Security alert over NatWest online banking

Paul_1977

According to the Daily Mail, if someone is an RBS/Natwest customer, and your phone is nicked, they can raid your account.

http://www.dailymail.co.uk/news/article-3475126/Security-alert-NatWest-online-banking.html

A high street bank has admitted that a serious flaw in its online banking system has allowed criminals to raid accounts.
The problem means fraudsters have been able to take control of online accounts and snatch thousands of pounds through stolen mobile phones.
The revelations identify a serious failure in the security systems of the NatWest, which is part of RBS, and it is promising to introduce new safeguards.
Mobile and internet banking has been promoted by the big banks as convenient and secure.
However, an investigation by the BBC Radio 4’s You and Yours programme proved it is possible to hack into an account using a stolen mobile phone.

The investigation was launched following consumer complaints that money was disappearing from accounts without any logical explanation.
People who asked their bank for help were often batted away and told they must have allowed their bank details, account numbers and internet log-in passwords to be stolen.
In fact, researchers were able to show it is possible to raid someone else’s bank account without having any of the log-in details and passwords.
Concerns focus on the mobile banking services run by NatWest, however there are reports of similar problems with other banks.


Read more: http://www.dailymail.co.uk/news/article-3475126/Security-alert-NatWest-online-banking.html#ixzz41rUFx1kW
Follow us: @MailOnline on Twitter | DailyMail on Facebook

Read more: http://www.dailymail.co.uk/news/article-3475126/Security-alert-NatWest-online-banking.html#ixzz41rUDEpoh
Follow us: @MailOnline on Twitter | DailyMail on Facebook

marleyboy

Far be it for me to worry about anything The DM has to say, I imagine one would have to at least have some form of banking system on their phone for it to become any sort of a risk.

Be that I have NEVER used my phone for banking, not even so much as browsing, I think my account is pretty safe should I lose my phone.

Paul_1977

Do you have your mobile phone registered to the account?

grumbler

marleyboy wrote: »

Far be it for me to worry about anything The DM has to say, I imagine one would have to at least have some form of banking system on their phone for it to become any sort of a risk.

Well, they seem to say this pretty clearly:

Mobile and internet banking has been promoted by the big banks as convenient and secure.
However, an investigation by the BBC Radio 4’s You and Yours programme proved it is possible to hack into an account using a stolen mobile phone.
...
Concerns focus on the mobile banking services

gunsandbanjos

This is just sim swap fraud and has been around for ages.

colsten

gunsandbanjos wrote: »

This is just sim swap fraud and has been around for ages.

Not specific to Natwest, either.

Worth remembering that fraudsters need a lot more information than a phone number to be able to do a SIM swap, and to access a bank account.

GingerFurball_2

Is there actually a worthwhile story here or is it simply hysterical nonsense from the Mail?

marleyboy

Paul_1977 wrote: »

Do you have your mobile phone registered to the account?

Nope....My PAYG is not registered to ANY account other than my phone provider.

gunsandbanjos

GingerFurball wrote: »

Is there actually a worthwhile story here or is it simply hysterical nonsense from the Mail?

Sim swap fraud is definitely a thing, it's something to be wary of.

gunsandbanjos

http://www.moneyweb.co.za/archive/how-internet-banking-and-sim-swap-fraud-happens/

In case anyone doesn't know how sim swap works.

masonic

gunsandbanjos wrote: »

http://www.moneyweb.co.za/archive/how-internet-banking-and-sim-swap-fraud-happens/

In case anyone doesn't know how sim swap works.

Does setting up and requiring a SIM PIN offer any protection against this, or can that measure be easily bypassed? I note it isn't mentioned as a countermeasure.

Edit: nevermind, the article first mentioned "cloning" the SIM card, but later goes on to describe porting phone number to a new SIM via the phone company, which obviously can be done using social engineering.