My bank support just asked me for my online banking credentials

Question

As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for further improvement of the bot I was talking to) makes it even worse.

For sure, after that, I hung up and I'm pretty sure it is a violation of privacy as you are asked for private details and also it is not encrypted whatsoever.

• Have anyone been asked for this before?
• Is this a normal practice?
• After saying my ID number, the bot refered to me as "Mr. my_last_name" so I guess it is a legit phone number but, could they been hacked and the support number hijacked?
• Should I take any actions?

Answer 1

Assuming that you called them on a published number, I'd say that this sounds like it was an interactive Voice Response (IVR) system, which is pretty common in the banking world.

The concept is that the system takes your authentication information before passing you on to a contact centre agent. The benefit of this from a security perspective is that then the agent in the call centre doesn't have to ask you to authenticate yourself, before discussing your account.

If correctly implemented this should be no more insecure than typing your password into a website. There is an automated system processing the voice data and it should store/log this appropriately.

Of course as you point out there is the risk of phone tapping, but then if you assume that your phone line is tapped, any form of phone banking is insecure as they've got to authenticate you somehow to be able to discuss your account with you.

EDIT: To add some more details, rather than leave them scattered around comments that could get cleared.

Basically banks have to authenticate you somehow, no matter which channel (e.g. web, phone, branch) you use to contact them, and there are trade-offs to be considered.

On the one hand having dedicated credentials per channel is useful in that it reduce the risk of compromise, and avoids muddying the message of "don't tell people your web password" but it leaves users with more credentials to manage and in all likelihood a lot of password resets if users only use a specific channel rarely (with all the vulnerabilities that frequent resets attract)

So the option that it appears, from the information provided, that's used here is to combine the credentials for the web and phone channels, and to use an automated IVR system on the phone channel to avoid credentials being given to contact centre agents. The upside here is single set of creds, so user's won't forget them, and the downside is the scenario we see where bank messaging "don't give people your password" leads to problems in using this system.

In terms of the IVR system security, this is essentially like any other system that processes data. It needs to be secured appropriately so that user credentials are not exposed, no different than the web channel.

Obviously a system like hardware (not SMS) 2FA could work well in this scenario as numeric codes are easily passed to IVR systems, but that has it's own tradeoffs in terms of cost and user experience.

Answer 2

Obligatory warning message:

Don't ever give your password to anyone, and don't let this answer influence this kind of behaviour in any way.

---

Because one can't possibly know all the circumstances in this particular case, a bit of speculation is necessary when giving an answer to this question.

If I understood everything correctly, the case is as follows:

The OP visited the bank's website, looked up the support number and then he/she initiated a call. After giving only his/her banking ID(?) the bot at the end of the line greeted the OP with his/her last name and then asked for the online banking password.

Yes, this could have been a phishing attempt by an attacker. The site you visited could've been altered and another support number could've been set up. After doing all this, the attacker then had to wait until the OP visited the site voluntarily¹ and then call the number. The attacker would've also had to set up a telephone bot which is also able to connect the banking ID to the last name of OP².

This - to me at least - looks like a really big effort to just get the password to an online banking account, which isn't even that valuable when using a typical online banking system. You typically need a second factor to do any kind of transaction of money. It's still a compromising of the bank account, but nothing that can't be fixed.

I highly doubt, that this is a phishing attempt. It just doesn't seem like a good policy to me, especially if it's not clear for users, that their online password is also used for authentication over the phone.

_{(1) In theory an attacker could fake some kind of emergency which would then lead a user to call the support number.}

_{(2) Unless the OP made a mistake and mentioned his/her last name earlier during the call.}

Answer 3

Yes you should take action, report it to your bank, in all likelihood this was a phishing attempt.

This shouldn’t happen and isn’t normal practice.

Your bank will never ask you for your pin number or password.

EDIT: After reading your comments and the clarification (posted after my awnser) that the contact was entirely initiated by you it is possible/probable that this isn't a phishing attempt and is either a very bad policy (as voice id/biometrics should not require a secret password to work) or a request for information supplied to prove identity in this kind of scenario.

Either way I would contact your bank (via some method other than this phone number) and explain your concerns and get clarification from them that this request was legitimate.

Answer 4

I would not trust this bank. Even if this phone call was totally legit to their systems, it just proves that they don't understand the security implications in at least two ways:

1. If your web password is simple enough to be pronounceable to a bot that it could understand it well enough to validate that it is indeed your password, it is not a secure enough password for something as sensitive as bank information. By forcing users to pronounce (or somehow enter it through the keypad, which honestly sounds like absolute hell) their password they are encouraging insecure passwords.

2. From Rory's answer:

If correctly implemented this should be no more insecure than typing your password into a website.

and

In terms of the IVR system security, this is essentially like any other system that processes data. It needs to be secured appropriately so that user credentials are not exposed, no different than the web channel.

Talking on a phone is VERY different from communicating on a web channel. Unless you are using an encrypted phone line from you to the bank, anything transmitted over the line can be eavesdropped. Whereas a properly implemented web login cannot be eavesdropped as it uses end-to-end encryption. In fact in the best implementations, your password is never transmitted in a recoverable form, so even if the bank's web server had been infected, it would not be able to discover your password (it could only verify that you are in possession of the correct password). Here is a discussion on why this hashing technique (in addition to the already encrypted communication channel) would or would not be used: Why is client-side hashing of a password so uncommon?

[T]hey've got to authenticate you somehow to be able to discuss your account with you.

This is true, but using web credentials is not the way to do it. And for the reasons I mentioned above, phone communication has inherent insecurities and I do not do sensitive business over the phone if I can help it.

As with anything, take my advice with a grain of salt. The likelihood of your phone line being tapped by a person or organization who would be interested in using your online password against you is very slim. I leave it to the reader to weigh this risk to the risks of the bank improperly securing other communication channels and to chose what level of risk they are willing to take.

You will never be 100% secure. You can only mitigate risks to an acceptable level.

Answer 5

There are usually different credentials for phone banking and online banking. This avoids most temptations and conflicts of interest since telephone banking can only be initiated through a logged phone operator, and at least my bank quite clearly points out that its online credentials will never get asked or accepted via phone, exactly because of phishing.

If it were completely trivial to distinguish phishing from bonafide stupidity, phishing would be less of a thing. Either way trusting the other side with your online credentials seems like a bad idea.

Answer 6

Disclaimer: never share your login credentials, passwords or PIN numbers in person, over the phone or online. Only use bank passwords on the verified website of the bank, checking your browser's security information (next to the https).

---

I wouldn't call it a "violation of privacy" since theoretically your password (or its hash) is information already shared between you and the bank. Since you were the one calling customer service, it seems you have unearthed either a bug or a security leak in their system.

• I have been asked for parts of my PUK or factory ID from the piece of plastic my SIM card was removed from by a human customer service employee when calling about my mobile phone account. And for a few digits from my account number by a bank employee, when calling the bank, never my password.
• No this is not normal practice, most banks warn you to never even write down your password, not to tell it to anyone and only use it from your computer when logging into the internet banking service over HTTPS.
• It is possible they have been hacked (namely the bot software used at their service center) or alternatively it could be an unplanned security risk/bug in their software. Either way, saying your password over the phone is a security risk in itself, as it is possible you could be overheard, the phone call is being redirected (for instance if your phone was hacked) or someone could be intercepting and listening in on the conversation.
• Contact your bank through another avenue and report the security risk. You can either try to report the bug through the contact/error reporting form on their website or go to your local branch office in person. Another thing to do would be to check the bank website for help pages associated with their phone service. These will usually describe the process required to use their customer service line and if this step (telling the bot your password) is not included, someone has most likely compromised their bot software or it is a phishing attack by someone at their service center, if this step is included it is most likely an overlooked security risk. Either way you should report this, most financial services will take such a complaint very seriously.
• Depending on the result of this complaint you may have to also contact your phone company, because this could be the result of malicious software or a security risk with your provider. To provisionally rule this out, try contacting the banking service with another phone on a different network.

Answer 7

They weren't asking for your online banking password, but your password/passphrase for their phone system. A bank (let alone any company/system) using the same credentials for your online banking and phone banking just does not exist.

-typical "secure" web password:

+o_TH3-m*0N2017! which is then stored in the DB as a hash (e.g. 8dd6ae487b790146f6570cb5b01f7f70224f6706). To authenticate you entered the right pass, the system rehashes your input and if it's a match you're authenticated.

For phone systems, passphrases would be stored as plain text or automated system would require you to use only numbers/letters and state them letter by letter.

Unless you want to fill us in on the bank you're using, you might get more clarity by calling your bank back and asking to speak to a representative?

Finally -- since you called them, a phishing attempt isn't likely

Answer 8

From first sight it looks like a scam, but you have things to do now:

1. When people receive calls like this, it is usually recommended to call the banks central inquiry phone nuber and ask for a real person to receive confirmation if the case is real.

   Since it is very probably a phishing trick, you should report it to them. It helps them to block or find the criminals.

   • You need to provide information about the phone number or e-mail, where it was coming from
   • Provide information about the time of the call and any other suspicious activities with dates.
   • Provide infomation about the information they asked, and if you provided anything to them.

2. Change any datas possible, best with calling the central inquiry line, where you give them a FRESH new email and phone number, where you can communicate securely. Best not to read sms from unknown numbers.

   • Change the user name, password, pin. Limit the amount of credit withdrawable. But honestly, if you were giving them an ID, I would just simply ask for a new account based on security reasons. It depends on your bank, how flexible they are.
   • After your new email is registered, you need to change the password and security questions in your account too. If the account seems to be secure, you can transfer that money to an other one, or best to personally get it paid in cash to you in the bank or transferred to the new account by them. Tell them that you were giving out informations.
   • Do not trust any sites popping up in your (comproised) email/account. Even SSL(secure site) can be fake.

3. Optionally you can contact the police, but it is a waste of time without any specific information.

Some of these might seem overkill and improbable, but I have seen many clever, tricky criminals. Ttey come from Russia or India on a daily basis, where law enforcement will not care about your EU/US authorities.

edit @ questioner comment

You did not seem to specify how it happened. I do not know if it was edited, but as I understood it seemed like they contacted you. If you called the number of the official site (no click on email links), than you did what I said. But:

1. NONE of the companies I knew so far (banks or IT) ask for passwords on phone. As you said, its recorded, unencrypted, and usable without the agreement of the owner. They do not even ask for full ID numbers!
2. On the contrary I know companies, who have to inform you that the call is recorded, and the employee is FORBIDDEN to ask for any password, and they forbid the owner to tell any of those. Not even an automated systems ask for entering full passwords by buttons or saying it into the phone. If this was a real company, I would leave this bank immediately.
3. This exactly looks like a scam. A "real person" is a key point in social engineering. The scammer gains trust by being authentical. These kind of tricks are pulled off on a daily basis. What I described is an official routine of professional companies. I agree, it is a horrible policy if this was a real bank.