Westpac customer service asks for SMS code

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › Westpac customer service asks for SMS code - poor security?

1 | 2 | 3

mudguard

2123 posts

Uber Geek

#3400572 7-Aug-2025 09:45

robocat:

First time they were fixing THEIR cockup where they were charging my father's account every time I chose "savings". Took them over a month to work that one out - when dad saw a bill that he worked out was me. They were just calling to confirm they could transfer $1,612.75 out of my account to pay my Dad back for the erroneous transactions!

Are your accounts tied to your father's somehow? It does odd otherwise.

snj

200 posts

Master Geek

#3400597 7-Aug-2025 11:01

tripper1000:

First you won't get scammed into 2FA'ing your own account for a scammer if you read the SMS message! It isn't just a code, it has some framing and context around it.

As much as I want to agree with you, the fact is there is evidence that this is not true in practice. Examples without even trying:

Also just need to look at how mobile phones handle SMS 2FA codes, my iPhone will recognise that a text I just got was a 2FA code and offer to enter it into a prompt, I can have my phone on Do Not Disturb and not even see the context of the message until the next time I check my notifications manually or go into Messages.

The sad truth is, people are trained to "see code, enter code", without reading the full message, just find the 6 digits and get it over with.

Thats not even getting started on companies doing absolutely silly things when it comes to 2FA-type systems. AMI is a good example, call them "We'd like to verify your identity, we will text you a code and enter it followed by a # key", never mind the fact that they're often sending it to the same phone you're calling from (which makes it laughable to start with), they're normalising giving codes over the phone.

richms

28220 posts

Uber Geek

Trusted

Lifetime subscriber

#3400621 7-Aug-2025 12:20

Also the scammers will create a sense of urgency with people in order to get them to comply. They will not read the full SMS and just see the code and give it away. Scammers will have some believable crap to spin that only has to work a few % of the time

Most people will hear unauthorized transactions and panic about it and stop thinking right. The scammers have their stories worked out really well and to have a bank asking for codes in the same way that scammers do to act as the customer when blocked by 2 factor is negligent and they need to cover the losses because of their crap security.

Richard rich.ms

alasta

6711 posts

Uber Geek

Trusted

Subscriber

#3400685 7-Aug-2025 14:07

It's going to be interesting when people start using the new iOS feature that allows an AI assistant to ask unidentified callers who they are and why they are calling. If my phone rings and Siri tells me it's someone calling from my bank then I would probably reject the call on the assumption that it's a scam.

Realistically the only way for my bank to communicate with me is through the instant messaging feature on their app. If I get a message about something that requires discussion then I'll call them or drop into the branch near work.

I'm surprised that anyone is still using SMS for anything let along 2FA.

robocat

111 posts

Master Geek

#3401021 8-Aug-2025 12:31

Banking Ombudsman update:

They wait for Westpac to go through their customer complaints process first. I'm working through that now and they know I've followed up with the Ombudsman.

If I'm not happy with the resolution, then the ombudsman can't do anything unless Westpac give me a "final position" or I've waited two months. https://bankomb.org.nz/the-complaint-process

The Ombudsman has a separate prevention wing for systemic issues rather than individual complaints.

Any knowledgeable advice on how to escalate to the prevention wing would be welcome (generic advice is less useful).

Any other Westpac customer that wants to also make a similar complaint to the Ombudsman - go ahead.

I don't often deal with lawyers or security consultants but they are not cheap. I'm willing to throw some money at this (like most working age NZers I already pay a few tithes worth of taxes, so a little extra where I'm choosing to tax myself focused directly is okay). I'd be happy for any recommendations for how to do that most effectively.

antant

116 posts

Master Geek

#3401242 9-Aug-2025 14:16

Thought you might find this relevant ... received this email from ANZ yesterday which I think makes it quite clear of their expectations in regards to disclosing codes.

BNZ also has similar advice on their website ...

If Westpac are suggesting you should disclose the codes, that's certainly an outlier.

1 | 2 | 3