Banks still using SMS

masonic

bobblebob wrote: »

Push notifications via the app would be more secure i would have thought

This or an authenticator app would be ideal. Some financial services companies do this. Even the card readers and 'secure keys' used by some banks are a step up from SMS.

Some banks don't even have a secure messaging facility within online banking, let alone their app.

18cc

The perceived Wisdom which I happen to agree with his never ever call any number that has been texted to you or indeed emailed to you

f you're so-called bank so-called contacts you and asks you to call them then call them from a number that you know and trust

mgdavid

bobblebob wrote: »

Well if you got a text out of the blue claiming to be the bank about a transaction, you may think someone had attempted to use your card and ring the number on the text.

Then again anyone with a grain of common sense would spend 30 seconds checking the phone number's authenticity (or not) before calling it.

Zanderman

It's all about appropriateness surely. Nought wrong with the circumstance the OP describes - setting up a new payment and getting confirmation by text. A scammer wouldn't know you'd just set up a payment so would not be sending a text saying 'was this you'. That's surely, therefore, not likely to ever be a problem is it?.

A text out of the blue, unexpected, is another matter. Be wary of those, sure.

But that's not the circumstances described by the OP.

Re notifications 'through the app' - as others have already hinted above, not everyone uses apps for online banking.

Many, instead, use website based banking. Yes, I know that's arguably less secure as it uses browsers, but it's still the norm for many. It has many advantages over apps (other than security) - apps are, to my way of thinking, fiddly and awkward, give me full screen banking with all menus visible and a full size keyboard any day.I only use banking apps when I'm out and only then reluctantly.

And because of ongoing browser-based banking the banks won't be switching from text notifications anytime soon - as it's the only system that copes with all online banking circumstances - browser or app based.

Switching away from SMS to app only would make browser-based banking obsolete - and that would remove banking facilities from many.

masonic

Zanderman wrote: »

And because of ongoing browser-based banking the banks won't be switching from text notifications anytime soon - as it's the only system that copes with all online banking circumstances - browser or app based.

The card readers used by several banks cope with all online banking circumstances, as do the secure keys used by HSBC group. Rather than receiving a one time code by SMS, you generate your own using 'something you have'. Yes, it requires having something other than your phone, but it ought to be an option to turn this on rather than relying on SMS, which isn't a second factor if you are using an app on your phone.

Another solution would be to use email rather than SMS, as this is more flexible and no less secure - more secure if you properly secure your email account.

jonnygee2

Switching away from SMS to app only would make browser-based banking obsolete

They could use a third party app such as Google Authenticator, there's no need to enforce use of the bank's app, and there's no need to stop browser based banking, you can use push notifications in the app to verify the browser. It would be difficult for people without smartphones, but they should probably use card readers as 2FA instead.

masonic

jonnygee2 wrote: »

They could use a third party app such as Google Authenticator, there's no need to enforce use of the bank's app, and there's no need to stop browser based banking, you can use push notifications in the app to verify the browser. It would be difficult for people without smartphones, but they should probably use card readers as 2FA instead.

Another option is Authy, which has desktop apps for Windows and Mac. This is capable of inter-operating with Google Authenticator, so people could take their pick.

EachPenny

18cc wrote: »

The perceived Wisdom which I happen to agree with his never ever call any number that has been texted to you or indeed emailed to you

This is the issue, not the insecurity of SMS.

Banks are wrong to include phone numbers in SMS or emails because it conditions people to expect to be sent numbers rather than looking up the right one.

The best way to address that issue might be to have a standard and easily remembered number (equivalent to 999 or 101) that people could call for advice in a banking 'emergency'. It would need the banks to work together and to fund a shared system, but it wouldn't have to be resource intensive as the process could be largely automated. (E.g. Phone the number, say the name of the bank, the computer re-routes your call to the correct bank's call centre)

It will never happen of course.

Jami74

My teen child (age 15) got a random text asking about a transaction that she hadn't made.

I've talked to her lots about different scams so she showed it to me rather than acting on it. I phoned the bank directly (not via the SMS message) and it turned out to be genuine, someone had tried to make several purchases using an expired card. The bank dealt with it and reassured her that the account was safe.

I was surprised that the bank contacted a child and asked for a response without also contacting the adult associated with the account.

TheBanker

masonic wrote: »

The card readers used by several banks cope with all online banking circumstances, as do the secure keys used by HSBC group. Rather than receiving a one time code by SMS, you generate your own using 'something you have'. Yes, it requires having something other than your phone, but it ought to be an option to turn this on rather than relying on SMS, which isn't a second factor if you are using an app on your phone.

I agree that card readers are a different way of authentication a transaction rather than receiving a code via SMS. But the card reader can't be used to send you a message asking you if a transaction that's just been made is genuine. It's a trade off really - does using SMS to alert customers to potentially suspicious transactions prevent more fraud than the number of customers who fall victim to fake text messages?

The problem is that most (I accept not all) people have a phone that can receive SMS messages. Push messages are great if you have a smart phone and have installed the right app, but they wouldn't work for people who just have a basic mobile. I suspect the number of people who just have basic phones is still sizeable, especially amongst older people.

PS: The banks would love to move to push messages as they are cheaper to send than SMS. So the fact they haven't suggests they do have a reason for using SMS.