Banks still using SMS

bobblebob

Why are banks still using SMS to communicate with customers when SMS is known not to be secure?


For example im with Halifax and just set up a new faster payment contact on the app. Soon as i did i got an SMS confirming i had set the payment up and if this wasnt me, contact this number (it then gave a number to ring). Similar when i make large payments online, i sometimes get a text confirming its genuine and to ring this number if not.


Now its great they have these in place so you know whats happening on your account, but SMS isnt secure enough for this. A scammer could easily send me an SMS pretending to be from the bank and claim a payment attempt has been made and to ring this number if it wasnt me. This number would then obviously be a scam number that you ring. Because people are getting genuine texts from the bank with numbers to ring, they may not notice a scam as easily.

[Deleted User]

Been discussed many times.
SMS is no more secure than email.

If in doubt, call the number you know for your bank

bobblebob

Well yea thats always been the correct advice, but when banks are texting you a number to call it does open it up for scammers.


Push notifications via the app would be more secure i would have thought

Yorkshire_Pud

How could the scammer send you a scam text just at the moment you are carrying out a transaction especially as the bank would also send the genuine one?

If on the other hand you didn't carry out a transaction and received a text from the bank you might be alerted to a scam, also if a scammer sent a text out of the blue?

bobblebob

Yorkshire_Pud wrote: »

How could the scammer send you a scam text just at the moment you are carrying out a transaction especially as the bank would also send the genuine one?

If on the other hand you didn't carry out a transaction and received a text from the bank you might be alerted to a scam, also if a scammer sent a text out of the blue?

Well if you got a text out of the blue claiming to be the bank about a transaction, you may think someone had attempted to use your card and ring the number on the text.

molerat

bobblebob wrote: »

Well yea thats always been the correct advice, but when banks are texting you a number to call it does open it up for scammers.


Push notifications via the app would be more secure i would have thought

Of course, everyone uses app based banking don't they

bobblebob

But you could offer it as an option for those that do

Rosemary7391

It might be better if they said "Contact us using the number on the bank of your card" instead of giving a number?

unforeseen

Rosemary7391 wrote: »

It might be better if they said "Contact us using the number on the bank of your card" instead of giving a number?

But if you are using Apple Pay or the Android version then you may not have the card on you

sausage_time

unforeseen wrote: »

But if you are using Apple Pay or the Android version then you may not have the card on you

Android pay lets you call the bank from within the app for each card.

jonnygee2

Push notifications via the app would be more secure i would have thought

This is how Monzo does 3DS.

I agree with you, banks texting customers is a bad idea, it gives the impression it's a secure channel.