Mmastodon BusinessBanking first seen 2 d ago, last 1 d ago, peak #1

BMO criticized for forcing branch visits to report security bugs

Original: BMO is an absolute joke. They won't accept a bug report without "verifying my identity", claim they have no way to repor

A developer is blasting Bank of Montreal after the bank refused to accept a bug report without verifying the reporter's identity, saying it has no channel for unsolicited security vulnerability reports short of visiting a branch in person. The complaint also notes BMO's only two-factor options are phone calls or SMS, both considered weak. People are sharing it as an example of how poorly banks handle outside security disclosures.

Why now: Frustration over a major bank's lack of a proper security disclosure channel and weak 2FA options resonates widely.

BMOBank of Montreal

Open on mastodon →

Evidence

• BMO is an absolute joke. They won't accept a bug report without "verifying my identity", claim they have no way to report a security vulnerability unless they "authenticate" me, and suggest going to a branch (!!) to do so. Their only 2FA method is "phone call" or SMS. Absolute… · meejah · 3

API: https://socialmediatrends-api.osmike.com/v1/trends/3928037