RBS online security

c_smith

It would appear these security lapses have been going on for quite some time ........

http://www.guardian.co.uk/money/2008/aug/26/consumeraffairs.banks

An investigation has been launched into how a computer holding personal details of high street bank customers was sold on eBay for £35.

Information including the bank account numbers, phone numbers, mothers' maiden names and signatures of 1 million customers of American Express, NatWest and the Royal Bank of Scotland were reportedly found on the computer.

Yes, RBS take their customers privacy and security VERY seriously! And they have the cheek to insinuate that my computer must have a virus and it's my fault security was breached.

metalstardust

See my new post

RBS

Somebody got round their security checks and cancelled a card and got emergency cash.

As it was outside office hours!!!! RBS did not ask for the random letters/digits from pass code/word. So with a few simple bits of information they got round the security checks

And yes they blamed my PC. I work in IT security and I know my PC is firewalled, has anti virus, anti spyware and gets regular scans. So it was not a key logger etc.
And the PC has no account numbers on it, no direct debit info, no utility bills, no maiden names on it, no DOB etc etc.

So their lack of normal checks allowed the fraud.
Had they run the normal checks = no fraud.

If they are doing different checks sounds like the out of office hours is an off shore operation who they don't trust with the password/passcode information.


I have been with them for 12 years but I think it's time to leave.

coldhandoff

Out of hours security would be asking questions about direct debits and stuff like that. Someone must have compromised your bank account in some way. All customer contact in the RBS group is in the UK.

JohalaReewi

Looks like there might be a problem with the emergency cash feature...

https://forums.moneysavingexpert.com/discussion/4102341

c_smith

I've received a response to my complaint. They have accepted there were some failings and customer service issues, but have "confirmed" that my computer was infected by a trojan and this is how the persons responsible managed to gain access to my account.

I'd like to know how they can confirm that. Quite clearly what they're doing, is trying to pass the failings in their own security onto me. And I'm not having it. They believe my computer is infected, I believe it's not. And I would suggest, as I have suggested to them, that the fact none of my other online accounts have been compromised, tends to rule out the trojan theory. They're not prepared to accept this however.

I also suggested to them that the process of being able to reset both the PIN and password at the same time to gain immediate access to an account, is a major security flaw. I suggested that this process only be allowed to reset one or the other, but if someone claims to have forgotten both, then new reset codes are sent out in the post. Their reply to this is that this would inconvenience their customers and would not be fair on them!!!

They also claim to have no record of my email address ever having been changed. This is utter bullsh!t, as I saw it with my own two eyes on one of THEIR branch computers, when I visited the branch to get this sorted out. And it was their branch representative who changed it back for me.

So, I'll now be writing to the ombudsman to bring these issues to their attention, as I seem to be talking to the wall with the bank.

jalexa

c_smith wrote: »

I've received a response to my complaint. They have accepted there were some failings and customer service issues, but have "confirmed" that my computer was infected by a trojan ...

Are you at the "final response" stage? "Confirmed" (as a statement as opposed to a theory) is quite a hostage to fortune. If not at the "final response" stage that would be a good issue to pursue.

Regarding the email record, there might be be no change record unless the change was transactional, (though under SAR you should be able to request copies of all emails sent to "you"). Given our low opinion of some aspects of RBS systems analysis that would not entirely surprise me. I would also at this stage "set a trap" (or "prepation of the ombudsman battleground") by requesting transcripts of "your" telephone contacts that resulted in the issue.

maxberan

Rapport bumped me off after noticing a trojan (for which I am grateful as it was genuine) however I've had a devil's own job getting back on to internet (or telephone) banking. I've been given the runaround, bounced from pillar to post, for a fortnight and today it emerges via a chat that there is a "marker" on two of my rbs accounts. Anyone here familiar with this jargon, what it means, and who can deal with it. My branch, even advised by their "ops" advisors haven't got to the bottom of it - one staff member suggested I closed that account!

pmduk

c_smith wrote: »

I now have real concerns about the standard of RBS digital banking security and the fact that someone can contact them with publicly available information about me,

Their security can't be too bad if they spotted the problem before it lost you/them any money. People can and do lose/forget passwords all the time. Banks need to have a process to get customers back online quickly and have to tread a fine line between custopmer service and security.