Their policy should just be to reset the password immediately and have the user set a new one. This is one hell of a risk.
I still can’t believe American banks lets you login with just username / password? Surely there is some id check or at least two factors involved?
Nope, several years ago someone complained that their steam account has better protection then their bank account. We're now in 2023 and that statement still holds. It's quite scary really. Bank websites that heavily rely on third party scripts ,"MFA" logins based on something you know and something you know. Account verification question based on code words or security questions based on public information. Worst of all, the ignorance of it all. "We got hacked, here have a identity protection bandage, comes with an automatic subscription after several years".
I wanted to use a 2FA device for my banking accounts and no bank that I have spoken to would allow it. I'd had a breach on one account because my information had been leaked from several different places including the federal government and a credit agency and as a result the person used my leaked information to validate their way into my checking account. At that point they let me set up a pass phrase and a couple of other random safeguards. This was all well and good but it didn't make me feel safer than having that account protected by a physical 2FA device. I was also given more free credit monitoring (which I've gotten like 4 or 5 times in the last 10 years or so). Still bugs me to this day.
Bank of America has two factor and optional 3 three factor integration, what are you talking about?
https://www.eff.org/deeplinks/2016/12/how-enable-two-factor-authentication-bank-america
Bank of America is not one of the banks I talked to because I will never bank with them again. I was 18 and they sent me (unsolicited) a credit card when I opened my first checking account. It had A 35% interest rate.
Commerce, Midwest, citi, and most if not all state banks have 2fa at this point.
2fa with a physical key? Also it's been more than a year since I last checked at all.
Via third party integration yes. Outside of that is user/password then they send a code to your email or phone you enter that and it bumps you to third party if you've requested it.
https://www.bankofamerica.com/security-center/online-mobile-banking-privacy/usb-security-key/
Thank you. I actually really appreciate this information.
No problem.
Iirc any bank that does European transactions is obligated to offer it so they can conduct business with European banks.
35% interest rate
Per year? Rookie numbers, imagine that per month
Here's the silly thing - most other countries have had a form of 2FA for decades. Yes, decades. Some of the earliest ones used to sent you a printed list of codes and asked you a random code from that list. This was before the Internet even when you had to use a modem to dial in to a bank to transmit your transactions.
Yes, they do. Wtf is even happening in this thread.
There are some that do, true, but also a boatload that don't. In my personal experience, most don't.
Most do, unless they're some small town bank. That could be the difference, perhaps.
Most interesting, I checked 2fa.directory and lo and behold, one of them shows that use 2fa! It's the dinky SMS one, but still better then none! Sad part is that a) they never informed me and b) it's completely optional also c) this must be something from the last year or so as I'm one of those people who actively gives feedback
Hey, that's great. I'm glad you looked into it, they really should have let you know.
No wonder all the finance and budget apps primarily prefers integrating with American banks!
Yeah I'm European end my job in accounting makes me have to work with American banks regularly. So let's just say my expectations on American banks are quite low.
I have BofA and my mobile app requires 2fa over SMS.
Alright, SIM swap it is!
They don't, and there is, but you would still suggest removing the user name and password from a social media post anyway. Right?
That would imply they have to test that the credentials are correct though.
Otherwise I can just put somebody's user and put some fake password and they would reset it and disconnect the account of that user and annoy him.
Hot take: let the bank release tweets like this as a honeypot, and see who tries to log in.
That is one way to get their attention
Couldn’t BofA Have deleted the tweet?
I get why you're saying that since it was Xitted at/tagged Bank of America. But it was still a public post from the user's account. That's like assuming a company could delete one of your emails or your Facebook post.
I never used twitter but I guess the best you can do is make it not appear on your wall but the tweet still exists.
Tweets from other people don't ever appear on your wall. They only appear on that user's profile page, or on the home page of users who follow that user. Or, the third way it can show up is attached to another post that replies to it.
So ironically, by replying and telling the user to remove their personal information, BoA has actually ensured more people are able to see that user's personal information.
previous big Twitter user here, technically, as the replies are threaded, this would be under BoFA > Tweets and replies > the reply we see above > this tweet attached.
not literally "on their wall" but still findable without using a search function from the profile.
No, but they could have (and maybe have) block access to their bank account as a precaution.
They also definetely should have advised them to (or just done it themselves) reset their password, because even deleting the tweet isn't nearly enough at that point (as evidenced by the screen grab lol
How to have your account stolen:
The sublemmy for "Old People Facebook" is a curated space showcasing the charming, confusing, and often hilarious social media endeavors of the older generation. From accidental memes and cryptic status updates to endearing attempts at using modern technology, this sublemmy celebrates the unique ways seniors engage with the digital world.
