Online banking using two-step authentication

Victor_Delta

securityguy wrote: »

The problem for banks would be writing terms and conditions to cover different customers having different security procedures. Would people who opted for two-factor be held to higher standards (ie, harder to get money refunded)? Hmm, that doesn't sound like an incentive. Would people who opted for two-factor be held to lower standards (ie, easier to get refunds, ie, harder for those using one-factor to get refunds?) That's going to cause a riot, because the people who would whine about being told to use two-factor will whine all the more about being effectively punished for not doing so.

So a few banks have made two-factor compulsory, but have had substantial customer resistance to it. It's not helped by the fact that they've mostly done it via card readers, with the fundamental security property being proof of ownership of a debit card and associated PIN, which means that people are stuck with a card reader rather than (say) a Smartphone App or a Vasco tag. There's also not been much evidence, at least not published evidence, that those banks have lower levels of fraud, or at least, low enough to pay for the project costs and the customer grief. It's all a bit of a shambles.

My gut feel is that in fact most "password theft" online fraud is actually caused by people giving their credentials to their partners and children, and therefore two-factor doesn't really alter the risk equation. After all, look at all the people who know their spouses PINs, and talk not only about doing online banking for their partner but about doing the shopping by taking their partner's card. Look at all the people who apparently know their partner's and children's PINs for phones, too. If the main threat actors in contested payments are other residents of the same house (I don't know, I'm guessing) then why would two-factor improve matters?

Thanks for some interesting thoughts on this issue. I hadn't thought about the double standards that the banks would have to consider if there were two different ways of accessing one's account. I wonder how the Nationwide (website) gets round this since the 2nd stage of logging in can either be done using a card and reader or just memorable data - it's the customer's choice (and so presumably therefore only has the lower security level of the 2nd option). Perhaps they currently provide both options with the hope of one day removing the second?

As regards your theory that "password theft" online fraud is mainly caused by people giving their credentials to their partners and children (and friends?), is there any evidence to support this theory? Surely, if this were the case, the authorities wouldn't be putting so much effort in to trying to make the internet more secure from hackers and online fraudsters etc.?

System

Nationwide acts differently if you login with memorable data vrs card reader.

Victor_Delta wrote: »

I wonder how the Nationwide (website) gets round this since the 2nd stage of logging in can either be done using a card and reader or just memorable data - it's the customer's choice (and so presumably therefore only has the lower security level of the 2nd option). Perhaps they currently provide both options with the hope of one day removing the second?

securityguy

Victor_Delta wrote: »

As regards your theory that "password theft" online fraud is mainly caused by people giving their credentials to their partners and children (and friends?), is there any evidence to support this theory? Surely, if this were the case, the authorities wouldn't be putting so much effort in to trying to make the internet more secure from hackers and online fraudsters etc.?

Most computer fraud is insider: businesses are defrauded by their staff, or by outsiders working in conjunction with insiders. It would be surprising were domestic fraud to be substantially different.

It's not my research area, but when I've looked at it the banks have been very reluctant to give numbers. However, the main areas of bank fraud today are, I hear, various courier-type fraud (phone calls telling you your cards are being misused and to give them to a courier, plus social-engineering to get the PIN) and two-factor doesn't address that.

Evidence that banking fraud using technical attacks on PCs is happening at scale is pretty thin on the ground.

diamonds

securityguy wrote: »

The usual bad faith objection, made from people who have mobile phones, is "what about people who don't have mobile phones?"

They pay BT Openreach indirectly for service... I pay no line rental for ZILTCH included on a mobile account, if people want to use a landline or pay for it as your choice then banks will end up doing the same (excluding minorities with health issues and pensioners)


Two of my banks accounts opened onlīne dont even have my signature, I have never been asked or signed anything in branch.

diamonds

Mattygroves2 wrote: »

I have no problem with the card readers but areas with bad mobile signal do exist. You would be stuffed in a fair part of Wales if you had to rely on texts.

It was a example, email - nearly every home as PC/broadband and wifi nearby

colsten

Many places in the UK do not have reliable mobile signals, or any mobile signals at all. People living in those places can't use a bank like Santander who insist on texting a confirmation code to a mobile. And no, Santander do not offer SMS texts to landlines.

LBG and TSB are a lot smarter in that respect, as they allow you to receive your confirmation codes on a landline or a mobile.

As someone mentioned earlier, biometric ID verification for online transactions must be the way to go for all banks.

cheesetoast

Mattygroves2 wrote: »

I have no problem with the card readers but areas with bad mobile signal do exist. You would be stuffed in a fair part of Wales if you had to rely on texts.

Halifax and Lloyds let you complete the enhanced auth with their app now, which will work solely over wifi.

grumbler

Halifax and Lloyds can call to a landline to complete it.

Westie983

diamonds wrote: »

They pay BT Openreach indirectly for service... I pay no line rental for ZILTCH included on a mobile account, if people want to use a landline or pay for it as your choice then banks will end up doing the same (excluding minorities with health issues and pensioners)


Two of my banks accounts opened onlīne dont even have my signature, I have never been asked or signed anything in branch.

You will find you have accepted T&Cs online with a virtual signature and a signature capture form posted or will be captured in the future as part of upgrade to systems.
As CNP is used predominantly in branches most of the time which supersedes signature, if this fails you will be asked for signature and ID if it not present to capture.

alternate

I am happy with the way most banks seem to do it. One factor (two step) to log on. Text/App/Authenticator second factor to setup a new payee.

A decent balance of convenience and security IMO.