[gtkspert]

You have to think of a Bank's threat model though.

Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier...

Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but not impossible, use a modem or maybe a SMS service.) And requiring a special app is quite difficult to automate.

[sedatk]

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP.

Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but cell operators have workarounds in place for that. It's getting better.

I don't even know how recovery scenarios work for passkeys.

[sir_brickalot]

Counter: Backups for TOTP are easy and you can use multiple devices/services for a single TOTP login.

[kube-system]

Whether it is easy or possible is irrelevant. For the 99.7% of the world that isn't a software developer, the real-world observed use case will predominantly be the least-friction commoditized workflow. People mostly have one phone with one authenticator app, and that's what they'll use.

[TingPing]

You aren’t wrong. It is built in to Googles and Apples though, should be widely used.

[raron]

> Losing TOTP is easy. Lose your phone and it's gone.

That is the main point of it. That's why it is called a second factor.

> It means game over for a regular person.

It just means you have to go to the nearest branch.

[sneak]

Precisely nobody is suggesting that there be no recovery mechanism. This criticism is a red herring.

[sedatk]

What do you think such a recovery mechanism would look like without SMS?

[Uvix]

Syncing the TOTP credentials from a cloud account of some sort (iCloud/Google for the masses, Bitwarden or another password manager for more technical users) to the device.

As a fallback recovery mechanism, offline backup codes generated at the time the TOTP is applied to the account.

[sedatk]

Then you make Google/iCloud the point of entry to someone's bank account. That completely changes the threat model for customers, and possibly for worse than SMS.

Offline backup codes, when printed, isn't such a bad idea. But when you lose that piece of paper, again, game over.

SMS is fantastically resilient to these scenarios. There's a reason banks insist on using it.

[Uvix]

SMS isn't resilient to the worker at the local retail store for the phone carrier giving someone else a SIM for my phone number. That's a much bigger threat vector than Google/iCloud/a sync target I manage storing an encrypted version of the TOTP credentials.

[loeg]

Show up in person with ID.

[kube-system]

That's not necessarily possible. Many banks do not have physical locations, and many people do banking business while physically away from a bank.

https://en.wikipedia.org/wiki/Direct_bank

[loeg]

We're talking about recovery mechanisms, not day to day regular banking interactions. Ultimately, if there isn't a physical branch you can show up to easily, your access recovery time might be pretty inconvenient. This would be a good thing to consider when selecting a bank.

[sedatk]

Yes, but remember, the original scenario was person leaving Canada, and trying to use their Canadian bank account from the US. There is nowhere to show up. But, if they could swallow SMS roaming costs temporarily, they could access to their account easily.

[loeg]

> There is nowhere to show up.

There's Canada. And yes, re-enabling a SIM and paying a handful of roaming SMS charges might easily be more convenient than traveling to Canada.

[mixmastamyk]

MFA is more than 2FA. You'll typically mandate several ways to get in, ahead of time. Whether a third logical device or printing out recovery codes. For something as important as a bank, folks will comply.

[Detrytus]

Password managers, such as KeePassX can generate TOTP codes. And Keepass database is just a file, you can have as many backups of it as you want.

[sedatk]

You overestimate a regular person's technical skills and their capability of planning resilient backup strategies.

[dfxm12]

The banks' real threat model is around what punishments will come from the government. If there's no real regulation with teeth, banks will not care.

[gruez]

The biggest hurdle to money laundering is getting past KYC at the creation stage, which requires you to have stolen identities and/or identity documents, getting past the anti-fraud gauntlet, and probably intercepting any documents/cards that get mailed. Setting up a device farm that can receive SMS OTPs is simple by comparison. All you need as a $60 android phone and an app with SMS access.

[nunez]

There are ways of getting phone numbers that can be used in automation. Then there's SIM cloning, which is apparently very easy to do and very hard to defend against given how often this happens.

[speckx]

I was surprised that Bank of America still does SMS based 2FA.

[dmoy]

BoA is one of the very few US banks that do any modern auth - they support fido2 security keys.

Of course effectively 0% of their customers actually use it, and instead rely on sms

[kccqzy]

Huh I set up SMS 2FA for BofA back in 2016 and I never knew they now support fido2.

[dmoy]

They don't let you get rid of sms fallback, so it's not immune to sim theft

It does help vs phishing though

[charcircuit]

Why would a bank care about money laundering?

[Muromec]

Because the government said so. Why did the government say so -- because the bank is the only place that can see your transactions and has a profile on you and has a dedicated person to call you and ask about that cash withdrawal on the Turkish side of the Syrian border or regular cash deposits of 100k each week in addition to your cop salary.

Alternatively you can just not do anything with money laundering and all that or let the government do the monitoring itself.

[charcircuit]

There is a difference between caring about reducing legal risk and caring about money laundering.

[jszymborski]

HSBC determined its retail banking operations in NA were not worth it any longer due to the liability they faced after their high-profile money laundering scandal [0].

[0] https://www.investopedia.com/stock-analysis/2013/investing-n...

[hiatus]

Because look at what happens when the government thinks you don't care enough about money laundering. TD Bank recently got hit with a $3 billion fine.

> More than 90% of transactions went unmonitored between January 2018 to April 2024, which “enabled three money laundering networks to collectively transfer more than $670 million through TD Bank accounts,” according to a legal filing.

https://edition.cnn.com/2024/10/10/investing/td-bank-settlem...

[rs186]

I think you can easily answer that question yourself by doing a simple search.

[josephthejoe]

It's a long-complicated story but it essentially boils down to this: https://en.wikipedia.org/wiki/Bank_Secrecy_Act

[gruez]

If they're not seen as doing enough, they can be fined by regulators.