I was just subjected to the most credible phishing attempt I’ve experienced (twitter.com)

Article summary

The author of the article was subjected to a sophisticated phishing attempt where the scammer posed as a bank representative and used a password reset flow to gain access to the author's account. The scammer was able to read some of the author's transactions, but was unable to transfer money because the author refused to provide their PIN. The author notes that the scam was credible because the scammer had triggered a legitimate password reset flow and had sent a verification code to the author's phone. The author was eventually able to thwart the scam by refusing to provide their PIN and contacting their bank's fraud department.

Main themes

• phishing attempts
• bank security
• two-factor authentication
• password reset flows
• scammer tactics

What commenters say

• Banks should implement more secure password reset flows to prevent scammers from gaining access to accounts.
• The use of SMS-based two-factor authentication is not secure and can be easily intercepted by scammers.
• Some banks have more secure authentication methods, such as hardware tokens or phone apps with push notifications, which can help prevent phishing attempts.
• The onus is on the customer to be vigilant and not fall for phishing attempts, but banks also have a responsibility to implement secure systems to prevent scams.
• The use of physical tokens or hardware devices for authentication can be inconvenient, but may provide an additional layer of security.
• Phone-based 2FA may not be effective if the phone is compromised, and alternative methods such as fingerprint or passcode protection may be necessary.
• Banks may prioritize convenience over security, which can put customers at risk of phishing attempts.
• Customers should be cautious when receiving calls from banks and should not provide sensitive information over the phone without verifying the caller's identity.