't check my CC statements more than monthly, but if I was in your situation, I might be in the habit of checking daily. Not to mention the other safeguards you've put into place (multiple accounts, moving money from one account to another when you need to use the ATM, etc).
-
@Dashrender said:
I don't worry about my bank account because I use it so infrequently except as I mentioned to pay the CC and the mortgage. Both of which are done through electronic direct withdrawls. I check my statements monthly when I get my statements from the bank.
If you don't worry about it, what's causing all of this extra effort?
-
@Dashrender said:
As for the CC, living where I do where fraud is pretty darned low - I don't check my CC statements more than monthly, but if I was in your situation, I might be in the habit of checking daily. Not to mention the other safeguards you've put into place (multiple accounts, moving money from one account to another when you need to use the ATM, etc).
More like once or twice a week, not daily. But "often." If something is awry I want to know quickly. And in reality, the highest risk places are in the US, not abroad (except when I go to Africa.)
-
or everyone could just switch to a system that uses smartphones, a qr code that expires after 45 seconds and your 2 factor authentication on your smartphones banking app.
nothing can be skimmed in the current methods doing this way that I am aware of.
