search

ElectricRCAircraftGuy / bug_reports

Consumer bug reports you and I can report for any product or service we use. Add additional details & screenshots to an Issue here and link to it when submitting help requests through their website.
MIT License
1 stars 0 forks source link

SoFi Security Issue: SoFi may call you and request you give them a 2-factor authentication code when sending wire transfers [potential for total account theft and loss of account!] #15

Open ElectricRCAircraftGuy opened 2 years ago

ElectricRCAircraftGuy commented 2 years ago

I was doing a wire transfer from SoFi to my title company in Oct. 2022 to purchase a house. SoFi blocked the wire transfer for "security concerns". They needed to verify my identity. So, they [SoFi, supposedly] called me (ie: they initiated the call to me, which is also how scammers work). SoFi then initiated a 2 factor authentication to my cell phone (which is also how scammers work when they are illicitly logging into your account). The 2-factor authentication said something to the effect of: "never give this to anyone on any call not initiated by you." Update 1 Aug. 2023: here is exactly what these SoFi security messages say (with the security number changed):

From: SoFi
Reminder: SoFi will never ask for your code on a call not initiated by you
One-Time Code: 999999

Then, the SoFi rep, who initiated the call to me, not me to them, then said, "I need the verification code" (which is what scammers would do to finish illicitly logging into my account). Red flag red flag red flag! This is exactly how social engineering fraud works to get you to give them their 2-factor code. I had no choice because we had no place to live and we were about to lose the house and have to reschedule closing, our movers, cleaners, truck rental, and moving help, so I double-checked the phone number of the person and reluctantly gave the code. It turned out to not be fraud/a scam, and the rep really was with SoFi, but this is dangerous. The SoFi representative and SoFi wire-transfer 2-factor authentication system and process followed the pattern of what a scammer would do to the T!

There are 2 problems here:

  1. SoFi's security practices for verification of wire transfers via 2-factor authentication codes like this, as described above, are downright dangerous and in violation of 2-factor norms, and contradictory to SoFi's statements themselves in the 2-factor messages.
  2. Also, SoFi's general usage of 2-factor authentication codes (I did not describe this above) are non-standard and deviate from best banking practices. The fact that SoFi ever asks for a 2-factor code over the phone, even on calls "initiated by [us]", is also a (slightly lesser) security risk. Typically, 2-factor codes are NEVER legitimately asked for by any human or robot, period, via a phone call, as that is how hackers and hackers alone get them.

The security consultant KnowBe4 (https://www.knowbe4.com/) agrees with me. They have explicit trainings in which they show how hackers get your 2-factor authentication codes by initiating a login which triggers a 2-factor request to you, then they run a hacker demo script, python3 call.py -n "+61401066604" -s google -v female, to call your phone with an automated message saying you might be under a fraud attack, and to press 2 to reject the attack. Once you press 2, it asks you to type in the 2-factor authentication code you got to confirm your identity. This "confirmation of identity" is actually you mistakenly sending your 2 factor authentication code to the hacker, who then uses it to finish logging into your account. SoFi's 2 factor authentication practices are in general, dangerous, and in the case of the wire transfer, downright wrong and risky.

ElectricRCAircraftGuy commented 1 year ago

As of 14 July, the messages now look like this:

From: SoFi
This code should NEVER be shared with anyone including SoFi agents. If anyone asks for this code, HANG UP and call 1 (855) 456-7634.
Login Code: 999999

So, if I am trying to buy a house and get a wire transfer processed out of SoFi and to the title company, so I can get the house keys and conduct my move, this message would make me _even more concerned if a SoFi agent calls and says they won't conduct the wire transfer without me giving them the code. Think about it: this happened to me: in real life, a SoFi agent called me and asked me for this code to verify me so they could verify me so they would sent the wire transfer so I could buy a house to have a roof over my family's head. Imagine the pressure when a a SoFi agent calls me and asks me for the code to verify me as I'm trying to buy a house and get a wire transfer sent, because if I don't give it to them I will have no place to live for my wife and kids and I, and will have to reschedule movers, a moving truck, utilities, walk-through, carpet cleaner, house cleaners, and key-handoff.

I gave the agent my code back in Oct. 2022, and the wire transfer went through fine, and all was well, and it was not fraud, but this is a recipe for disaster when I am caught between a rock and a hard place: give the code and risk fraud, but it's the only way SoFi will let me have the wire transfer and buy the house, or don't give the code, and have a disaster, lost money by many hundreds or thousands of dollars, and no place to live for a week or two extra, with a baby and kids and a job I'm trying to manage.

ElectricRCAircraftGuy commented 1 year ago

As of 4 Aug. 2023, if a SoFi rep. sends you a code (at least from the credit card fraud dept.), it looks like this!:

From: SoFi
Thanks for contacting SoFi, to protect your security please provide this code back to the agent who is assisting you.
One-Time Code: 999999

This is good! It means they have or are fixing it! I was able to reach the same agent twice, before, and directed him to this very issue right here on GitHub. He said he could see it and would relay it on. I'm guessing he did, and that SoFi has responded with this change. I hope that's the case.