What I would recommend is just reaching out to your banks customer service line and asking their methods for validating identity over the phone. The experience you had does not strike me as strange but I think it was smart of you to end the conversation if you were uncomfortable/unsure. This may be a phone PIN (separate from your debit card pin) or a word or phrase - such as the make and model of your first car (if you've shared this information with them). A lot of banks these days do ask for some sort of secondary authentication when doing business over the phone. I think a lot of people got to the heart of the issue here but I'll chime in. You know why? We're not the first guys and girls that worry about getting scammed. The good thing is, most banks do not let that happen, because a lot of smart people work there, that rack their brain about these things. If an agent working in a call center that handles phone banking wants to scam you, he/she probably can - if there are no security controls in place. Automated systems can be hacked or be exploited, security questions can be recorded etc. Important: Most of the solutions that were mentioned in the comments do not solve this problem. There is a simple solution for that: stop using phone banking. And humans tend to make mistakes and in some case can be criminals. Phone banking is always a tad insecure, because other humans are involved. This is especially true if they don't have any form of 2FA within their systems. Tell them why, maybe they'll do something about it. If this does not fit your threat model, you can always threaten to leave the bank for another company, if they don't change their policy. But this does not mean, that all your funds are gone tomorrow. It is not best practice (from my experience).
This is not the worst thing in the world. If you dont trust a human agent, ask for authentication against an automated system. If there is no information on the interwebz, just call again, wait for another agent and see what kind of credentials he/she wants. Find out, what the bank's typical form of authentication over the phone is. If you are uncomfortable with this, ask for another form of authentication. If a bank uses the same PIN for two different systems, that might be not the best way to do it, but it is a way to do things. So theoretically an adversary has taken a big step towards gaining control of your bank account, when he/she steals one of the latter PINs, but can't really do much, without also having control over whatever supplies your second factor.ĭifferent PINs typically authenticate you against different systems. Be it transferring money, establishing a banker's order or changing your address. If these systems are well designed, you will need a second factor to authorize any changes that are made. Why? Because with PINs for online and phone banking, you access a system to manage your funds. That makes it much more valuable than the other two. BUT some banks do use this PIN for phone banking as well (it was news to me at first too).Ī cardholder PIN is used to directly access your funds (while in possession of your card). Most banks use this PIN only for online banking. What they will do is pretty routine and exactly what you would expect from normal behavior around managing sensitive passwords. Some banks do wonky stuff with your online banking PIN, but most banks don't.
#QUEST FOR INFAMY BANK ATM PIN PASSWORD#
To be frank, your PIN for online banking is pretty much a password for logging into your online banking account. This is the PIN that you use for all your online banking needs. Take a look at these, they will answer most of the surrounding questions you might have. This is a PIN that you can authenticate yourself with over the phone towards an agent or an automated system (see similar questions here, here and especially here). Most banks (that I came across at least) have a separate PIN for phone banking. No serious bank will ever ask you for that number, if somebody does, it's probably a scam.
That is when you are paying for something or withdrawing money. There are a lot of instances whre you will have to give your cardholder PIN to a machine. So this will be pretty routin to nearly all banks.
#QUEST FOR INFAMY BANK ATM PIN HOW TO#
Unsurprisingly, there's also an ISO norm on how to manage PINs like this. This is the PIN that belongs to your debit or credit card.
As there has been some confusion here, I wanted to add another (and hopefully last) answer to consolidate all the information that is flying around.įirst of all, what kind of PINs are there in today's banking world?
0 kommentar(er)
