Chase business bank account security flaw?

[ShimshonK]

I called Chase business phone line today regarding my business bank account. All I had to enter in the automated menu was the account number and EIN. That's enough for them to tell you the balance, transaction history, etc. When I talked to an actual person, they also asked for my name and business name. None of these questions keep your account very secure. Account numbers are available to anyone that has ever received a check, and EIN's can often be publicly accessible too. Obviously name and business name are real easy.

I thought that they must only be allowing it because they recognize the number I'm calling from, but nope, tried from a different number and got through the exact same way.

Don't know if more secure data would be required for actions like withdraw, etc., but in any case, it seems like way too much access offered to anyone that so desires.

[pcgeek]

I called Chase business phone line today regarding my business bank account. All I had to enter in the automated menu was the account number and EIN. That's enough for them to tell you the balance, transaction history, etc. When I talked to an actual person, they also asked for my name and business name. None of these questions keep your account very secure. Account numbers are available to anyone that has ever received a check, and EIN's can often be publicly accessible too. Obviously name and business name are real easy.

I thought that they must only be allowing it because they recognize the number I'm calling from, but nope, tried from a different number and got through the exact same way.

Don't know if more secure data would be required for actions like withdraw, etc., but in any case, it seems like way too much access offered to anyone that so desires.

Maybe they're using this: https://www.chase.com/personal/voice-biometrics ?
You can test by having someone who never called about your account call using a different number so you know that they're not using your number or voice print. Let us know

[ShimshonK]

Maybe they're using this: https://www.chase.com/personal/voice-biometrics ?
You can test by having someone who never called about your account call using a different number so you know that they're not using your number or voice print. Let us know

When I brought up my security concern to them, they did mention this. However, the balance, transaction history, etc., is all available on the automated system without saying a word.

[justmeha]

When I brought up my security concern to them, they did mention this. However, the balance, transaction history, etc., is all available on the automated system without saying a word.

standard DDF advice seems to be... send a email to the CEO.

[lcm]

Ein is a funny thing.
On the one hand, it acts like a ssn, but on the other hand it is basically publicly available.
Go figure

[ShimshonK]

standard DDF advice seems to be... send a email to the CEO.

I don't think Mr. Dimon will read my email, but maybe @Dan (and @jj1000 ) have connections

[justmeha]

I don't think Mr. Dimon will read my email, but maybe @Dan (and @jj1000 ) have connections

correct, but someone in his office (who likely had more "connections" then your average CSR) will.

[ShimshonK]

correct, but someone in his office (who likely had more "connections" then your average CSR) will.

Fair enough. If I can actually get my email viewed, I might as well try.

[AsherO]

standard DDF advice seems to be... send a email to the CEO.

Funny you say that, worked for me yesterday with a different F500, sent an email to the CEO and had a callback from someone in an executive response team within hours. Got an incident number, and the guy’d direct extension with clear expectations of what to expect and when.

[S209]

Funny you say that, worked for me yesterday with a different F500, sent an email to the CEO and had a callback from someone in an executive response team within hours. Got an incident number, and the guy’d direct extension with clear expectations of what to expect and when.

What sort of issue? Something they messed up on, or a general inquiry/request?

[Shmulie]

Ein is a funny thing.
On the one hand, it acts like a ssn, but on the other hand it is basically publicly available.
Go figure

Where can you lookup an EIN? I've actually tried in the past

[AsherO]

What sort of issue? Something they messed up on, or a general inquiry/request?

Fraud committed on my account, likely identity theft. Couldn't get answers elsewhere so I self-escalated to executive services. Email was all facts and request for more information; no complaints, threats, or requests for compensation.

[ShimshonK]

Well, got a response (voicemail) from someone in the executive office.

[AsherO]

Well, got a response (voicemail) from someone in the executive office.

Saying?