Ally Never Uses 2FA --Should I worry?

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills.
athenslb57
Posts: 32
Joined: Mon Feb 20, 2017 6:49 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by athenslb57 »

Here is what I received back from Ally re:2FA.... pleased to inform me :confused
I am pleased to inform you that Ally Bank does currently utilize a two-factor authentication. We use a security code when an additional verification of a login attempt is needed. The security code is a randomly generated six-digit code that is sent when you log into a device or location that is not recognized such as an unregistered device. Choosing not to register a device does not guarantee that additional verification via security code will be required. Likewise, registering a device will not necessarily prevent the need for a security code.

Your online access can be changed to always receive a security code by contacting Ally customer service at the phone number listed below. If you would like to increase your chances of receiving the security code, please call the phone number below and a customer care associate can deregister your devices.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

athenslb57 wrote: Sat Jan 08, 2022 12:56 pm Here is what I received back from Ally re:2FA.... pleased to inform me :confused
I am pleased to inform you that Ally Bank does currently utilize a two-factor authentication. We use a security code when an additional verification of a login attempt is needed. The security code is a randomly generated six-digit code that is sent when you log into a device or location that is not recognized such as an unregistered device. Choosing not to register a device does not guarantee that additional verification via security code will be required. Likewise, registering a device will not necessarily prevent the need for a security code.

Your online access can be changed to always receive a security code by contacting Ally customer service at the phone number listed below. If you would like to increase your chances of receiving the security code, please call the phone number below and a customer care associate can deregister your devices.
If I understand your earlier posting, you called Ally yesterday and were told that they created a case report for you with the tech team so that you would receive 2FA every time you log in. Did they tell you how long it would take to implement? They told me three to five business days.

So today you received the above notification from Ally. Was it through regular email or through secure message on Ally's website? It doesn't acknowledge that you've already called customer service and have a case started.

What you received today is as vague and baffling and meaningless as the language on their "security" section about security codes.

I'm still waiting 3-5 business days to see if they resolve this issue. If not, I'm immediately transferring to another bank.

Thank you for updating us, and please let us know if they do actually resolve your case next week!
NabSh
Posts: 377
Joined: Fri Dec 25, 2020 11:09 am
Location: USA

Re: Ally Never Uses 2FA --Should I worry?

Post by NabSh »

I believe Ally uses "cookies" on your computer. Consider cookies as a unique signature of confirming to Ally that computer and browser is yours. As long as the history is not cleared, IP doesn't change, Ally knows it's you.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

NabSh wrote: Sat Jan 08, 2022 5:13 pm I believe Ally uses "cookies" on your computer. Consider cookies as a unique signature of confirming to Ally that computer and browser is yours. As long as the history is not cleared, IP doesn't change, Ally knows it's you.
I hear you, but that's definitely not enough for me to trust the security of my funds. Every company I do business with that holds my personal information has 2FA: Vanguard has 2FA; Kaiser (healthcare provider) has 2FA; my life insurance company has 2FA; my password manager has 2FA; Bank of America has 2FA; Xfinity has 2FA; even Google Gmail has 2FA. I don't want to do business with any company that doesn't offer it.

https://bitwarden.com/blog/basics-of-tw ... bitwarden/
athenslb57
Posts: 32
Joined: Mon Feb 20, 2017 6:49 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by athenslb57 »

evelynmanley wrote: Sat Jan 08, 2022 1:34 pm
athenslb57 wrote: Sat Jan 08, 2022 12:56 pm Here is what I received back from Ally re:2FA.... pleased to inform me :confused
I am pleased to inform you that Ally Bank does currently utilize a two-factor authentication. We use a security code when an additional verification of a login attempt is needed. The security code is a randomly generated six-digit code that is sent when you log into a device or location that is not recognized such as an unregistered device. Choosing not to register a device does not guarantee that additional verification via security code will be required. Likewise, registering a device will not necessarily prevent the need for a security code.

Your online access can be changed to always receive a security code by contacting Ally customer service at the phone number listed below. If you would like to increase your chances of receiving the security code, please call the phone number below and a customer care associate can deregister your devices.
If I understand your earlier posting, you called Ally yesterday and were told that they created a case report for you with the tech team so that you would receive 2FA every time you log in. Did they tell you how long it would take to implement? They told me three to five business days.

So today you received the above notification from Ally. Was it through regular email or through secure message on Ally's website? It doesn't acknowledge that you've already called customer service and have a case started.

What you received today is as vague and baffling and meaningless as the language on their "security" section about security codes.

I'm still waiting 3-5 business days to see if they resolve this issue. If not, I'm immediately transferring to another bank.

Thank you for updating us, and please let us know if they do actually resolve your case next week!
Honestly, I do not think they have any idea what they can or cannot do in regards to security. I do have an open case but they indicate how long it would take to implement. I did call Marcus bank on Friday and they only have SMS based 2FA as well. Here is a listing of 2FA enabled sites and the type of 2FA they support. https://2fa.directory/
Topic Author
goaties
Posts: 542
Joined: Fri Jan 29, 2010 3:15 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by goaties »

evelynmanley wrote: Sat Jan 08, 2022 5:23 pm
NabSh wrote: Sat Jan 08, 2022 5:13 pm I believe Ally uses "cookies" on your computer. Consider cookies as a unique signature of confirming to Ally that computer and browser is yours. As long as the history is not cleared, IP doesn't change, Ally knows it's you.
I hear you, but that's definitely not enough for me to trust the security of my funds. Every company I do business with that holds my personal information has 2FA: Vanguard has 2FA; Kaiser (healthcare provider) has 2FA; my life insurance company has 2FA; my password manager has 2FA; Bank of America has 2FA; Xfinity has 2FA; even Google Gmail has 2FA. I don't want to do business with any company that doesn't offer it.

https://bitwarden.com/blog/basics-of-tw ... bitwarden/
I am not sure what Ally's "algorithm" is for deciding when or when not to ask for 2FA. All I know is, since I called back in November, I now almost always get asked to do 2FA. It doesn't seem to matter whether I click on "trust this device" or not. But, at least it's mostly asking me to do 2FA, so I am happy.

Remember too that a lot of this will be highly individual, based on:
-- whether your browser clears cookies after each session (mine does--I suggest you set yours up to do so as well),
-- whether your router or some other gizmo gives you a new IP address from time to time (I have no idea how this works, but I know it can happen
-- whether you are using a VPN (I don't, can't comment on that),
-- whether you start a new session of your browser each time your log in (I ALWAYS do this for EVERYTHING. I don't want cookies left behind which another site could possibly examine),
-- etc, etc.

So there may be some things you could do on your end to force Ally and all your other sites to do 2FA.
User avatar
VictorStarr
Posts: 746
Joined: Sat Jan 04, 2020 9:13 pm
Location: Washington

Re: Ally Never Uses 2FA --Should I worry?

Post by VictorStarr »

VictorStarr wrote: Thu Jan 06, 2022 2:25 pm I sent secure message to Ally and requested to enable 2FA on every login.
I received a respond in 10 minutes and it implies that it possible for Ally to enable 2FA on every login.
Here is the full message:

Dear Xxx,

Thank you for taking the time to contact Ally Bank. It is my pleasure to assist you with setting up Two Step Authentication.

The security code feature helps enhance our security program to safeguard your account. To assist us in protecting your funds, we may require additional verification in the form of a security code each time that you log in with a device that we do not recognize as belonging to you. Once you have the security code, you will need to enter that information when you log into your account on the unrecognized device.

Please keep in mind, your security code delivery preferences are separate from your contact information. To review your preferences online, please take the following steps:

-From the Snapshot screen on a desktop PC, click Profile and Settings.
-Click Profile and Settings again to expand the menu.
-Click Security Code Delivery.
-From here you can add new security code delivery options or delete old ones.

To request a security code be required for every log in attempt, please call our toll-free number below to be connected to a Tech Team associate.

If you have any additional questions, we are here for you 24 hours a day, seven days a week, by Phone, Live Chat, or Secure Messaging. Our toll-free number is 1-877-247-ALLY (2559), or you can visit us online at ally.com. We appreciate your business and want to thank you for choosing Ally Bank.

Sincerely,
Xxxx
Customer Service
Ally Bank

I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

VictorStarr wrote: Wed Jan 12, 2022 12:38 pm
VictorStarr wrote: Thu Jan 06, 2022 2:25 pm I sent secure message to Ally and requested to enable 2FA on every login.
I received a respond in 10 minutes and it implies that it possible for Ally to enable 2FA on every login.
Here is the full message:

Dear Xxx,

Thank you for taking the time to contact Ally Bank. It is my pleasure to assist you with setting up Two Step Authentication.

The security code feature helps enhance our security program to safeguard your account. To assist us in protecting your funds, we may require additional verification in the form of a security code each time that you log in with a device that we do not recognize as belonging to you. Once you have the security code, you will need to enter that information when you log into your account on the unrecognized device.

Please keep in mind, your security code delivery preferences are separate from your contact information. To review your preferences online, please take the following steps:

-From the Snapshot screen on a desktop PC, click Profile and Settings.
-Click Profile and Settings again to expand the menu.
-Click Security Code Delivery.
-From here you can add new security code delivery options or delete old ones.

To request a security code be required for every log in attempt, please call our toll-free number below to be connected to a Tech Team associate.

If you have any additional questions, we are here for you 24 hours a day, seven days a week, by Phone, Live Chat, or Secure Messaging. Our toll-free number is 1-877-247-ALLY (2559), or you can visit us online at ally.com. We appreciate your business and want to thank you for choosing Ally Bank.

Sincerely,
Xxxx
Customer Service
Ally Bank

I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
FedGuy
Posts: 1677
Joined: Sun Jul 25, 2010 3:36 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by FedGuy »

When I log in to my Ally account, I see a button to suggest a feature. Has anyone used that to suggest that Ally implement a more robust 2FA?
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

FedGuy wrote: Mon Jan 17, 2022 9:24 am When I log in to my Ally account, I see a button to suggest a feature. Has anyone used that to suggest that Ally implement a more robust 2FA?
I don't see that button suggesting that feature when I log in.

It's been over a week since each of the Ally reps said they would have 2FA available each time I try to access the account (see above) in 3-5 business days. Nothing has changed. I've tried to access with a different computer, different IP address, and no 2FA. I'm considering transferring all my Ally funds over to Marcus. They still have a $100 bonus offering, so this is good timing. viewtopic.php?f=2&t=336533&start=100 I've just asked other Bogleheads if they get 2FA on their Marcus accounts.

There's also a Discover bonus offering for opening a savings account, either $150 or $200: https://www.depositaccounts.com/banks/d ... nk/offers/ I've talked to their rep, and they do NOT use 2FA each time a customer logs in.

I think having 2FA is the LEAST that Ally could do to offer their customers an extra layer of security. Bank of America has it, Kaiser (healthcare) has it, Bitwarden password manager has it, Amazon has it, even Gmail has it! And if three Ally reps assured me that 2FA would be consistent, yet it isn't, then imagine the headaches if there were others issues to deal with. They've lost a longtime customer.
FedGuy
Posts: 1677
Joined: Sun Jul 25, 2010 3:36 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by FedGuy »

evelynmanley wrote: Thu Jan 20, 2022 11:13 am
FedGuy wrote: Mon Jan 17, 2022 9:24 am When I log in to my Ally account, I see a button to suggest a feature. Has anyone used that to suggest that Ally implement a more robust 2FA?
I don't see that button suggesting that feature when I log in.
Go to Accounts...View Snapshot. Below the list of your accounts there should be a line listing five items: "Feedback," "Ally Community," "Security," "Privacy," and "Legal." Click "Feedback." That should open a pop-up with two options: "Give us some feedback" and "Review our products." Click "Give us some feedback."

Mine doesn't work. Depending on the browser I use, when I click on "Give us some feedback" either nothing happens, or it goes to a new screen but won't let me type anything in it. I'm curious to hear other people's experiences.
User avatar
VictorStarr
Posts: 746
Joined: Sat Jan 04, 2020 9:13 pm
Location: Washington

Re: Ally Never Uses 2FA --Should I worry?

Post by VictorStarr »

evelynmanley wrote: Thu Jan 13, 2022 11:11 am
VictorStarr wrote: Wed Jan 12, 2022 12:38 pm I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
Two weeks have passed, but 2FA is still not enabled for my account. I am not going to contact them again, it seems Ally is incapable of enabling 2FA. I use Ally as a pass-through account to transfer money from my main account to a crypto brokerage and usually have only a few bucks at Ally.

Many bogleheads use Ally either as a primary checking or for parking their emergency fund. I would not rely on a financial company that can not implement robust 2FA.
User avatar
aj76er
Posts: 1179
Joined: Tue Dec 01, 2015 10:34 pm
Location: Austin, TX

Re: Ally Never Uses 2FA --Should I worry?

Post by aj76er »

evelynmanley wrote: Thu Jan 20, 2022 11:13 am viewtopic.php?f=2&t=336533&start=100 I've just asked other Bogleheads if they get 2FA on their Marcus accounts.
According to this, 2FA is standard at Marcus:

https://www.marcus.com/us/en/banking-wi ... protectyou

I’m thinking of making the switch. Between what I’ve learned from this thread, and the security issue Ally had last year, I’m becoming uncomfortable holding funds there.
"Buy-and-hold, long-term, all-market-index strategies, implemented at rock-bottom cost, are the surest of all routes to the accumulation of wealth" - John C. Bogle
lawman3966
Posts: 1352
Joined: Sun Aug 10, 2008 12:09 pm
Location: Tacoma WA

Re: Ally Never Uses 2FA --Should I worry?

Post by lawman3966 »

VictorStarr wrote: Thu Jan 20, 2022 9:05 pm
evelynmanley wrote: Thu Jan 13, 2022 11:11 am
VictorStarr wrote: Wed Jan 12, 2022 12:38 pm I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
Two weeks have passed, but 2FA is still not enabled for my account. I am not going to contact them again, it seems Ally is incapable of enabling 2FA. I use Ally as a pass-through account to transfer money from my main account to a crypto brokerage and usually have only a few bucks at Ally.

Many bogleheads use Ally either as a primary checking or for parking their emergency fund. I would not rely on a financial company that can not implement robust 2FA.
I was about to start a thread on this topic, but after searching, I'm glad to see that others are addressing this issue. I have had an experience similar to others listed above. In one phone call, I was assured that 2FA would be set up with me on the phone live. All of those attempts failed. After several additional calls to customer service, and then the "Tech Team," I was told (after about a ten minute wait on the phone) that 2FA would be active in about three business days. It's now been six business days, and 2FA is still not active.

Based on my and others' experience, it's starting to look futile. Consequently, I will be checking out Marcus Bank. If there are any other recommendations for online banking, please free to chime in.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

aj76er wrote: Thu Jan 20, 2022 9:15 pm
evelynmanley wrote: Thu Jan 20, 2022 11:13 am viewtopic.php?f=2&t=336533&start=100 I've just asked other Bogleheads if they get 2FA on their Marcus accounts.
According to this, 2FA is standard at Marcus:

https://www.marcus.com/us/en/banking-wi ... protectyou

I’m thinking of making the switch. Between what I’ve learned from this thread, and the security issue Ally had last year, I’m becoming uncomfortable holding funds there.
I have learned that what's on a bank's website isn't necessarily true, and most definitely at Ally. I called Marcus yesterday, and the rep was very confused about it. At first he said that customers have the option of turning on an alert which will ensure the 2FA code. I asked him to walk me through the steps to do that online. I don't have an account there; I was writing it down. He said he'd open his own account and walk me through it. He went through the steps, then said that alert was gone, but it used to be there a year ago. So then he said that maybe customers do NOT have the option to have 2FA consistently. I'm so fed up with reps not knowing what they're talking about, and because I'm so entirely frustrated by all my phone calls with Ally, I'm not going to sign up with Marcus.

[Edited my comment about contacting Lending Club. They only offer 2FA code when on a new device.]
Last edited by evelynmanley on Fri Jan 21, 2022 8:30 am, edited 1 time in total.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

FedGuy wrote: Thu Jan 20, 2022 7:16 pm
evelynmanley wrote: Thu Jan 20, 2022 11:13 am
FedGuy wrote: Mon Jan 17, 2022 9:24 am When I log in to my Ally account, I see a button to suggest a feature. Has anyone used that to suggest that Ally implement a more robust 2FA?
I don't see that button suggesting that feature when I log in.
Go to Accounts...View Snapshot. Below the list of your accounts there should be a line listing five items: "Feedback," "Ally Community," "Security," "Privacy," and "Legal." Click "Feedback." That should open a pop-up with two options: "Give us some feedback" and "Review our products." Click "Give us some feedback."

Mine doesn't work. Depending on the browser I use, when I click on "Give us some feedback" either nothing happens, or it goes to a new screen but won't let me type anything in it. I'm curious to hear other people's experiences.
The link doesn't work for me either; nothing happens. I tried with two different browsers. I'm completely done with Ally.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

lawman3966 wrote: Fri Jan 21, 2022 5:32 am
VictorStarr wrote: Thu Jan 20, 2022 9:05 pm
evelynmanley wrote: Thu Jan 13, 2022 11:11 am
VictorStarr wrote: Wed Jan 12, 2022 12:38 pm I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
Two weeks have passed, but 2FA is still not enabled for my account. I am not going to contact them again, it seems Ally is incapable of enabling 2FA. I use Ally as a pass-through account to transfer money from my main account to a crypto brokerage and usually have only a few bucks at Ally.

Many bogleheads use Ally either as a primary checking or for parking their emergency fund. I would not rely on a financial company that can not implement robust 2FA.
I was about to start a thread on this topic, but after searching, I'm glad to see that others are addressing this issue. I have had an experience similar to others listed above. In one phone call, I was assured that 2FA would be set up with me on the phone live. All of those attempts failed. After several additional calls to customer service, and then the "Tech Team," I was told (after about a ten minute wait on the phone) that 2FA would be active in about three business days. It's now been six business days, and 2FA is still not active.

Based on my and others' experience, it's starting to look futile. Consequently, I will be checking out Marcus Bank. If there are any other recommendations for online banking, please free to chime in.
I wrote (above) about my experience calling Marcus Bank about 2FA. Discover Bank rep said they never have 2FA codes. [Update: They actually do. I set up an account with Discover and I get a 2FA code every single time I log in.] My brick-and-mortar bank, Bank of America, has 2FA without fail on all my accounts, and if all else fails, I'll put all my savings with them just out of principle and a desire for a bank that prioritizes extra security. I'd hate to forego the interest, but I'm not going to place my funds in a bank that is basically not trustworthy. Offering consistent 2FA is the very least a bank can do.

[Just edited my comment about looking into Lending Club Bank. They don't offer 2FA unless customer is on a new device.]
Last edited by evelynmanley on Mon Jan 24, 2022 1:43 pm, edited 1 time in total.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

Very interesting Bogleheads threat addressing this same issue of banks offering/not offering 2FA:

viewtopic.php?t=364790
User avatar
aj76er
Posts: 1179
Joined: Tue Dec 01, 2015 10:34 pm
Location: Austin, TX

Re: Ally Never Uses 2FA --Should I worry?

Post by aj76er »

evelynmanley wrote: Fri Jan 21, 2022 7:23 am
aj76er wrote: Thu Jan 20, 2022 9:15 pm
evelynmanley wrote: Thu Jan 20, 2022 11:13 am viewtopic.php?f=2&t=336533&start=100 I've just asked other Bogleheads if they get 2FA on their Marcus accounts.
According to this, 2FA is standard at Marcus:

https://www.marcus.com/us/en/banking-wi ... protectyou

I’m thinking of making the switch. Between what I’ve learned from this thread, and the security issue Ally had last year, I’m becoming uncomfortable holding funds there.

I have learned that what's on a bank's website isn't necessarily true, and most definitely at Ally. I called Marcus yesterday, and the rep was very confused about it. At first he said that customers have the option of turning on an alert which will ensure the 2FA code. I asked him to walk me through the steps to do that online. I don't have an account there; I was writing it down. He said he'd open his own account and walk me through it. He went through the steps, then said that alert was gone, but it used to be there a year ago. So then he said that maybe customers do NOT have the option to have 2FA consistently. I'm so fed up with reps not knowing what they're talking about, and because I'm so entirely frustrated by all my phone calls with Ally, I'm not going to sign up with Marcus.

[Edited my comment about contacting Lending Club. They only offer 2FA code when on a new device.]
Thanks for posting your experience. Due to these security concerns, I’m now considering just using one of our brokerages for storing any extra cash (as both are setup to use Symantec VIP authenticator apps). Unfortunately, this means foregoing 0.5% APR on idle cash, but could always use something like ICSH if so inclined.

We use a few “big” banks for our everyday checking needs, and I’ve been using 2FA on those for quite some time. It’s a shame that the smaller high-yield online banks can’t get their security up to par, but I suppose there’s always a tradeoff involved (i.e. “you get what you pay for”).
"Buy-and-hold, long-term, all-market-index strategies, implemented at rock-bottom cost, are the surest of all routes to the accumulation of wealth" - John C. Bogle
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

aj76er wrote: Fri Jan 21, 2022 9:57 am
evelynmanley wrote: Fri Jan 21, 2022 7:23 am
aj76er wrote: Thu Jan 20, 2022 9:15 pm
evelynmanley wrote: Thu Jan 20, 2022 11:13 am viewtopic.php?f=2&t=336533&start=100 I've just asked other Bogleheads if they get 2FA on their Marcus accounts.
According to this, 2FA is standard at Marcus:

https://www.marcus.com/us/en/banking-wi ... protectyou

I’m thinking of making the switch. Between what I’ve learned from this thread, and the security issue Ally had last year, I’m becoming uncomfortable holding funds there.

I have learned that what's on a bank's website isn't necessarily true, and most definitely at Ally. I called Marcus yesterday, and the rep was very confused about it. At first he said that customers have the option of turning on an alert which will ensure the 2FA code. I asked him to walk me through the steps to do that online. I don't have an account there; I was writing it down. He said he'd open his own account and walk me through it. He went through the steps, then said that alert was gone, but it used to be there a year ago. So then he said that maybe customers do NOT have the option to have 2FA consistently. I'm so fed up with reps not knowing what they're talking about, and because I'm so entirely frustrated by all my phone calls with Ally, I'm not going to sign up with Marcus.

[Edited my comment about contacting Lending Club. They only offer 2FA code when on a new device.]
Thanks for posting your experience. Due to these security concerns, I’m now considering just using one of our brokerages for storing any extra cash (as both are setup to use Symantec VIP authenticator apps). Unfortunately, this means foregoing 0.5% APR on idle cash, but could always use something like ICSH if so inclined.

We use a few “big” banks for our everyday checking needs, and I’ve been using 2FA on those for quite some time. It’s a shame that the smaller high-yield online banks can’t get their security up to par, but I suppose there’s always a tradeoff involved (i.e. “you get what you pay for”).
[deleted paragraph about my intention to move funds to Bank of America. I decided to move funds to Discover Bank Savings (see below)]

I wouldn't really have thought about this 2FA issue much, except that my daughter, who is a systems architect, said that she wouldn't put a dime in any financial institution that didn't offer 2FA at the very least. She's set me up with 2FA SMS and/or Authy (https://authy.com/) for all of my online accounts and also set me up with Bitwarden password manager (I love it).
Last edited by evelynmanley on Mon Jan 24, 2022 1:42 pm, edited 1 time in total.
User avatar
samsoes
Posts: 2802
Joined: Tue Mar 05, 2013 8:12 am
Location: Northeast Rat Race

Re: Ally Never Uses 2FA --Should I worry?

Post by samsoes »

Ally Never Uses 2FA --Should I worry?
Never. Worrying is pointless and a waste of time and energy.
"Happiness Is Not My Companion" - Gen. Gouverneur K. Warren. | (Avatar is the statue of Gen. Warren atop Little Round Top @ Gettysburg National Military Park.)
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

samsoes wrote: Fri Jan 21, 2022 10:50 am
Ally Never Uses 2FA --Should I worry?
Never. Worrying is pointless and a waste of time and energy.
Agreed. I took action (moving funds out of Ally) after my initial worry and doing research of other banks. Action is much more productive than worrying and doing nothing.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

Interesting article that addresses which banks do and do not hold you up if you've been hacked and there's an investigation pending:

https://www.mybanktracker.com/news/most ... protection

Next-Day Cash Reimbursement

When disputes are being settled (such as fraud), some banks offer next-day cash reimbursement so their customers have that money in the meantime, instead of waiting months before they get their cash back.

Bank of America and Chase are two big banks that do this, and Discover and Citibank send their customers emergency money if customers' cards are lost or stolen while traveling.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

Update January 24, 2022:

Ally "tech team" never did set up the 2FA on my account, despite three different tech reps saying they were going to do so.

Therefore, I opened up a savings account at Discover Bank (because of this bonus offer which extends to 3/15/22: https://www.depositaccounts.com/banks/d ... nk/offers/) as a trial to see if they send a 2FA security code every time I log in. They do. Surprisingly, within the last few days, Discover increased their interest rate from .4% to .5%, which is the same as what Ally Bank offers. So I transferred my funds from Ally to Discover. I've been very satisfied with the Discover Bank customer service, with the web interface, the ease of opening up an savings online account and taking advantage of the bonus offer (it took 7 minutes), and the ease of ACH transfer.

Ally, I do not miss you.
lawman3966
Posts: 1352
Joined: Sun Aug 10, 2008 12:09 pm
Location: Tacoma WA

Re: Ally Never Uses 2FA --Should I worry?

Post by lawman3966 »

evelynmanley wrote: Mon Jan 24, 2022 1:40 pm Update January 24, 2022:

Ally "tech team" never did set up the 2FA on my account, despite three different tech reps saying they were going to do so.
Ally, I do not miss you.
Thank you for the information about Discover Bank.
I've been considering transferring my Ally Bank balance to my Schwab trading account and using ICSH (short term bond ETF) as a cash replacement.

I'm writing to ask why you prefer having a savings account to having the cash in a trading account, knowing that bond ETFs are available that have interest rates similar to the rates at Discover Bank.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

lawman3966 wrote: Mon Jan 24, 2022 1:49 pm
evelynmanley wrote: Mon Jan 24, 2022 1:40 pm Update January 24, 2022:

Ally "tech team" never did set up the 2FA on my account, despite three different tech reps saying they were going to do so.
Ally, I do not miss you.
Thank you for the information about Discover Bank.
I've been considering transferring my Ally Bank balance to my Schwab trading account and using ICSH (short term bond ETF) as a cash replacement.

I'm writing to ask why you prefer having a savings account to having the cash in a trading account, knowing that bond ETFs are available that have interest rates similar to the rates at Discover Bank.
I am in semi-retirement and exceedingly risk-averse!
User avatar
aj76er
Posts: 1179
Joined: Tue Dec 01, 2015 10:34 pm
Location: Austin, TX

Re: Ally Never Uses 2FA --Should I worry?

Post by aj76er »

lawman3966 wrote: Mon Jan 24, 2022 1:49 pm
evelynmanley wrote: Mon Jan 24, 2022 1:40 pm Update January 24, 2022:

Ally "tech team" never did set up the 2FA on my account, despite three different tech reps saying they were going to do so.
Ally, I do not miss you.
Thank you for the information about Discover Bank.
I've been considering transferring my Ally Bank balance to my Schwab trading account and using ICSH (short term bond ETF) as a cash replacement.

I'm writing to ask why you prefer having a savings account to having the cash in a trading account, knowing that bond ETFs are available that have interest rates similar to the rates at Discover Bank.
Personally, I use my HY Savings account as float for paying off credit cards. So every month, paychecks auto-deposit, and CC payments auto-debit and I don't have to manually do anything (except keep an eye on things, which is easy to do with automated alerts). With ICSH, this wouldn't be possible.
"Buy-and-hold, long-term, all-market-index strategies, implemented at rock-bottom cost, are the surest of all routes to the accumulation of wealth" - John C. Bogle
User avatar
VictorStarr
Posts: 746
Joined: Sat Jan 04, 2020 9:13 pm
Location: Washington

Re: Ally Never Uses 2FA --Should I worry?

Post by VictorStarr »

VictorStarr wrote: Thu Jan 20, 2022 9:05 pm
evelynmanley wrote: Thu Jan 13, 2022 11:11 am
VictorStarr wrote: Wed Jan 12, 2022 12:38 pm I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
Two weeks have passed, but 2FA is still not enabled for my account. I am not going to contact them again, it seems Ally is incapable of enabling 2FA. I use Ally as a pass-through account to transfer money from my main account to a crypto brokerage and usually have only a few bucks at Ally.

Many bogleheads use Ally either as a primary checking or for parking their emergency fund. I would not rely on a financial company that can not implement robust 2FA.

Today I tried to login to my Ally account and was prompted for a security code! After 25 days' wait Ally finally enabled 2FA (security code) on every login. For security code I use Google Voice number so it is relatively secure.
Security code for every login adds small overhead but gives me confidence that my money is protected.

To enable 2FA (if it does not work for you) you have to call and ask to be connected to a Tech Team associate.
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

VictorStarr wrote: Tue Feb 01, 2022 10:12 pm
VictorStarr wrote: Thu Jan 20, 2022 9:05 pm
evelynmanley wrote: Thu Jan 13, 2022 11:11 am
VictorStarr wrote: Wed Jan 12, 2022 12:38 pm I waited for six days, but my account still does not have 2FA enabled. I tried to login using VPN (new location) and new private window, still no 2FA prompt. I have email and SMS with google voice number for security codes.
A few months ago Ally did prompt me for security codes from time to time. I only found the issue with Ally 2FA because of this thread. Potentially a number of customers are affected without realizing it.
Thank you for the update. Do you plan to contact them again by phone? This whole thing is ridiculous. I'm waiting until next week to see if Ally has implemented the 2FA on my account. That will pass the "3-5 business days" that the rep told me it would take.
Two weeks have passed, but 2FA is still not enabled for my account. I am not going to contact them again, it seems Ally is incapable of enabling 2FA. I use Ally as a pass-through account to transfer money from my main account to a crypto brokerage and usually have only a few bucks at Ally.

Many bogleheads use Ally either as a primary checking or for parking their emergency fund. I would not rely on a financial company that can not implement robust 2FA.

Today I tried to login to my Ally account and was prompted for a security code! After 25 days' wait Ally finally enabled 2FA (security code) on every login. For security code I use Google Voice number so it is relatively secure.
Security code for every login adds small overhead but gives me confidence that my money is protected.

To enable 2FA (if it does not work for you) you have to call and ask to be connected to a Tech Team associate.
Wow, VictorStarr! That's great news! As you know, Ally was not able to do that for my account, so I transferred funds to Discover Bank savings account with .5% interest rate and $200 bonus. In my opinion, their customer service far, far surpasses that of Ally, and no problems with automatic 2FA. I got sick and tired of having to call Ally repeatedly, being given wildly different explanations about the situation, and having zero positive result, despite their assurances. I'm glad you were successful!
ovise
Posts: 2
Joined: Mon Jun 06, 2022 12:21 am

Re: Ally Never Uses 2FA --Should I worry?

Post by ovise »

Hello, beside the 2FA is not always active (as some one said we need to call Tech team) is there any other issue with Ally bank ?

@evelynmanley, thank for the sugesstion and I opened Discover bank to take a look and found out they have good system about user friendly, alerts also good, secure message and chatting however there are something I am not happy with
  • 2FA is not always, it is "almost always". I tried both online web and mobile app for serval times a day then after that none of them asking about 2FA. (I did choose No, this public computer) for every time.
  • But the critial thing which let me want to find another bank is their password and user ID management. For example, if i changed the password or user id by online web browser, then the mobile app will not ask for new password or user ID if you have Touch ID/Face ID enabled. It just simply takes Finger or Face from iPhone then goes straight into the account. It is not safe when you lost your phone and change userID and password does not have any impact on the phone.
    • To be fair, I did compare with Bank of America mobile, Capital One app, if i changed the password online then the mobile app will not work (even Touch ID/Face ID are enabled). The mobile app will ask me to update password and re-enroll Touch ID/Face ID)
    • Contacted the Discover agent and they said the mobile app with Touch ID/Face ID enabled will not use password :oops: it only asks for Password at the first time to enable Touch/Face ID
evelynmanley
Posts: 1029
Joined: Tue Sep 21, 2010 9:13 am

Re: Ally Never Uses 2FA --Should I worry?

Post by evelynmanley »

ovise wrote: Mon Jun 06, 2022 2:02 pm Hello, beside the 2FA is not always active (as some one said we need to call Tech team) is there any other issue with Ally bank ?

@evelynmanley, thank for the sugesstion and I opened Discover bank to take a look and found out they have good system about user friendly, alerts also good, secure message and chatting however there are something I am not happy with
  • 2FA is not always, it is "almost always". I tried both online web and mobile app for serval times a day then after that none of them asking about 2FA. (I did choose No, this public computer) for every time.
  • But the critial thing which let me want to find another bank is their password and user ID management. For example, if i changed the password or user id by online web browser, then the mobile app will not ask for new password or user ID if you have Touch ID/Face ID enabled. It just simply takes Finger or Face from iPhone then goes straight into the account. It is not safe when you lost your phone and change userID and password does not have any impact on the phone.
    • To be fair, I did compare with Bank of America mobile, Capital One app, if i changed the password online then the mobile app will not work (even Touch ID/Face ID are enabled). The mobile app will ask me to update password and re-enroll Touch ID/Face ID)
    • Contacted the Discover agent and they said the mobile app with Touch ID/Face ID enabled will not use password :oops: it only asks for Password at the first time to enable Touch/Face ID
Thank you for passing on this very important information about Discover Bank.
FedGuy
Posts: 1677
Joined: Sun Jul 25, 2010 3:36 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by FedGuy »

ovise wrote: Mon Jun 06, 2022 2:02 pmHello, beside the 2FA is not always active (as some one said we need to call Tech team) is there any other issue with Ally bank ?
Their customer service is poor. When I've sent questions through their online messaging system, about 40% of the time I don't get a response, and about half the time I do hear back from them their answer is wrong (often suggesting that they didn't even really read my message).

And if tech support needs to be involved, forget it. Tech support doesn't work weekends, and I don't think they work evenings, so the only time I can chat with them is when I'm at work, when I can't log into my account and do what they're telling me to do. So, I take notes, try it at home that night, call back when it doesn't work, leave a message, hear from them a day or two later when I'm back in the office, and we repeat the process until I stop hearing back from them or I decide it's not worth any more of my time to keep working on the issue.

It's really annoying.
User avatar
aj76er
Posts: 1179
Joined: Tue Dec 01, 2015 10:34 pm
Location: Austin, TX

Re: Ally Never Uses 2FA --Should I worry?

Post by aj76er »

FWIW, my Ally account now has 2FA active. I never requested it, so it seems they just turned it on by default.
"Buy-and-hold, long-term, all-market-index strategies, implemented at rock-bottom cost, are the surest of all routes to the accumulation of wealth" - John C. Bogle
User avatar
Miriam2
Posts: 4387
Joined: Fri Nov 14, 2014 10:51 am

Re: Ally Never Uses 2FA --Should I worry?

Post by Miriam2 »

aj76er wrote: Mon Jun 06, 2022 11:18 pm FWIW, my Ally account now has 2FA active. I never requested it, so it seems they just turned it on by default.
Same for me, used it last night with 2FA for first time without me requesting it.
Makaveli
Posts: 975
Joined: Mon May 19, 2014 11:18 pm

Re: Ally Never Uses 2FA --Should I worry?

Post by Makaveli »

My debit card was recently hacked at Ally, 8 charges hit within minutes. They've refunded me, yet admittedly I fell for the advanced phishing scheme.

Edit: a few post above say 2FA is working. Where is this toggle?
Last edited by Makaveli on Wed Aug 10, 2022 10:58 am, edited 2 times in total.
Gnirk
Posts: 1740
Joined: Sun Sep 09, 2012 3:11 am
Location: South Puget Sound

Re: Ally Never Uses 2FA --Should I worry?

Post by Gnirk »

I “force” 2FA by always using Safari’s private browser to sign in.
lawman3966
Posts: 1352
Joined: Sun Aug 10, 2008 12:09 pm
Location: Tacoma WA

Re: Ally Never Uses 2FA --Should I worry?

Post by lawman3966 »

Makaveli wrote: Sun Aug 07, 2022 9:19 pm My debit card was recently hacked at Ally, 8 charges hit within minutes. They've refunded me yet, and admittedly I fell for the advanced phishing scheme, but no 2FA bothers me as well.

Edit: a few post above say 2FA is working. Where is this toggle?
Once logged in, you can go to "profile and settings" and afteward click on "security code delivery." You should then see options for having delivery codes delivered to you for a secure login.

Every time I log in, I see an option to identify my computer as secure or public (such as at a library or other public place). I always enter the option indicating that it's "public" since that way the system prompts me for a security code on my next login. Otherwise, the requirement for a security code will be waived and the 2FA feature effectively gets removed.
User avatar
VictoriaF
Posts: 20122
Joined: Tue Feb 27, 2007 6:27 am
Location: Black Swan Lake

Re: Ally Never Uses 2FA --Should I worry?

Post by VictoriaF »

Makaveli wrote: Sun Aug 07, 2022 9:19 pm My debit card was recently hacked at Ally, 8 charges hit within minutes. They've refunded me, yet admittedly I fell for the advanced phishing scheme.

Edit: a few post above say 2FA is working. Where is this toggle?
My Ally debit card was hacked on August 1, and 6 charges were made within a minute. I have NOT fallen for a phishing scam; I am assuming there was a breach within Ally.

Victoria
Inventor of the Bogleheads Secret Handshake | Winner of the 2015 Boglehead Contest. | Every joke has a bit of a joke. ... The rest is the truth. (Marat F)
Post Reply