\u201cI can assure you that they would not be able to do that with the Bank of America security.\u201d The words of the Bank of America supervisor echoed in our heads as the Bank of America automated phone system revealed our account details over a call we were making via a Caller-ID spoofing website.<\/p>\n
Bank of America is at it again. We really aren\u2019t going out of our way to find issues with Bank of America\u2019s online\u00a0security<\/a>. They just happen to find a way to drop these issues in front of us as we go about our usual business of running Private Internet Access, our\u00a0VPN Service<\/a>.<\/p>\n It\u2019s a hard call but we think the issue we discovered today is significantly worse than the previous one in which a\u00a0random customer\u2019s name and account balance was displayed to us while performing a funds transfer<\/a>.<\/p>\n Social and Phone Number<\/strong><\/p>\n Today\u2019s issue simply requires a Bank of America customer\u2019s SSN and telephone number \u2013 very sensitive information<\/a>. How to get someone\u2019s phone number doesn\u2019t even warrant discussion. Whilst people\u2019s SSNs aren\u2019t usually freely floating around on the internet, there are certain situations where it\u2019s common place to give away this information. For example, employment W-4s and background checks both require a SSN. Imagine an employer that logged into their potential employees\u2019 bank accounts to check their balance before deciding whether to hire them. The IRS W-9 form, which includes your SSN, is required to be filled out and given to any business that pays you more than 600$ per year. This can include relationships such as contracting, consulting, affiliate deals, and advertising, like Amazon Affiliates and Google AdSense. A business which pays many people and\/or companies would likely have both the SSN\u00a0as well as<\/strong>\u00a0phone number for all of the recipients, which is everything that is required to get phone access to their bank account. Even if you\u2019re not in a situation like this, once someone finds a way to get your SSN, getting your phone number is probably trivial.<\/p>\n Bank of America provided little to quell our concerns. \u201cSo, you mean that\u2019s how it\u2019s supposed to work?\u201d\u2026 \u201cYes sir\u201d. While they told us you are<\/em>\u00a0able to change your phone access code to be something different than your SSN, we know the issues with\u00a0opt-out and defaults<\/a>. They also claimed that this would only work when calling from your home phone. We raised the objection that Caller-ID spoofing services were and have been prevalent for years now. \u201cI can assure you that they would not be able to do that with the Bank of America security,\u201d the supervisor responded.<\/p>\n Hearing this, we decided to actually test it out using a well known spoofing website to fake our phone number and call into Bank of America\u2019s automated system. After keying in our SSN, bingo, we were in and had full access to the account information and account transactional history, or in other words, we now had access to a bank statement over the phone.<\/p>\n We\u2019ve provided a recording detailing how easy it was to get into our account and access our account details (we recorded over sensitive information in the call, as well as edited out some superfluous phone menu navigation).\u00a0Maybe it\u2019s time for Bitcoin<\/a> over Bank of America.<\/p>\nBank of America doesn\u2019t care about Privacy it seems<\/h2>\n