Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


freitasm

BDFL - Memuneh
79253 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

#286048 2-Jun-2021 09:19
Send private message

Just received:

 

 

From tomorrow (Thursday 3 June 2021), consumers who switch mobile providers and want to keep their phone number – a process called number porting – will receive a dedicated SMS text message to help prevent fraudsters.

 

The SMS will alert the consumer that their mobile provider has received a request to port their phone number. If they did not request this port, it may be fraudulent and the consumer can then take action to alert their mobile provider and bank.

 

The text message sent will be as follows: 

 

We’re processing a request to move your mobile number to another provider. If you DID NOT request this, please contact your mobile provider and bank IMMEDIATELY as an unauthorised mobile transfer may leave you vulnerable to serious fraud. Do not reply to this text.

 

Number porting fraud is relatively new and uncommon in New Zealand, but when it does happen it can have a devastating impact on the victim. 

 

A fraudster obtains personal information about the victim, such as their name, mobile number and account details, often gained from hacking into an individual's email account. The fraudster then requests to have the victim’s mobile number transferred to the fraudster's SIM card on a new provider. If successful in porting the victim’s number to their own SIM card, the fraudster will receive all the voice calls and text messages intended for the victim.

 

Typically, this occurs after a fraudster has managed to gain access to a customer's bank account – either by hacking or illegally obtaining the customer’s banking password.

 

Armed with this information, the fraudster can then take advantage of a security process called ‘two-factor authentication’ which is where a service, like online banking, uses SMS to send a unique code that the customer needs to provide when logging in or when confirming a banking transaction. This means the fraudster can request a funds transfer from the victim’s bank account and can use the SMS code to confirm the transfer.

 

The dedicated SMS is part of a series of measures the mobile phone industry is implementing to make it much tougher for fraudsters to exploit the number porting system.

 

A more advanced SMS solution is under development and is expected to be rolled out in October 2021. Once implemented, customers who have had a porting request on their account will receive an SMS from their current provider to which they will need to reply ‘YES’ in order for the number porting process to occur.

 

Mobile providers have also tightened up the requirements for customers to verify their identification when requesting a SIM swap – which is the process of moving a number to another SIM card that is with the same provider. Providers that have physical stores now require these customers to present their identification in-store.

 

NZ Telecommunications Forum Communications Director Andrew Pirie commented: “Number porting was put in place in 2007 to make it easy for consumers to retain their existing phone number when changing mobile providers. Consumers have benefitted greatly as it has made it easier for them to switch providers and get better deals. 

 

“However, as an industry we’ve become concerned recently about the potential for fraudsters to exploit the Number Porting process.  With these new security measures, we aim to add another layer of protection for our customers.”

 





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
Linux
11399 posts

Uber Geek

Trusted
Lifetime subscriber

#2717053 2-Jun-2021 09:55
Send private message

Fantastic move!!




CYaBro
4582 posts

Uber Geek

ID Verified
Trusted

  #2717075 2-Jun-2021 10:31
Send private message

Great!
I know someone who had this happen to them a few months ago and had money taken from their bank account.
Luckily the bank has given them the money back.





Opinions are my own and not the views of my employer.


richms
28168 posts

Uber Geek

Trusted
Lifetime subscriber

  #2717077 2-Jun-2021 10:40
Send private message

So the scammers will just start sending these one per hour or some thing before doing the port and the person will get sick of calling the telco after try 2 or 3 and ignore the real one. Not an ideal outcome but this is better than nothing.





Richard rich.ms



alasta
6703 posts

Uber Geek

Trusted
Subscriber

  #2717082 2-Jun-2021 10:53
Send private message

Do banks seriously still use SMS as a means of two factor authentication? 


SpartanVXL
1306 posts

Uber Geek


  #2717227 2-Jun-2021 12:29
Send private message

Between this and the potential to lose access to a number or get it re-used by someone else, phone numbers should be dropped as a 2fac method altogether.

richms
28168 posts

Uber Geek

Trusted
Lifetime subscriber

  #2717233 2-Jun-2021 12:40
Send private message

SpartanVXL: Between this and the potential to lose access to a number or get it re-used by someone else, phone numbers should be dropped as a 2fac method altogether.

 

As any identification at all. Too many places tie things to phone numbers or email addresses as identifying who people are. Its one step off being as bad as a facebook login button for being lazy.





Richard rich.ms

michaelmurfy
meow
13240 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

  #2717240 2-Jun-2021 12:57
Send private message

alasta: Do banks seriously still use SMS as a means of two factor authentication?

 

Yes - the main reason for this (having first-hand experience) is the fact many customers don't have an understanding on how 2FA works and many companies, especially banks, need to make it as seamless as possible for customers. I know this is a poor excuse, but SMS still goes through if the customer is out of credit on their mobile or has no data.

 

It is treated as a "better than nothing" solution for many banks as anything else has actually had a negative user experience for customers who don't have a technical understanding and banks would rather have 2FA via SMS than customers putting 2FA into the too hard basket and not having it enabled at all.

 

But I also know SMS has never been considered secure and many companies, including the one I work for are working on alternatives to make 2FA accessible and secure for all customers. Afraid I can't discuss anything though about this here.





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.


 
 
 

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.
Inphinity
2780 posts

Uber Geek


  #2717241 2-Jun-2021 12:58
Send private message

Yes, but it's ease of adoption means people use it - which is better than nothing at all. The issue is lack of readily useable for the masses standardised alternatives. 


dolsen
1476 posts

Uber Geek

Trusted
Lifetime subscriber

  #2717304 2-Jun-2021 14:07
Send private message

Inphinity:

 

Yes, but it's ease of adoption means people use it - which is better than nothing at all. The issue is lack of readily useable for the masses standardised alternatives. 

 

 

 

 

Google authenticator and Microsoft authenticator are two of the ones that I use which I would assume that a large number of people could access if needed. Is there an apple one also?

 

 


GSManiac
488 posts

Ultimate Geek


  #2717309 2-Jun-2021 14:17
Send private message

I hope Apple come up with their own 2FA app. Currently use the Microsoft one and it’s a pain the a$$. It always deletes all the saved accounts and always states there is no backup to restore from. Even though I set that up. 


freitasm

BDFL - Memuneh
79253 posts

Uber Geek

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #2717311 2-Jun-2021 14:18
Send private message

GSManiac:

 

I hope Apple come up with their own 2FA app. Currently use the Microsoft one and it’s a pain the a$$. It always deletes all the saved accounts and always states there is no backup to restore from. Even though I set that up. 

 

 

I am not sure about your app but I use the Microsoft Authenticator with my Office 365 and Microsoft accounts only. Everything else is on Authy.  





Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSyncBackblaze backup


michaelmurfy
meow
13240 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

  #2717315 2-Jun-2021 14:29
Send private message

dolsen:

 

Inphinity:

 

Yes, but it's ease of adoption means people use it - which is better than nothing at all. The issue is lack of readily useable for the masses standardised alternatives. 

 

 

Google authenticator and Microsoft authenticator are two of the ones that I use which I would assume that a large number of people could access if needed. Is there an apple one also?

 

Again - this is great for those with a knowledge of 2FA but not great for those who don't understand what 2FA is.

 

Apples implementation is great - send a push notification to trusted devices with a code even showing a location where the sign-in is being attempted. This only works with iCloud / Apple Account logins though and not for any third party apps.

 

Even some of my colleagues who have a technical understanding don't know about 2FA. I got them to set 2FA up on one of their accounts and they come to me a couple of days later asking for another QR code (what?!) - I then find out they uninstalled their 2FA app thinking they didn't need it anymore and suddenly now don't have access to the apps they had set up for 2FA.

 

So that is why SMS is still a "better than nothing" approach. Also the reason why many companies like banks have not set up 2FA via the open standards out there is because of the support overhead with supporting such solutions. I'd love to have my bank logins protected by physical 2FA (YubiKey) or 2FA on my phone outside of SMS but I could also imagine people setting this up for themselves "trying it out" and not having an understanding that they then always need the app to login from that point on.

 

This is why alternatives are being tested for such cases.





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.


antonknee
1133 posts

Uber Geek


  #2717321 2-Jun-2021 14:38
Send private message

Really easy to forget we're geeks here. The average bear doesn't know what 2FA is or how to use it, probably doesn't want yet another app on their phone, and would get confused way too easily. Keep in mind also the whingers and moaners about cheques going away - how are the people who can't wrap their head around not being able to write a cheque supposed to wrap their head around 2FA?

 

Seriously - the average person doesn't understand 2FA and they don't want to. We recently rolled out Okta Verify at work which sends a push notification that says "Is this you signing in from Auckland?" and people still don't really understand that - but they definitely understand it more than our previous Symantec 2FA code system (where you'd enter the 6 digit OTP from the app when prompted).

 

BNZ comes the closest to a "good enough" solution IMO where if you login from desktop, their mobile app prompts you to approve or deny the sign in request. Relies on you having the app though, and doesn't protect the app itself. For the record I hate the NetGuard card.


old3eyes
9119 posts

Uber Geek

Subscriber

  #2717326 2-Jun-2021 14:50
Send private message

The ASB has moved to their App for the initial login 2FA  but for some reason still uses  SMS for payments .  I asked them about it  but didn't give a reason . 





Regards,

Old3eyes


SpartanVXL
1306 posts

Uber Geek


  #2717329 2-Jun-2021 14:56
Send private message

Very often the same people who don’t understand 2fac will end up tripping on phone verification too. Same issues with broken/lost/unpaid phone, getting a new number, oops sign-in is tied to old number and no way to recover. Less likely sure, but still similar issues whilst being insecure and other issues pointed out.

Not sure why biometrics haven’t been used as a stopgap, faceid/touchid and equivalents are very commonly used due to ease of use and could be setup by authenticator apps on a existing secure device.

It doesn’t really help in the event you’ve lost all means of recovery though. Services like microsoft and google essentially have ‘Tough luck’ as the end of their recovery solution design for the majority of people who need it the most.

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic





News and reviews »

Air New Zealand Starts AI adoption with OpenAI
Posted 24-Jul-2025 16:00


eero Pro 7 Review
Posted 23-Jul-2025 12:07


BeeStation Plus Review
Posted 21-Jul-2025 14:21


eero Unveils New Wi-Fi 7 Products in New Zealand
Posted 21-Jul-2025 00:01


WiZ Introduces HDMI Sync Box and other Light Devices
Posted 20-Jul-2025 17:32


RedShield Enhances DDoS and Bot Attack Protection
Posted 20-Jul-2025 17:26


Seagate Ships 30TB Drives
Posted 17-Jul-2025 11:24


Oclean AirPump A10 Water Flosser Review
Posted 13-Jul-2025 11:05


Samsung Galaxy Z Fold7: Raising the Bar for Smartphones
Posted 10-Jul-2025 02:01


Samsung Galaxy Z Flip7 Brings New Edge-To-Edge FlexWindow
Posted 10-Jul-2025 02:01


Epson Launches New AM-C550Z WorkForce Enterprise printer
Posted 9-Jul-2025 18:22


Samsung Releases Smart Monitor M9
Posted 9-Jul-2025 17:46


Nearly Half of Older Kiwis Still Write their Passwords on Paper
Posted 9-Jul-2025 08:42


D-Link 4G+ Cat6 Wi-Fi 6 DWR-933M Mobile Hotspot Review
Posted 1-Jul-2025 11:34


Oppo A5 Series Launches With New Levels of Durability
Posted 30-Jun-2025 10:15









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.