Banks are using SMS for Balances? What’s next?
| August 12th, 2009Was just watching TV, and saw a commercial from Chase Bank. Chase will now allow you to send a SMS message to the bank, and they will send you your balance.
Has everyone lost their minds? SMS is not encrypted, so not only the source and destination of the communications are known, but the balance, and who you are being sent in the clear should be a alarming thing to someone.
Realize that if I have your device’s SMS number, (e.g. Telephone number), I can contact you as if I’m Chase Bank, or any other person (http://www.spoofcard.com/) including masking my voice, and engineer as much info out of you as possible.
I’m a firm believer in Cellular phones to replace hard lines (in fact, I’ve fired ATT over a year ago, and couldn’t be happier), however, moving banking to this medium is probably the dumbest thing I’ve ever heard. Unless the banking industry is going to lobby to bring back telnet, pop3, and http transactions without encryption.
The only thing that is keeping someone from sniffing/snooping on your SMS messages, is a FCC mandate that you are “not allowed” to eavesdrop on Cellular Communications. Since the FCC and NSA don’t want your Cellular communications to be encrypted (It would be much harder to listen to phone calls of innocent citizens), you have banks, and other transaction based systems like Ebay, moving your data to “mobile” networks.
Stop using them. Listening to Cellular voice and data is a trivially easy thing to do, and just imagine someone listening to all voice and data at a convention, your local mall, football game, etc… you would have NO IDEA it was happening. Of course, until your bank account is drained, and the bank claims that you made the transactions.
To solve this problem, we need to have companies realize that SMS is NOT a secure communications protocol, and also need to lobby the FCC and DHS to allow us to have encrypted telephone conversations, not only for voice, but for data as well. Only then will we be safe from those who wish to steal our identities, moneys, and lifestyles.
Let me know what you think…
****UPDATE*****
In reading Chase’s Mobile site, I do see that they are being frugal with the access you have to your account via SMS, however, even sending your balance over unsecured means is the same as walking around with it painted on your forehead. I am VERY happy that I don’t bank with Chase, or any other bank that has SMS services.
What does your bank do?
