[hvindin]

Personally I'd be pretty sure that, at least at the bank I currently work at, this would rarely ever work.

I mean, other than the attempts to foster a relationship between bank staff and the tech people through things like days of letting tech people hang out and try and be helpful at branches in order to "see what real difference they could make" - and that laegely ending up being a fairly regular educational exercise for everyone involved theres two problems I see:

1. All the phone calls into branches are monitored (you may have noticed so many "we will record this call and it may be monitored" messages - they arent kidding) and if certain key words, or even key tones of voice are picked up someone from a relevant team silently dials onto the call to listen in. 2. The general process for anyone not in it interacting with any IT system is to click a button on their screen which generates a 6 digit pin and if you cant match that pin with the person talking to you and dont confirm success then alerts go out immediately.

And given the hit rate on the "generate pin" api, tellers are definitely using it properly.

So i'd be inclined to go pretty small if I where to bet at all.

Not sure why the assumption that you can social engineer your way onto any half way competent institution still persists,but nowadays, as far as I know, you have to pick the really low hanging fruit for someone to let you in so easily.

[btown]

> half way competent institution

At which attackers shift their targets from a bank to a mobile phone provider... :(

[bonestamp2]

Obligatory "SMS 2FA needs to stop" comment. Because it does.