Fidelity security calls getting blocked

msf

When Fidelity sends a security code (e.g. to allow you to change your phone number, add a payee to bill pay, etc.), you have the option of getting a voice message. A variety of phone service providers are blocking these calls so that your phone never rings.

Fidelity says that it is aware of the problem and is working with the phone companies to get this resolved. In the meantime, they suggest calling your phone provider to see if they will unlock the number for at least your phone.

---

My provider is Verizon. Its tech support insists that Verizon does not block numbers universally. All call blocks are initiated by customers themselves.

Yet Verizon writes on its website:

In addition to Call Filter blocking, Verizon auto-blocks calls that are highly likely to be illegal, such as calls from telephone numbers that are not authorized to make outbound calls.

Welcome to the 21st century. Where everything is automated and humans don't know what's going on.

hank

It’s getting nuts. Some banks / credit unions use an outside security service that monitors activity for possible fraud. My local bank blocked an attempted $159 purchase of (commercial free) NBA league Pass the other day for no reason I could discern. Not only that, but a block was put on my debit card until I answered a phoned computerized query. (I’m wondering if the auto-renewal component of League Pass may have resulted in a flurry of complaints in the past by people who simply forgot to cancel subscriptions in time.)

Is the block @msf mentions also used for 2 party factor verification of other transactions? Buying and selling inside a brokerage account? Sure sounds like it. I think everybody’s racing to stay ahead of AI. Heck, even though already logged in as a paid subscriber, Morningstar made me take one of those “prove you’re not a bot” tests the other day before I could continue. (I successfully identified all the busses in the photos.)

BTW - I’m a Verizon user. Haven’t had any problems using text messages for verification. In fact, the problem with the debit card I noted was finally successfully resolved by a computer generated voice call.

yogibearbull

When I changed to T-Mobile a few years ago, I stopped getting 2FA codes by text (not everyone provides phone option). After calling firms, who confirmed send, I called T-Mobile.

T-Mobile said, of course, 2FA txt codes are auto-blocked on new accounts to avoid problems with purchases by kid users.

After unblocking all line, I told them that proper default would be not-blocked, but people can set block by phone or online.

Not sure what T-Mobile does now.

msf

Verizon continues to block the number that Fidelity has been calling me from. Except for one brief shining moment a couple of days ago when Verizon tagged it as SPAM?? but still let it through.

Today Fidelity got a call past Verizon by using a different outgoing number. When a resistible force meets an immovable object (Verizon), it seems that the resistible force goes around the immovable object.

fred495

Just as a point of information, I am also a Verizon customer and have not experienced any problems with blocked calls from Fidelity to lock and unlock money transfers between accounts.

msf

To clarify: you've enabled money transfer lockdown and when you start a transfer Fidelity prompts you for a security code? You select to receive the code by voice (i.e. an actual call where the phone rings) and it comes through on your Verizon FiOS or copper line?

Maybe Fidelity is using a different outgoing number for you, or maybe Verizon is blocking numbers regionally. All I can say is that once again I cannot get a voice security code from Fidelity. Verizon is simply not allowing the call to reach my phone.

fundly

Similar problem with Spectrum voip landline, until after many calls to tech support problem was fixed. Spectrum has 3 levels of call blocking, high medium and low. We had no idea this was the case. This is done to stop scam and other suspicious calls. They had us assigned ," high "and after changing it to medium the voice 2FA problem was corrected. Perhaps this the cause of the blocked calls with other companies mentioned above.

Sven

I have not had blocking issues on my cell carrier, Verizon when I do transaction with Fidelity. Unless I specify those specific phone numbers as “spam” on my phone. Lately I get phone calls from Fidelity financial consultants. Without verification of who they are, I politely decline to take their calls, and mark that number as spam. I ask them to leave a private message on Fidelity if they want to talk to me, but they fail to follow through. Oh, well…

There are times when the 2FA comes slow as text message, I ask Fidelity to call instead and it works as well. Another option is use your email address to authenticate yourself. But this is rare as mobile devices are more common today.

I think there are more security issues recently. I get the verification of not being. “bot” from my bank from my PC, as @hank pointed out. Using the bank’s App, this does not happen. Recently I was asked for my PIN # for buying gas at a new location using my credit card. Typically they ask for my zip code of my home address. I called the credit card later and was told there are more unauthorized uses are happening.

fred495

msf said:

To clarify: you've enabled money transfer lockdown and when you start a transfer Fidelity prompts you for a security code? You select to receive the code by voice (i.e. an actual call where the phone rings) and it comes through on your Verizon FiOS or copper line?

Maybe Fidelity is using a different outgoing number for you, or maybe Verizon is blocking numbers regionally. All I can say is that once again I cannot get a voice security code from Fidelity. Verizon is simply not allowing the call to reach my phone.

The answer to your two questions is "yes". By the way, I have also been able to receive a security code via my Verizon Wireless mobile device.

Really sorry to hear about your problem with Verizon.

msf

@fred495 Thanks. Lucky me, I guess

Sven

hank said : Morningstar made me take one of those “prove you’re not a bot” tests the other day before I could continue. (I successfully identified all the busses in the photos.)

Think there are bot-generated stuff going on. My call to the credit card indicates an increase fraud uses of credit card and they need verification. Fortunately I remember mine at that time. This happened twice at out of town gas stations. Other transactions had no problem.

hank

Financial institutions have used voice recognition technology to screen callers to varying degrees for decades. But ISTM that wasn’t always acknowledged publicly. Direct calls I make to Fido are routinely screened & cleared by voice alone (I’m confident there’s an opt-out somewhere.)

With the rapid advances in AI, this form of identity verification (along with all others) must leave “heads spinning” in the security departments. May partially help explain why more “hoops” are being thrown up. I realize this doesn’t pertain directly to @msf’s post - but thought worth adding.

Helpful discussion. I locked my Fido direct transfer option this morning. There’s a good page (if logged in) that explains what’s covered by a lock and what isn’t. For example, regularly scheduled automatic transfers are not included.

Technically, my cellular provider is called “Visible”. It’s actually a low cost subsidiary of Verizon. Very dependable. No issues. Can’t speak directly to getting an audible security code by voice call recently - though it’s worked successfully in the past. I do routinely receive robotically phoned security inquiries that require my confirming by pressing a number.

msf

No objection to broadening the scope of the thread. We should consider the pros and cons of mechanisms providers offer and/or require us to use for security. Including how they can be defeated, both by friends? (Verizon) and foes.

One of the institutions I'm using always (automated) asks me if I'd like to use my voiceprint in the future for access (not Fidelity). I always decline.

I don't use voice recognition (IMHO too easy to clone) and I don't speak first when answering the phone. Different people make different tradeoffs on security. It's a matter of how you perceive different risks and how much effort you're willing to expend for each extra layer of security.

Five Ways to Protect Your Voice from AI Voice Cloning Scams
https://tnsi.com/resource/com/five-ways-to-protect-your-voice-from-ai-voice-cloning-scams-blog/

hank

Thanks @msf / I may have been incorrect in stating : ”Direct calls I make to Fido are routinely screened & cleared by voice alone”.

I know it gets me “in the door” initially. Saves time. But not sure how far I’d get moving money around. I think they do follow up with additional verification for actual exchanges / transfers. I do so much online today it’s hard to remember any calls … Anyway, will look into the advisability of using voice-print at all for verification in this Brave New World.

PS - It seems to me (in retrospect) that the 1st human to pick up at Fido says something like, ”You have been pre-screened by voice recognition … “

I didn’t know we could bypass the robot’s directions “Now tell me why you’re calling ….” I’ll definitely try that next time!

Observant1

From Extra login security FAQs section - "What transactions require extra security steps?"
https://www.fidelity.com/security/extra-security-login

"You will be prompted to verify your identity when you perform highly sensitive transactions such as setting up new bank instructions or changing your contact information. If you are signed up for extra security at login,
you may not get prompted for additional verification during the transaction because we will have already verified your identity when you logged in."

I've configured extra login security with MFA using the Symantec VIP authenticator app.
I seldom perform "highly sensitive transactions" but did change my user name this year
and assume this would be highly sensitive per Fidelity.
Security text alerts were turned on but I don't recall receiving a text for this transaction.

hank

Very informative @Observant1. Thanks.

I haven’t tried authentication apps. Would using the one you mention replace 2-factor authentication? Currently, I feel reasonably safe because I usually login using a fiber optic wifi network and than receive a secure numerical code through an outside cellular network. Exceptions would be when away from home and I login and receive the code over same cellular network. Try to minimize those less secure logins.

Your quote from Fidelity seems to say they would not change / add a bank account without additional security steps. ISTM that provides a very good layer of protection as they would not make a transfer to an unauthorized institution. Recently changed password & user name as well. 20 characters I believe is the maximum number. If were 30 I’d probably use it. Password memory only - not recorded anywhere. God help us as we approach 80.


Add: Just checked. FYI - Fidelity did promptly email an “Alert” that the password had been changed. (Use texting rarely. Prefer email alerts. May have so specified.)

Observant1

@hank

The Symantec VIP app is used for Two-Factor Authentication.
I've used it for years at Fidelity and recently with a new Schwab account.
I haven't had any issues with the app - it works as expected.
Since Symantec VIP is only installed on my desktop computer,
I can't comment on mobile versions of the app.
I'd prefer Fidelity support hardware authentication devices (e.g., Yubikey),
but this is probably the next best solution from a security standpoint.

Do yourself a favor and try using a password manager app.
I suffer from CRS (can't remember s***) so a password manager is very helpful.
There's no way I'd remember strong passwords like =qaDg|I$%3g/IIa*zKzn from memory.

yogibearbull

Widely used SMS texts are not very secure. They are unencrypted.

I have experience with both Symantec VIP and Google Authenticator. Many sites support one or the other. Timer for Symantec VIP starts from 0 and you have 1 minute to input the code. Google Authenticator runs continuously, so it could be in the middle or the last part of its 1-minute cycle. So, I wait until it starts from beginning and wait a few seconds to input the code - otherwise, it may reject the code, because the systems need a few seconds to refresh. It must be a rumor that light and electrons move at the speed of light - my PC takes its time to do things (-:).

Make sure that there are at least 2 ways to get the 2FA codes - via phone, e-mail, authenticator app.

Recently, in one account, the 2FA used only Symantec VIP. The app got frozen/locked, so I had to uninstall and reinstall, and that wiped out the old information/connection. So, I had to call because I had no way to log back in - a great royal pain!

Old_Joe

What a coincidence! =qaDg|I$%3g/IIa*zKzn is my password too!

Observant1

Great minds think alike!

msf

Observant1 said:

Since Symantec VIP is only installed on my desktop computer,
I can't comment on mobile versions of the app.
I'd prefer Fidelity support hardware authentication devices (e.g., Yubikey)

There is a pure physical authenticator that Fidelity currently supports. Symantec VIP packaged as a key fob:


Pay no attention to Fidelity's comment that it doesn't support this. Right below that is a comment by Harry Sit (The Finance Buff) that he has the fob and it works fine.

Observant1

@msf

Thanks, I was not aware of this and will investigate further.

Edit/Quick Take: non-replaceable batteries, larger footprint than Yubikeys,
will not work with any MFA provider besides Symantec VIP Access

hank

Thanks for the suggestion guys!

=qaDg|I$%3g/IIa*zKzn is perfect. I’ll switch over tomorrow. Who the hell could ever duplicate that one?

Observant1

"Am I incorrect that Fidelity limits passwords to 20 characters - if anyone knows?"

You're correct that Fidelity passwords are limited to 20 characters.
Here are the password requirements:
Use 8-20 English alphanumeric characters.
Use at least one of these special characters: ! @ $ % ^ ( ) - _ + = | \ : ; ' , . ? / ~.
Use at least 1 number, 1 lowercase letter, and 1 uppercase letter.
Use a random combination of characters instead of a common sequence or personal information.

hank

Thanks again @Observant1 for answering my query. I’ll give an authenticator a try first opportunity. I feel quite secure using the latest Apple IOS and running Norton (anti-spyware) software in the background. Plus secure wifi / cellular networks. But you can’t be too safe. OJ and others have shared tips on the safest browsers over the years.

FWIW - I don’t find it difficult to memorize a 20 character password consisting of at least 2 each of the following: upper case letters, lower case letters, numbers, special characters (in random sequence). The trick is to formulate a short phrase in your mind incorporating them. For letters, each letter in the code corresponds to the first letter of a word in that phrase. There are other tricks. That’s not to say what I construct is as good as what a password manager could. I doubt it is. Fido usually grades my passwords as “strong” or “very strong” - but have yet to attain their ultimate highest grade.

Here’s a quick one I constructed in a minute: FMDcIdGAD/Csb1142*CG

Translated:

F Frankly
M My
D Dear
c comma
i I
d don’t
G give
A a
D damn
/ space or hyphen mark
C
s
b Shorthand for Casablanca

1
1 Month of release

4
2 Year of release

* staring
C Clark
G Gable

Password strength meter

Old_Joe

@hank- I think that you're about ready for the home... see you there soon.

hank

Blame the election.

hank

Some fascinating discussions re Fidelity at the source @msf linked above. A Fidelity rep decided to join an ongoing discussion. Here’s a snippet from what the Fidelity Rep posted on that site:

”I wanted to let you know that multi-factor authentication (MFA) is up and running! You can learn more about this through our formal announcement below.” Link to Rep / Discussion


Fidelity MFA announcement (Quoted from Announcement) “Why MFA is important - MFA helps prevent unauthorized people from accessing your account, by requiring you to log in with your password AND confirm the login via another factor (in this case, entering a code generated by an app on your personal device). This added layer of protection means that even if someone knows your password, they’ll have a harder time accessing your account. We strongly encourage you to add MFA if you haven’t already done so.“


What I’m having some difficulty grasping is how this is substantially more secure than the 2-factor authentication I already use? Why is the new fangled “multi-factor” method (being touted) more secure?

Here’s a link / source that explains it. MFA vs. 2FA: what’s the difference?

BaluBalu

If SMS texts are not secure, what is the solution? Physical athenticator? But big companies like to cut costs and may not be interested in providing physical ones!