Chase removes email option for verification codes.
#1
Original Poster


Join Date: Jun 2008
Posts: 3,039
Chase removes email option for verification codes.
Does anyone have a clever workaround that I am not thinking of?
When logging into Chase from an unknown device, there is an option for a code via text, a call, or an e-mail. Chase recently took away the e-mail option; 'for security reasons'. I asked the Chase rep how to access the account when out of the country, without my phone (as I don't use my phone outside of the US - usually just purchase a local SIM card).
The only Chase solution is to schedule a payment in advance of leaving the US. That is OK, but not for a 30-45 day trip. In addition, I want to be able to check transactions throughout a trip.
Thanks!
Steve
When logging into Chase from an unknown device, there is an option for a code via text, a call, or an e-mail. Chase recently took away the e-mail option; 'for security reasons'. I asked the Chase rep how to access the account when out of the country, without my phone (as I don't use my phone outside of the US - usually just purchase a local SIM card).
The only Chase solution is to schedule a payment in advance of leaving the US. That is OK, but not for a 30-45 day trip. In addition, I want to be able to check transactions throughout a trip.
Thanks!
Steve
#2
Join Date: Sep 2015
Location: flyover country
Posts: 2,856
I share your frustration. And you touched a nerve.
I hope so.
With no warning to me or to the front-line agents who told me I must have changed something.
Absolutely. It's like Chase markets travel cards with no idea that people who have them might travel. Either that, or Chase doesn't think checking transactions is something its card-holding travelers should do.
I'm a technological moron, but from what I read, email and SMS each have vulnerabilities and either is way better than nothing. Also, my understanding is that Chase could query the MAC address of a device that's trying to access an account. (Yes, I know a MAC address can be spoofed.) It seems to me that Chase could assume that someone using the last MAC address that has been used to access the account and the email address on file is likely to be the customer.
I hope so.
[...] Chase recently took away the e-mail option; 'for security reasons'. [...]
[...] In addition, I want to be able to check transactions throughout a trip.[...]
I'm a technological moron, but from what I read, email and SMS each have vulnerabilities and either is way better than nothing. Also, my understanding is that Chase could query the MAC address of a device that's trying to access an account. (Yes, I know a MAC address can be spoofed.) It seems to me that Chase could assume that someone using the last MAC address that has been used to access the account and the email address on file is likely to be the customer.
#3
Formerly known as stellertony




Join Date: Oct 2006
Location: MEX
Posts: 1,151
Fwiw even if you switch SIM cards the chase app should still be fully functional on your phone unless you actively log out. I think I was also recently given the option to approve a login on an unrecognized device by having them send a notification to the Chase app on my phone and approving it there.
Hopefully they will add support for app-generated authenticator codes at some point, though the banking industry is pretty behind the curve on that front so Im not holding my breath.
Hopefully they will add support for app-generated authenticator codes at some point, though the banking industry is pretty behind the curve on that front so Im not holding my breath.
#5
Original Poster


Join Date: Jun 2008
Posts: 3,039
I share your frustration. And you touched a nerve.
I hope so.
With no warning to me or to the front-line agents who told me I must have changed something.
Absolutely. It's like Chase markets travel cards with no idea that people who have them might travel. Either that, or Chase doesn't think checking transactions is something its card-holding travelers should do.
I'm a technological moron, but from what I read, email and SMS each have vulnerabilities and either is way better than nothing. Also, my understanding is that Chase could query the MAC address of a device that's trying to access an account. (Yes, I know a MAC address can be spoofed.) It seems to me that Chase could assume that someone using the last MAC address that has been used to access the account and the email address on file is likely to be the customer.
I hope so.
With no warning to me or to the front-line agents who told me I must have changed something.
Absolutely. It's like Chase markets travel cards with no idea that people who have them might travel. Either that, or Chase doesn't think checking transactions is something its card-holding travelers should do.
I'm a technological moron, but from what I read, email and SMS each have vulnerabilities and either is way better than nothing. Also, my understanding is that Chase could query the MAC address of a device that's trying to access an account. (Yes, I know a MAC address can be spoofed.) It seems to me that Chase could assume that someone using the last MAC address that has been used to access the account and the email address on file is likely to be the customer.
Fwiw even if you switch SIM cards the chase app should still be fully functional on your phone unless you actively log out. I think I was also recently given the option to approve a login on an unrecognized device by having them send a notification to the Chase app on my phone and approving it there.
Hopefully they will add support for app-generated authenticator codes at some point, though the banking industry is pretty behind the curve on that front so Im not holding my breath.
Hopefully they will add support for app-generated authenticator codes at some point, though the banking industry is pretty behind the curve on that front so Im not holding my breath.
I am not familair with the Chase app. I do not do any type of finance on my phone. And the couple of apps that I do use on my phone; I always logout of. That said, I have a short overseas trip in two weeks. I'll install the Chase app, switch SIM cards, and see what happens. I'll report back.
#6
Join Date: Sep 2015
Location: flyover country
Posts: 2,856
I look forward to your report.
#7




Join Date: Nov 2003
Location: CGK/KOA
Programs: QR Plat, AA PP, Hilton Diamond
Posts: 1,784
I live and work overseas, only in the US for 8 weeks per year. My work around? I buy a dual sim iPhone (all phones bought in HK, China, and Macau I believe are required to have two sim card slots). This, combined with T-Mobile allows to keep my US phone line on to receive texts from all my banking institutions at no cost.
#8
Suspended
Join Date: Jul 2001
Location: Watchlisted by the prejudiced, en route to purgatory
Programs: Just Say No to Fleecing and Blacklisting
Posts: 102,077
I noticed the change too, but wasn't sure how widespread the change was with Chase account access. I can see the change being a hassle in parts, but I also do understand why they wanted to migrate away from email authentication means.
#9



Join Date: Jan 2017
Programs: Marriott Lifetime Titanium, Hyatt Globalist
Posts: 2,993
Yes, very annoying. I'm not in the US often and can't receive sms to non US number. I couldn't log in on my computer and they made me call international rates to US to get unblocked. Annoying that email option is now removed.
#10
Formerly known as stellertony




Join Date: Oct 2006
Location: MEX
Posts: 1,151
I live and work overseas, only in the US for 8 weeks per year. My work around? I buy a dual sim iPhone (all phones bought in HK, China, and Macau I believe are required to have two sim card slots). This, combined with T-Mobile allows to keep my US phone line on to receive texts from all my banking institutions at no cost.
#11
Formerly known as stellertony




Join Date: Oct 2006
Location: MEX
Posts: 1,151
Yes, afaik no issue with switching sims while a phone is on at least with any modern devices. Though I also dont get logged out of the Chase app or any other app when I restart my phone.
#13
Join Date: Sep 2015
Location: flyover country
Posts: 2,856
Thank you for the info on leaving the phone on, and thank you for the info on app behavior. (I don't use many apps, as you might have surmised.)
#14




Join Date: Aug 2010
Location: LAS, MPL
Programs: DL Platinum, 1 MM
Posts: 1,405
This is another case of a bunch of 25 year old kids running the IT department. They cannot imagine that somebody wouldn't be glued to their phone 24/7. What makes them believe I have my phone with me when I am trying to login - not from my phone - is beyond me.
(OT) I have a similar issue with Wells Fargo. First, they update their app what feels like every month for "minor performance improvements and bug fixes". And then they stop supporting the Android version on my 4 year old perfectly fine phone. Why? Because they think everybody gets a new Iphone every year.
I am stepping off my soap box now.
(OT) I have a similar issue with Wells Fargo. First, they update their app what feels like every month for "minor performance improvements and bug fixes". And then they stop supporting the Android version on my 4 year old perfectly fine phone. Why? Because they think everybody gets a new Iphone every year.
I am stepping off my soap box now.
#15



Join Date: Jun 2015
Location: DTW
Programs: Alaska, Delta, Southwest
Posts: 1,732
And yet their account security page still says "When you sign in for the first time or with a device we don't recognize, we'll ask you for your username, password and a temporary identification code, which we'll send you by phone, email or text message."
IMHO, SMS is now more vulnerable than email thanks to the proliferation if SIM swapping. The best solution is an authentication app, which it seems Chase doesn't support.
IMHO, SMS is now more vulnerable than email thanks to the proliferation if SIM swapping. The best solution is an authentication app, which it seems Chase doesn't support.

