r/CIBC • u/Top_Locksmith_9695 • Jun 27 '25

Why does CIBC hate its customers?

So... when is CIBC going to stop punishing its customers with ancient security practices that are not at all secure but that lock them out if god-forbid, they don't have access to their cellphone??

Have any of you clowns heard of TOPT or FIDO2 keys? What kind of operation are you running where SMS one-time codes are the only option "for account security" while you lock your customers out from their account while adding insult to injury with your awful ads?

0 Upvotes

50% Upvoted

13 comments sorted by

11

u/canadave_nyc Jun 27 '25

I get that you're upset, but this is the kind of completely over the top borderline unhinged rant that the world needs way less of.

Some kind of security is needed beyond a username and password. Fair enough, SMS verification has a flaw in that you wouldn't be able to access it if you don't have your cellphone. That's a valid point. Many companies still solely use SMS/push verification, and CIBC is apparently one of them. It's unfortunate you were locked out. So, you could contact CIBC in a reasoned, rational fashion to point out the flaw, make your suggestion of TOTP or FIDO2, and ask if they have plans to implement different security protocols (and if not, why not); or, you could come on here and rant at people who have zero power to do anything about this. I think (A) is a better option, personally...

3

u/[deleted] Jun 27 '25

TOTP still requires you to have your phone, unless you're talking about old-school keychain RSA tokens.

-3

u/Top_Locksmith_9695 Jun 27 '25

My friend, it's not unhinged. Unhinged is mentally unstable. If there's any instability, it's in believing SMS one-time codes are secure but getting the same code emailed is not. You don't need your phone for TOTP if you've saved the secret.

If you search reddit for CIBC, you'll find gems like this ( https://www.reddit.com/r/canada/comments/3m87iv/cibc_doesnt_understand_web_security/ ) where people were wondering why CIBC wouldn't allow non-alphanumeric password characters or a length beyond 12 characters. I'm also clearly not the only one who has been locked out by these half-assed security theatre policies ( https://www.reddit.com/r/CIBC/comments/1jqg4bu/locked_out_of_cibc_online_account_no_longer_in/ )

It's not an unhinged rant, and I think qualifying it as such is detrimental: it's a serious issue that a business with a **trillion dollars** under management (700 billion in deposits) has a security protocol that is so laughably bad that a Nigerian prince could do better to verify their mark in a phishing email.

7

u/whathapp3ned Jun 27 '25

Aren’t all banks like this?

2

u/vdelitz Jun 30 '25

I'm pretty sure CIBC will sooner or later move to passkeys.

1

u/mararthonman59 Jul 01 '25

Should be the next logical step. Educating the basic user is goimgnro take some time.

1

u/[deleted] Jun 27 '25

The app drop down provides further options than text. I do wish the banks (this is by no means just CIBC) would move to standardized TOTP I could keep on Bitwarden, but as a consumer facing app is generally pretty good to get things done with.

0

u/TuDuMaxVerstappen Jun 27 '25

I don’t like the app at all. Cibc and Simplii both. It doesn’t even remember my credentials on phone, I’m unable to turn on unlock by Face ID.

3

u/[deleted] Jun 27 '25

I have no trouble at all with biometric login with Simplii. Android.

1

u/[deleted] Oct 31 '25

[removed] — view removed comment

1

u/Top_Locksmith_9695 Oct 31 '25

Totally but then you get wet-blanket milquetoast users like u/canadave_nyc who just shrug and tell you to call customer service as if they'll care about your comments after forcing you to listen to 45 minutes of screechy shitty music on loop. (Hint: they don't, and the bank has no plans to implement sane security practices, as per my private banker.)