Gert van Dijk

My bank has an option to start a regular call from their mobile app (logged in state) which they say is an "authenticated call". I will not have to provide any details on the phone with the service agent anymore.
The button opens my regular Google Phone dialer app.

HOW does that work? I mean, it's just my dialer calling a landline number. Can you send (hidden) metadata through the dialer app on a plain cell phone call? 🤔

Feb 16, 2024 at 11:16amElk
Show threadGert van DijkFeb 16, 2024

I *really* hope it's not just through the insecure caller ID here 😬

I had to confirm some action (change to the service plan) from within their app, which went pretty smooth. A good experience overall for the user. I just feel like it's vulnerable to social engineering on the bank side if this "authenticated call" would be just caller ID based.

Show threadlukasadrFeb 16, 2024

@gertvdijk Maybe the ID is signed through STIR/SHAKEN?

https://www.fcc.gov/call-authentication

Combating Spoofed Robocalls with Caller ID Authentication

Caller ID authorization is a new system aimed at combating illegal caller ID spoofing. Such a system is critical to protecting Americans from scam spoofed robocalls and would erode the ability of callers to illegally spoof a caller ID, which scam artists use to trick Americans into answering their phones when they shouldn't. Industry stakeholders are working to implement caller ID authentication, which is sometimes called STIR/SHAKEN.

Show threadGert van DijkFeb 16, 2024
@lukasadr I didn't know about that, but no. It's almost non-existent in production 😅
https://en.wikipedia.org/wiki/STIR/SHAKEN
STIR/SHAKEN - Wikipedia

Show thread📡 Daan Berg 🏍️Feb 16, 2024

@gertvdijk

(edit 13:14: @towo had the actual answer -- https://mastodon.social/@gertvdijk/111941100769929578)

My best guess would be that it sends a flag to the customer service script software (e.g. Oracle Service Cloud or equivalent) indicating that the user has announced that they're going to call.

Then when the caller ID pops up the agent can see that whoever has access to the bank app 'requested' the call.

Show threadGert van DijkFeb 16, 2024
@db Could be, which is not so secure! I should have tried this with a different phone number / caller ID actually. 😅
Show threadtowoFeb 16, 2024
@gertvdijk @db Might want to check if the landline number changes when you try to call at another time
Show threadbert hubert 🇺🇦🇪🇺🇺🇦Feb 16, 2024
@towo @gertvdijk @db I think this is how it works.
Show threadGert van DijkFeb 16, 2024
@towo @db Oh yes, spot on. 😃 Didn't notice this. It seems the last 4 digits are different in subsequent calls.
Show threadlukasadrFeb 17, 2024
@gertvdijk @towo @db Which also is rather insecure if the "password" to an account is just a 4 digit combination. If you guess a correct 4 digit code you can make transfers and things like that. @schiermi's idea is much more secure with a time limit and a ___ digit code. 🤷‍♂️
Show threadEdwin GroothuisFeb 16, 2024
@gertvdijk @jpmens time to sniff your network when you press that button!
Show threadschiermiFeb 17, 2024
@gertvdijk Barclays Card triggers the dialer with their usual customer service number followed by pause characters (,), followed by some fixed nummeric prefix, followed by a random number. You can call their customer service on a random/different phone and manually enter the prefix and random number at their voice prompt and you're placed (pre-identified in their waiting queue; the agent later already knows your name and account). If you alter the random number or wait a few minutes between triggering the call where the random number for their voice prompt is generated and placing the call the voice menu ignores your entries and behaves like you entered nothing. At least this approach is feasible/clever to me.