Banks and Phones

The Problem

For years there have been ongoing issues with SMS being used as a security mechanism for important things including financial services. The problem with this is that access to a phone number is not very well secured, the business model of phone stores is based on having a price of service that doesn’t allow the amounts of money spent on security and training that organisations such as banks can spend and are legally required to spend.

The way things work now is that SMS is a second factor of authentication for banks and other traditional financial companies as well as for services involving cryptocurrencies such as bitcoin. To gain unauthorised access to SMS an attacker can physically steal a phone or SIM or they can trick an employee of a phone store into replacing the SIM or attack the computers of the telco to gain access to replace SIMs.

SMS authentication is also used for many services which have indirect access to financial service. For example when I’m employed in a sysadmin role I may get given admin access to the email server used for the CEO’s email and have it default to using the phone number of my personal phone for authentication. So while my personal phone doesn’t give the potential for defrauding much money I own it does give the potential for being used for defrauding however much money the CEO can authorise which may be significantly greater than my net worth.

Hardware Security Devices

The best thing to do for securing such things is to use hardware security devices like FIDO keys, of which there is a wide range that cost less than $50. The problem with acceptance of such things is lack of general knowledge and lack of forced requirements to use them.

The vast majority of banks (including all banks in Australia AFAIK) have chosen not to require hardware security devices because of the cost. It has been widely claimed that 20% of the customers of a typical bank make 120% of the profit – 80% of the customers lose money for the bank. While I’m not in a position to know the accuracy of that most banks seem to have implemented monthly fees for accounts below a certain minimum balance to discourage less profitable customers. If there were banking regulations requiring hardware security devices then the costs would be passed on to people who really can’t afford an extra $50 per year in banking fees to pay for it.

It might be a good option for the government to require personal presence at the bank or a hardware security device for transfers of more than $1000. That would allow kids and minimum wage workers to have bank accounts without excessive fees while forcing a higher level of security for larger transfers.

I really should use the hardware security devices I own more, although they are mostly only usable on systems I run.

Improving Phone Store Security

The problems of employees of phone stores being tricked or bribed to giving attackers access to someone’s phone service could be addressed by introducing new regulations about security at phone stores. I think this isn’t a viable option as the amount of work required to develop new procedures, train staff, and implement more secure systems is significant. Also the stores used for selling phones aren’t the type of secure buildings that are used for banks so some construction work would be required and many phone stores in small towns would no longer be economically viable and would be shut down.

I think we should have legislation to require better security for phone stores as there is a lot of scope to do things better without the expense of bank type security. Crimes that involve stealing phone service don’t just hurt people who want a regular phone service, they hurt the community by facilitating other crimes.

How Virtual Telcos Work

In Australia there are 3 companies providing the full mobile phone service, Telstra, TPG (which bought Vodafone), and Optus. There are many “virtual telcos” that use those services. The virtual telcos are companies that will sell a phone service but use one of the 3 companies to provide the actual connection. The backend mobile service run by the big 3 has appeared to be secure, but probably doesn’t have the “protect $200m of bitcoin” level of security.

When you get a phone service you are issued a SIM or given a QR code for an eSIM by a company that has SIMs issued by the big 3. That company can then replace your SIM if it’s damaged, lost, or stolen by using a level of security that it deems appropriate, which probably isn’t very secure. Most of the news about SIM swapping attacks comes from other countries and it’s shown that the security of virtual telcos in the US is quite insecure and probably Australian companies aren’t any better.

To transfer a service to another virtual telco you used to be able to do it with just knowing the invoice number of your last invoice but in recent times you receive a SMS on your old SIM to confirm that you wish to change. That could be viable for any crime that involves stealing a phone today and stealing money tomorrow. But for most attacks that involve stealing a phone number transferring to a different virtual telco isn’t a good option.

Another possibility for crime that I haven’t seen reported yet is to steal eSIMs. It’s unreasonably difficult (although not impossible) to steal an eSIM once it’s installed in a phone. But stealing an eSIM before it gets installed is much easier. Kogan and Aldi email eSIMs to customers which is very vulnerable to attack and should be illegal. Telstra and Optus use an app to install an eSIM which could be quite secure if implemented properly. TPG uses a web page and QR code or an app which again could be quite secure.

Currently the iPhone 17 Air is apparently the only phone released world-wide without support for physical SIMs. When phones that have no support for physical SIMs become common people may have to make the security of eSIM delivery a factor when choosing a telco.

Banks as Virtual Telcos or SIM Providers

I think that in the near future the best thing to do to improve security involving the phone system would be to have the banks run virtual telco businesses or manage the supply of SIMs for virtual telcos. Then getting a SIM replaced would require the same security as changing access to a bank account and a lot of problems related to stealing phone service would be solved. Banks wouldn’t need to provide all phone services, just services to customers who want to use it which would be everyone who considers themself to be at risk of fraud.

I don’t think that this would be a great solution, but I think it’s better than anything else that’s likely to get used by a sufficient number of people in the near future.

What Will Happen

This blog post is mostly a thought experiment on ways of improving overall computer security in society. It can be read as advocacy for hardware security tokens. I don’t expect anything to be done to improve these issues.

I expect that banks will continue with their current security mechanisms (including SMS authentication) and just accepting a certain amount of fraud as the cost of doing business. For large fraud they can try to claw the money back or blame the customer to avoid having to pay. It’s not impossible to solve these things, I had a hardware device issued to me by a Dutch bank about 25 years ago but countries like Australia and the US are much more than 25 years behind.

I expect most people to regard whatever security they have on their bank account to be sufficient and that they will be happy to use the same for everything else. So we will continue to have things like SMS on a personal phone used to secure important corporate access to data and then people will be shocked when something goes wrong.

To make things even more exciting if a criminal takes over the phone number of the sysadmin to access the CEO’s email then there may be no-one to call to get the access restored.

We can add rampant financial fraud to the list for the AI related world economic crash that’s about to happen.