Tesco Bank Account Security

18cc

I normally use tiddles

Eco_Miser

Pound wrote: »

I don't know what the point of the photo and passphrase is. It's supposed to be so when you're presented the Tesco Bank login page you know it's the real deal because it's the photo you picked. But anyone could put your email address in and see what your picture and phrase is and use it to trick you.

EachPenny wrote: »

Not if you don't use your email address as your online banking username. Having a username which is not obvious is one of the first steps to online banking security.

Even so, the photo adds little if anything to security, as a man in the middle attack will display the correct photo and phrase.
Man in the middle: you log into a spoof site, the spoof site logs into the real site using what you type, and echos to real site's responses to you, then when it's logged in changes stuff to take over.

EachPenny

Eco_Miser wrote: »

Even so, the photo adds little if anything to security, as a man in the middle attack will display the correct photo and phrase.

But as part of an overall package it does help stop some basic level scams.

It is a bit like putting a padlock on your garden shed. Very few padlocks are used in a way which will stop a burglar stealing your tools, but a padlock might be enough to stop the local kids from 'having a look' and stealing your aerosol paint.

Pound

EachPenny wrote: »

But as part of an overall package it does help stop some basic level scams.

I think it helps scammers. Tesco Bank are giving people the message that if you see the picture and phrase then you can be assured that it's safe to enter your password.

EachPenny

Pound wrote: »

I think it helps scammers. Tesco Bank are giving people the message that if you see the picture and phrase then you can be assured that it's safe to enter your password.

But if you use other bank's online banking (e.g. LBG) you are invited to enter a username and password on the first login page and digits from your memorable phrase on the second. How many people stop to check either page is genuine, and how many are happy to just enter their details because the page looks familiar? That familiarity creates exactly the same assurance as the Tesco picture and phrase.

Tesco's sms check on devices they don't recognise is one of the better security measures.