A text message from your bank is not secure

I'm a big fan of "Two Factor Authentication" - where in addition to a password you use a second technique to add additional security.  Passwords have been attacked for years and years and Two Factor Authentication (called 2FA) makes a stolen password worthless.  This is a big security win.

Many organizations send an SMS text message to your phone with a short number for you to enter after your password.  It's a really convenient way to give you 2FA.  This has been something that is important for things like online banking.

The problem is that hackers are now sending fake SMS messages:

Financially-motivated hackers are using SS7 attacks to break into bank accounts.

It has finally happened. 

For years, researchers, hackers, and even some politicians have warned about stark vulnerabilities in a mobile data network called SS7. These flaws allow attackers to listen to calls, intercept text messages, and pinpoint a device's location armed with just the target's phone number. Taking advantage of these issues has typically been reserved for governments or surveillance contractors.

But on Wednesday, German newspaper The Süddeutsche Zeitung reported that financially-motivated hackers had used those flaws to help drain bank accounts.

Oh, foo.  There's no authentication for the SS7 signaling, and so there's no authentication for the text message.  If someone has your phone number and can send SS7 into the telephone network, they can send a text message seeming to come from your bank.  More importantly (and this is what seems to have been used here) they can cause the victim's text to go to any old device they want - this is where they steal the codes.

Unfortunately, there's no solution yet.  Watch your bank account closely is about all you can do.