From Facebook account takeover to an empty bank account

[AdmiralAsshat]

As an aside, it drives me up the wall that Facebook's 2FA settings are stuck on SMS. Although other options exist like a Yubikey or a TOTP scheme, even if you select one of those, Facebook still sends you a 2FA SMS whenever you try to login.

At this point I ignore it and use my TOTP app anyway, but it bothers me to no end, as it leaves my account that much more vulnerable to a hacker intercepting the SMS in transit and using it to break into my Facebook account. Facebook does not allow you to disable 2FA SMS without disabling 2FA altogether.

[efrafa]

Are you sure about it? I use 2FA with authy and never got sms.

[minxomat]

Facebook has a code generator in their app. 2fa does not require SMS

[jwilk]

> (to avoid the bank calling and asking “are you sure you want to speculate with cryptocurrency today”)

Huh? Do banks actually do that?

[milkytron]

I've done development on these types of systems. I can't go into too much detail for obvious reasons, but your answer is yes. When the details of a transaction seem to be unusual or have an association with high risk or fraud, you'll get an email, sometimes a call, sometimes they'll immediately freeze your account.

It's a security measure to protect both the bank and the customer.

[michaelt]

I gather some banks have fraud detection systems that will flag suspicious transactions, triggering a phone call to the customer.

While I haven't experienced that personally, a friend reported getting such a call from his bank after he ordered $400 of fireworks online.

Unfortunately it's all pretty opaque and bank dependent - as far as I know, there's no way a merchant can trigger such a call, for example.

[laken]

I've gotten a text from my bank after my first Bitcoin purchase on a newly issued debit card, with it saying that the transaction was flagged as suspicious and I needed to verify that I was actually the one who purchased it.

[matwood]

Not in those words obviously, but yes I have had numerous calls from credit card issuers during or after a large transaction. ATM cards or bank credit cards are usually tied to a bigger card issuer. These issuers have a lot of fraud prevention systems in place.

[saghm]

Not a phone call, but a couple of years ago I woke up to a text and a push notification from my bank (correctly) informing me that someone had used my account to pay for a hotel room and some other stuff and that they froze my account. I'm not sure if the person making fraudulent charges ever got caught, but they refunded me the money and issued me a new card, so it ended up only costing me the hour or so I had to spend at the bank that morning sorting everything out.

[iandioch]

My bank only yesterday froze my card because it is being used in a different country and they suspect fraud.

[bitwize]

One time I flew to Texas and bought a camera. It wouldn't go through, I got a text alert from my bank, and I had to make the poor saleslady wait while I called the bank and walked their phone rep saying that yes, this is me, the owner of thr account and I want this camera.

[NicoJuicy]

I had it when I paid by supplier in China 8 k. Visa called my bank, my bank called me

[protomyth]

My bank (well a credit union) called and asked if I really wanted to buy 4 tires. Since I was having a bit of an issue paying it without the money in my checking account, I said yes. It surprised the heck out of me too.

[mamon]

The scheme is very elaborate, multi-step process so the risk is quite low. Once in motion it is nearly impossible to prevent by a bank, but it would be trivially preventable by Facebook, if they just bothered to check the url and warn if they find them suspicious.

EDIT:

BTW this shows that sites like Let's Encrypt, which automatically issue certificates to websites kind of defeat the whole purpose of certificates - they only check that the site exists and requestor has admin access to it, but do nothing to check whether it is legitimate business or scam.

A green padlock in the address bar should mean that the site is trustworthy. Now it only means that site admin knows how to setup https.

[andrewflnr]

Trustworthiness of the organization behind a site is only half the story behind TLS, if that. The most important benefit IMO of secure connections is that some unknown-unknown party can't MitM your connection and read your data or inject malicious code. Trust in the intended participants in the conversation is really a different problem.

The problem with your scenario where https===trustworthy is that it doesn't leave any middle ground for a site to simply protect its and your information. It's either full bank-site security, or none at all. That's not acceptable.

[benchaney]

> A green padlock in the address bar should mean that the site is trustworthy. Now it only means that site admin knows how to setup https.

The green padlock means that you have a secure connection to the site you have selected to visit. We should not attempt to ascribe any other meaning to it.

[closeparen]

You are deeply mistaken on the purpose of certificates. They say that the holder of the corresponding private key is who they are say they are. DV checks the DNS name, EV checks the DNS name and the presence of a business registration with the relevant authority.

The purpose of certificates has never been a "not a scam" stamp, and no traditional certificate vendor was ever checking your business practices or legitimacy. Issuance of DV certs is just as automated at Verisign, etc.

[zeta0134]

Sure, in theory, but how do you solve a problem like this in practice? What is it about a given URL that makes it suspicious?

Is there a whitelist? Because then the press and the rest of the internet will cry censorship and stifling of innovation.

Is there an algorithm? Then the scammers simply learn how to game the algorithm and defeat it easily. (This applies to some easy checks like domain registration date too.)

Is it a team of humans? That's a lot of sites and a lot of humans to employ. What about user-reports? Now you have to deal with false reporting and abuse.

While it's possible for some combination of approaches to succeed here, it's not nearly trivial.

[cm2187]

The padlock (even an EV padlock) doesn't (and cannot) claim that the website is honest. It claims the website is who it says it is and that no one can intercept the communications between you two.

[kahnpro]

It sounds like you fundamentally misunderstood what HTTPS certificates are for, because they absolutely do not reflect trustworthiness or "not a scam".

[erpellan]

This problem was solved in 1999 with client-side certificates. Your browser would simply refuse to log you into the fake bank site.