I’m noticing a frightening trend of services (GoDaddy and M1, so far) suddenly not accepting my Google Auth codes and forcing me to ‘verify’ my identity with a selfie and govt. ID to reset my 2FA and gain access to my account. Is this their way of gaining my ID and selling my selfie? Or at least checking that I’m an adult and citizen?
I’ve verified I’m not blocking anything, including browser ads, and even tried on cellular before scratching my head. They worked last week. And both are requiring the exact same process.
I didn’t give my ID to open either account. M1 is financial, so they pull from my checking account so they know I’m legitimately a human. GoDaddy is more puzzling, but the eerie similarities stopped me from proceeding.
Anyone also having this issue?
I got salty with M1 and said I’ll verify my identity by blocking them from withdrawing money, which I did. I can’t do the same with GoDaddy.
I realize my mistake now when I set up 2FA with these services. They did not have recovery codes as a backup option.
I’m looking for a rebuttal or confirmation of my low-quality conspiracy theory based on almost nothing. …and venting a little.
I had/have that problem with linkedin. Their auth app code just stopped being accepted as valid one day. Their recovery keeps saying “we will help you with your lost phone” and wants me to upload an ID. So far I have declined.
UPDATE: The issue was my iOS clock. Google Authenticator uses the local clock to generate the codes and some ToTP 2FA are more generous with their tolerances of old codes being used. I discovered this when using, of all things, the Amazon app to generate an in-store code that helpfully displayed an ‘out-of-sync’ message below the QR code. This led me down a very weird route.
Thought: My informal and highly un-rigorous poll of friends and family gave me pause. 1/12 would NOT have sent in their selfie with a government ID. 11/12 would have refused to spend any significant time on the problem and just “get it over with”. These are people who spend significant time with digital coupons or internet surveys or other things that net them pennies in savings yet the ethics of my refusal were foreign to them. How many future digital hurdles will be circumvented with just a selfie? What about your updated annual income to increase your credit limit? Or verifying your information when calling a utility to change services? Or open an app for the first time? The privacy implications alone are horrifying to me, but I’d rather engage a bank to make a point to a faceless corporation.