Lloyds or Halifax bank accounts are easily stolen

Jeddy

I've tried to alert Lloyds but they aren't interested, so maybe if more people know they may take an interest. Or maybe I'm wrong?

If you have a Lloyds or Halifax bank account it is pretty easy for someone to steal it / take control of it. They will need 3 things.
Bank card (or bank sort code / account number / name on account)
Driving licence (or the persons date of birth)
The mobile phone registered to the account (it's typically ok if the phone is locked).

Given a lot of us carry all three of those with us whenever we leave the house, should you get pickpocketed, mugged or simply leave these somewhere you could loose your bank account.

Maybe someone could sanity check it really is this easy for me?

Go to the e.g. Lloyds personal banking logon page.
Click on Forgotten your logon details.
Click on Forgotten your Userid.
Enter the sort code and a/c number from your bank card.
Enter the first name and surname from the bank card.
Enter date of birth which is easily worked out from driving licence.
You'll now be given the Banking id.
Next similarly for the password, click on the link for a forgotten password. You can now SET a new password!

Next you'll be asked to pick one of the phone numbers for 'security'. I guess if you're unlucky it will take you a couple of attempts to pick the right number for the locked mobile phone you have.
When the mobile phone rings normally you don't need to enter a PIN to take the call, so just answer the phone. Now copy the PIN from the mobile banking session and enter it into the mobile phone.

You can now change the account security information (no additional questions needed to be answered).
Having done that you can now logon to the bank account and do whatever you want, setup a new payee - again that would just be confirmed by entering a number on a received phone call. Make a payment - that just needs the new password, change the email contact details - it's ok, no notification is sent to either email address, just to the mobile phone you have!

All in all, very insecure and yet Lloyds / Halifax don't care!

Zanderman

Jeddy wrote: »

Next similarly for the password, click on the link for a forgotten password. You can now SET a new password!

How?

Jeddy wrote: »

and yet Lloyds / Halifax don't care!

I bet they do.

And, why pick on Lloyds/Halifax for this - have you checked every other bank's recovery options?

enthusiasticsaver

If you "forget" a logon id or password it is emailed to the account holders email address. A fraudster would also need access to that. The email address cannot be changed without gaining access to online banking.

polymaff

I wonder how many people regularly carry bank account details around with them - other than in their heads.

enthusiasticsaver

Any payment made is going to be to a traceable account so that can be traced.

I am not sure Lloyds or Halifax are any different to other banks. Some require 2 part identification so access to a mobile phone. Most of us lock our mobile phones though so the fraudster will also need to know how to unlock the phone. These again are so traceable that they can be found almost instantly. How could the system be made any safer without making it so cumbersome that we spend hours trying to access our accounts?

enthusiasticsaver

polymaff wrote: »

I wonder how many people regularly carry bank account details around with them - other than in their heads.

The details are on the bank cards. Pin numbers of course are the safety brake there providing people are not silly enough to write them down.

mije1983

polymaff wrote: »

I wonder how many people regularly carry bank account details around with them - other than in their heads.

I'd say a very high percentage of people do. You will be in the minority if you don't have any bank cards in your wallet/purse.

polymaff

enthusiasticsaver wrote: »

The details are on the bank cards. Pin numbers of course are the safety brake there providing people are not silly enough to write them down.

Your point being?

enthusiasticsaver

polymaff wrote: »

Your point being?

The bank cards cannot be used alone without the pin numbers (contactless being the exception).

polymaff

enthusiasticsaver wrote: »

...I volunteer to help get your forum questions answered and keep the forum running smoothly

Give it a try, enthusiasticsaver. Neither of your responses were relevant to my post at all.

Compare with mije1983's 100% relevant post.

throwwwwaway

Worked for the online helpdesk for HBOS. Saw some fraudulent online access but never done this way. A customer would have to be very unfortunate to lose a bank card, with an unlocked phone and for it to be a thief with the foresight to look to reset online banking details.

Also, if this did happen I'm sure one of the first things you'd do is tell the Bank....

I'd be more concerned with actual hackers, you'd hope your online banking is protected, sadly there is and, I expect, always will be exploits (you're protected by the FSCS though gang if this is the case) :beer: