I've just noticed that several companies have stopped allowing email address changes online.
You have to phone them to do it, if they can be bothered to answer the phone, of course.
I've also noted several companies effectively requiring phone text authentication every time I try to log in online
Anyone know what's going on?
In most cases, I shall just cancel the account and rejoin with new details and new email, which is easier.
Changing email address
-
Fox3WheresMyBanana
- Chief Pilot
- Posts: 13249
- Joined: Thu Sep 03, 2015 9:51 pm
- Location: Great White North
- Gender:
- Age: 61
Re: Changing email address
It's called 2-factor authentication (2FA), or occasionally MFA (multi-).
The theory is that if someone manages to grab your password by nefarious means, hopefully they haven't also acquired your phone. Not foolproof, people have had their phone numbers stolen, or there's a weakness in the system that lets an attacker change the phone number associated with the account to their burner phone so they get the auth code. The other one is where you get a call from "customer service" and as part of their verification procedure, they're going to send you a text message and ask you to read back the number to them (which they're waiting to type into your bank login).
The difficulty in changing email address is most likely from a similar mechanism - some systems allow 2FA with an emailed code, so if they can change the email address on the account they can gain access that way. Also works with the inevitable password reset, which gets sent to the attacker's account. There are ways to mitigate it, like the system emailing old and new addresses to note that the address was changed. Doesn't stop a fast typist, but at least you know someone's messing with your account access.
The theory is that if someone manages to grab your password by nefarious means, hopefully they haven't also acquired your phone. Not foolproof, people have had their phone numbers stolen, or there's a weakness in the system that lets an attacker change the phone number associated with the account to their burner phone so they get the auth code. The other one is where you get a call from "customer service" and as part of their verification procedure, they're going to send you a text message and ask you to read back the number to them (which they're waiting to type into your bank login).
The difficulty in changing email address is most likely from a similar mechanism - some systems allow 2FA with an emailed code, so if they can change the email address on the account they can gain access that way. Also works with the inevitable password reset, which gets sent to the attacker's account. There are ways to mitigate it, like the system emailing old and new addresses to note that the address was changed. Doesn't stop a fast typist, but at least you know someone's messing with your account access.
-
Fox3WheresMyBanana
- Chief Pilot
- Posts: 13249
- Joined: Thu Sep 03, 2015 9:51 pm
- Location: Great White North
- Gender:
- Age: 61
Re: Changing email address
Thank you.
..and presumably this is now so rife that more and more companies are insisting on it?
Don't combat the crims, just annoy the customer more?
I (still) have a PAYG phone, so continual calls and texts cost me, as does waiting half an hour for a company, or the government, to answer their calls on a "freephone" number.
What particularly concerns me is that if the security breach is from inside their own company, which it increasingly appears to be with cheap, imported labour on minimum wage, or offshoring, they now have your phone number also. And the crims don't have to get that phone number from the bank. And the company marketing department will now flood that number with sales cr@p. And they'll sell it on to all their "associates". And one can't get round this by giving them a 'burner' phone number, as one can with 'burner' email addresses, because phone numbers are not free.
I'm shopping locally a lot more these days.
..and presumably this is now so rife that more and more companies are insisting on it?
Don't combat the crims, just annoy the customer more?
I (still) have a PAYG phone, so continual calls and texts cost me, as does waiting half an hour for a company, or the government, to answer their calls on a "freephone" number.
What particularly concerns me is that if the security breach is from inside their own company, which it increasingly appears to be with cheap, imported labour on minimum wage, or offshoring, they now have your phone number also. And the crims don't have to get that phone number from the bank. And the company marketing department will now flood that number with sales cr@p. And they'll sell it on to all their "associates". And one can't get round this by giving them a 'burner' phone number, as one can with 'burner' email addresses, because phone numbers are not free.
I'm shopping locally a lot more these days.