I was stolen $2.9k thanks to Neo Financial's unsured system design and they don't care | Neo Financial | Discussion forum

I am thinking there are few pieces that may be missing from this story. I do not dispute the fact of the theft.

One needs email address and password to login to Neo Financial account. If you know how to do that with email address alone, please tell.

I just checked with my Neo account: one can't send Interac transfer from Neo Financial web site. This can only be done through the app. Which means, the victim may have been specifically targeted: someone must have known the victim banks with Neo, with what login email address and password.
That someone had to install Neo app on their smartphone to gain access to Interac transfer services of Neo account.

Also, once I installed Neo app on my new smartphone, I was alerted by email about that.

guess this story means 2-factor authentication to your phone is a much safer security feature than confirmation to email. Some institution still only offer email option which is ancient tech.

Take a look at IP address lookup for IP used to access OP's Neo account:

The idiot who stole the money must have been on WiFi at home, connected to cable modem. Contacting Videotron Support might be a good idea, perhaps they will be willing to disclose postal address of that account.

That $2,900 Interac e-Transfer was deposited into a bank account. The identity of the owner of that bank account would be available and could be obtained by the police.

Yes, I know that.
However, OP was dealing with Neo.

Neo and Wyth/Concentra are not likely to take responsibility for this in my opinion; they will just blame each other and OP. And none of us knows who was responsible.

For all these reasons, I suggested OP contact the police. If they can be induced to pursue it, they have the tools needed. For them, it should be a simple case.

While a bit tangential to this thread, it appears many?most? people do not understand that email addresses are as important to protect as one's own bank vault, SDB, SIN card. They are the basis of most User IDs to accounts, and the default 'go to' for institutions to provide 'alerts' to changes in one's accounts, and sometimes for 2FA. One's email password should, in my opinion, be 15-30 characters in length.

All of my accounts, where possible, have both email and SMS text alerts when a transaction, including any profile change, is made. It is a bit of a nuisance to deal with both, but I would rather have both come in than to have a single one of them compromised.

Norman1 said
Whoever ordered the $2,900 Interac e-transfer had the Neo banking ID and password. How else would the person be able to install the Neo app on their phone and connect the app to the Neo account?

The person also had access to the e-mailbox registered with the Neo account. How else would the person be able to receive the 2FA e-mail message and respond to it?

With that, it isn't unreasonable for Neo or any financial institution to think that the person is the actual Neo account holder. Different phone or different IP address is just noise.

People change phones by moving their SIM card. IP address changes if one just switches from data plan to the WiFi at home or at work.  

Thank you. You've articulated the exact reason why regulated and non-regulated financial institutions need to be called out, taken to the mat, and publicly flogged and shamed for insisting on using SMS- and/or e-mail-based codes as a two-factor authentication mechanism. We need financial institutions to be required to use FIDO2/other standards TOTA-based two-factor mechanisms and, for those without smartphones, to provide, a free rental of a physical hardware token, with a reasonable charge if lost.

Cheers,
Doug

Doug said

Thank you. You've articulated the exact reason why regulated and non-regulated financial institutions need to be called out, taken to the mat, and publicly flogged and shamed for insisting on using SMS- and/or e-mail-based codes as a two-factor authentication mechanism. We need financial institutions to be required to use FIDO2/other standards TOTA-based two-factor mechanisms and, for those without smartphones, to provide, a free rental of a physical hardware token, with a reasonable charge if lost.

Cheers,
Doug  

Maybe, but that is not what the public at large will likely accept with a (near) 100% online future. It is incumbent upon each individual to properly secure their email address login credentials and their phone access. Anything less is irresponsible.