Yikes 😬
Yikes 😬
49 comments
-
-
Hot take: let the bank release tweets like this as a honeypot, and see who tries to log in.
-
That is one way to get their attention
-
Couldn’t BofA Have deleted the tweet?
-
I get why you're saying that since it was Xitted at/tagged Bank of America. But it was still a public post from the user's account. That's like assuming a company could delete one of your emails or your Facebook post.
-
No, but they could have (and maybe have) block access to their bank account as a precaution.
-
They also definetely should have advised them to (or just done it themselves) reset their password, because even deleting the tweet isn't nearly enough at that point (as evidenced by the screen grab lol
-
-
-
How to have your account stolen:
49 comments
Their policy should just be to reset the password immediately and have the user set a new one. This is one hell of a risk.
I still can’t believe American banks lets you login with just username / password? Surely there is some id check or at least two factors involved?
Nope, several years ago someone complained that their steam account has better protection then their bank account. We're now in 2023 and that statement still holds. It's quite scary really. Bank websites that heavily rely on third party scripts ,"MFA" logins based on something you know and something you know. Account verification question based on code words or security questions based on public information. Worst of all, the ignorance of it all. "We got hacked, here have a identity protection bandage, comes with an automatic subscription after several years".
Yeah I'm European end my job in accounting makes me have to work with American banks regularly. So let's just say my expectations on American banks are quite low.
I have BofA and my mobile app requires 2fa over SMS.
They don't, and there is, but you would still suggest removing the user name and password from a social media post anyway. Right?
That would imply they have to test that the credentials are correct though.
Otherwise I can just put somebody's user and put some fake password and they would reset it and disconnect the account of that user and annoy him.