5

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep.

I was wondering if this procedure is secure against a malicious agent who can listen to the data being passed. This agent (EVE) would be listening to the call and get the sensitive data.

In Literature i found that GSM stream ciphers such as (A5-1,A5-2) are known to be weak.

Is it safe to send sensitive information such as a bank online account code through a voice call? Why does my bank allow this?

Improve this question

1 Answer 1

Reset to default
8

It sounds like the technology you experienced is a call-agent blocker. These systems are designed to reduce fraud by not giving the call center your information, instead they transfer you to a computer who will process your pin, then if correct, will transfer it back to the calling agent. In this way, the agent can verify your identity without ever hearing your pin, reducing the chance the call center agent might memorize your pin (pen and paper is usually prohibited in a call center). Also, when you type in the code it is not usually recorded by the audio recording in most cases (it is replaced with beeps that repeat until you transfer back to the call center agent)

You are not on an encrypted channel, unless you have a special phone network to call your bank. Therefore, any attack on GSM or the POTS line, the VoIP system at the call center, etc. is not going to be affected. This will protect you from the call center agent committing identity theft, but not any other attacks.

The likelihood of an attacker compromising your line is relatively low, and any electronic fraud can often be reversed. If someone is taping your line, they probably already own you.

If you are describing a different technology, please let me know and I will adjust the answer.

Improve this answer
5
  • thanks for the answer. This call-agent blocker you mentioned makes total sense. But when you say that i'm not on an encrypted channel, i'm not getting it ? Isn't GSM somehow encrypted?
    – danieltorres
    Apr 1, 2013 at 23:07
  • 1
    When I refer to an encrypted channel, I mean from end-to-end, That would means its encrypted on your phone and then decrypted on the receivers phone. Any encryption between you and the tower is fine, but not end-to-end. It's kind of like WPA on WiFi versus HTTPS on your secure web connection. The government can get a warrant and tap your line, and likely so could a phreaker (without a warrant). It's also more likely you'd have malware on your phone recording the call then wasting time trying to MiTM the line.
    – Eric G
    Apr 1, 2013 at 23:10
  • Let's suppose this attacker can't install malware on my phone. This attacker, as you said, a phreaker could be taping my line. This is indeed a possible attack. Why aren't banks worried about this?
    – danieltorres
    Apr 1, 2013 at 23:39
  • Risk management. What is the likelihood and how much of an impact will it have on the bank? Did you give your full account number as well on the line? Even if the attacker gets your account number and pin, how much damage can they do before the bank's fraud systems kick in, and what is the likehlihood they cannot reverse the transactions. If your account was a high risk to the bank, your logon would have 2 factor auth, and they would monitor your account more closely. It's a security threat, but a lower risk that you may perceive.
    – Eric G
    Apr 1, 2013 at 23:48
  • On the other side, it's cheaper for an attacker to go the malware route on your PC or phone. Otherwise, they would have to guess which calls to listen in on, which is a lot more difficult and time consuming. If someone is attacking your phone line, you are likely under a targeted attack - rare from the bank's point of view - and if that attacker wants you, he will be trying multiple methods as well.
    – Eric G
    Apr 1, 2013 at 23:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .