What the F*** did that bank do?

What the F*** did that bank do?!

I thought I was going to crawl out of my skin when I found out. It’s a shameful practice that needs to be called out and stopped. It’s just…

But let’s start at the beginning.

I’m sitting in my home office, typing away at the keyboard. I have this habit of running a background thread in my mind: I pay attention, but really, I don’t.

It’s like a voice recorder equipped with an automated summarizer and an alarm system. I tend to joke that nothing escapes my attention. …and at some point, that alarm bell is hit with full force. I hear my wife reciting her mother’s maiden name. I stand up immediately, walk over to her, and tell her to hang up.

At first, it doesn’t make any sense, but then the “summary” of the situation kicks in. My wife is on a phone call. She’s answering with a few yeses and nos. Then she recites her phone number and—record scratch—her mother’s maiden name.

Once she hangs up, I ask who called. She tells me it was the bank. They wanted to verify her “online banking.”

What. The. Actual. F***.

My wife has absolutely no idea why I’m so upset. She doesn’t understand when I tell her that she should NEVER, under ANY circumstances, give out sensitive, money-accessing information to ANY caller - no matter who they claim to be or why they are calling.

I ask her for the phone number they called from. I search for it and find the exact number on the bank’s official website. I check it five times, digit by digit, squinting in anger to make sure I didn’t mistake a “34” for a “43” or an “03” for an “09.” It matches. Soon after, she receives a text message. It’s titled with the name of her bank, asking her to call the exact same number to confirm a transaction or it might be rejected.

I tell her to call it, confirm the transaction, and ask whether it was actually them who just called her (obviously, it should be in their contact history). She does, goes through the verification - the exact same sequence I heard previously - and confirms a mind blowing €250 transaction that required authorization. During the conversation, she confirms that it was, in fact, the bank who had called her. My wife hadn’t paid too much attention to what they wanted to confirm the first time; she just defaulted to trust and misremembered what they wanted.

…but that doesn’t matter.

The bank should never do this, and my wife shouldn’t have told them a thing.

She received a surprise phone call from a bank. A phone call she didn’t expect nor request. A phone call from an unknown number (she hadn’t had it in address book, though it’s not like spoofing is impossible anyway), and she proceeded to give out highly sensitive information purely on trust.

I explained very thoroughly and precisely why she must never, ever do this again. Thank God nothing bad came of it this time.

But the mere fact that the bank was so f***ing stupid is just beyond me. They are actively teaching their clients that it’s okay to respond to random strangers calling and asking for sensitive details!

This brain-dead bank is BGŻ BNP Paribas (and they deserve this shaming), a Polish branch of BNP Paribas. May all the Saints protect them from all evil with security practices like these!

On the other hand, there’s Erste Bank (formerly Santander in Poland), which has top-tier security practices. Just the day before, we were migrating a banking app and received a call with a confirmation code. The automated recording (two voices talking in turn) explicitly warned against giving this code to anyone or anything except directly into the mobile app for activation. That is a bank that verifies identity by asking people to confirm who they are within the banking app itself through notification. No sensitive details divulged over the phone.

And like… not to some strangers who might be calling from an amateur bank.

F***!

Przemysław Alexander Kamiński

vel xlii vel exlee