AIB - 48 hour restriction after SIM card change

observanto wrote: »

I have found a company (phonovation.com/fraud-prevention/sim-take-over-protection/?cn-reloaded=1) which offers product, which helps banks to minimize risk of sim swap.

4. How to combat it?
Phonovation’s anti SIM swap attack software prevents this kind of attack using data only available to Phonovation. Phonovation’s service (PhonoSecure STOP) checks if the current SIM card of the customer’s mobile phone can be trusted. If the number has been ported within a certain time period, our service will flag the interaction as a possible fraud and direct the user to the banks care lines to confirm certain details that only the customer and bank should know i.e previous transactions etc.

BENEFITS OF SIM SWAP PROTECTION (STOP)
- Will maintain a record of all customers’ SIM information
- Initial baselining of customer’s SIM information & continuous refresh of SIM information at regular periods
- SIM Swaps that are older than 12 to 24 hours can be assumed genuine and messages can be released to them on request
- When a password reset or account payee is added shortly after a SIM has been changed, the system assumes that the SIM has been compromised and refers the password reset to the call centre agent to verify the customer identity before the passwords are released
phonovation.com/fraud-prevention/sim-take-over-protection/?cn-reloaded=1

Interesting, so if that's what is going on here with AIB, they are contracting a company to track details of my SIM - but no mention of that in AIB's privacy statement.

smuggler.ie wrote: »

Ah c'mon here, as any T&C's with any company/service, they wont list EVERY single means of info they collect or share. It's always in broad terms for end user, and can be interpret as needed when needed.

I don't think that's necessarily true, but there aren't really 'broad terms' on te AIB Privacy Statement.

"Information (e.g. phone location) from your mobile to verify you are a resident in the Republic of Ireland when opening a new current account remotely;"

In this case, they've gone beyond phone location to track phone provider, and not for the reason stated (when opening a new account remotely).

So they're definitely not covered here.

KildareP wrote: »

What are you looking to get out of this as a resolution?

At the end of the day this is to protect you - the alternative is that when your account is compromised there's no 100% guarantee you'll get all or any of any money lost back.

You then need to have your online banking completely reset, which typically takes a week or more since your details will now have to be sent by post as they can't SMS them to you (and they usually send your username first followed by your PIN several days later so they do not arrive together).

You may also have to cancel all of your cards if they ordered replacement or additional cards while they had access to your online bank. Your current cards cancel down immediately and it will be several days before new ones arrive. Then you need to remember everywhere you've set up those cards as recurring payments - Netflix, Amazon, Sky, Vodafone, Eir, 3, car insurance, etc.

Frankly, the inconvenience of losing access to online for 48 hours because you swapped SIMs pales in significance to the potential hassle of having your accounts compromised.

Fair question.

The first thing I want to get out of it is to fully understand what's going on and how it improves security - professional curiosity from an IT head with an interest in security. The 48 hour delay seemed fairly arbitrary, and not something I had seen elsewhere.

I get the logic about protecting from SIM swap attacks, but I'm not 100% convinced that the 48 hour delay is the appropriate response - some kind of offline validation step to confirm that the new SIM is valid would make more sense to me. Not everyone would notice if their phone went offline for calls/texts for two days, especially in the WFH environment where we are generally connected to home wifi permanently.

The second thing I want to get out of it is to keep AIB honest in terms of their privacy statement and processes - more below.

KildareP wrote: »

But if you want to argue the legal/data protection side of it...

Their data protection policy is quite comprehensive in this regard, for example:
https://aib.ie/dataprotection#false
"What information do we collect about you?"
Phone number is listed there

"Lawful basis for processing"
[...]
"Prevent financial crime and cyber attacks
We continually monitor and analyse transactions, financial behaviour and electronic devices to detect and prevent financial crime and cyber-attacks. This enables us to protect and secure our customers information, our networks and our financial interests.

We share information with third parties to prevent financial crime, report fraud, manage our risks and protect both our interests."
[...]
"Sharing information to protect you

In some instances where we are concerned about your health and safety, we may share information to protect you and others. This may include where we suspect that you, or others, may become a victim of financial crime. In these cases, we may share information with third parties to help ensure your safety and the safety of others. "

Phone number is indeed listed there, but this isn't about phone number. They're not just tracking phone number, they are tracking my phone service provider, which is a fairly different thing, and is definitely additional to phone number.

And there is a good chance they are doing it through an external provider, such as Phonovation - so they are presumably giving my phone number to the external provider, who are getting details of my phone service provider, and either holding these details themselves or passing them back to AIB who are retaining them.

They would probably claim that this is covered under; "We share information with third parties to prevent financial crime, report fraud, manage our risks and protect both our interests." but there is no reason why their privacy statement shouldn't be as clear about their gathering and retention of phone service provider as they are about remote location of phone.

The Phonovation privacy policy isn't great either, in terms of detail and specificity.