Mobile phones and one time passwords

brianposter

Takmon wrote: »

If the phone is owned by someone else they can take the phone away and then a third party could have access to the code and use it to take money from your account.

If the security works, having access to the code doesnt enable anybody to do anything.

Takmon

brianposter wrote: »

If the security works, having access to the code doesnt enable anybody to do anything.

Some people are silly enough to fall for phishing attempts and other things such as malicious software on their computer which will give out their online banking details to the fraudster.

That's why they use OTP as two factor authentication to stop them being able to setup a new payee and take all your money.

If the account holder uses someone else's phone that they don't have control over then it's a risk.

If you think having access to the code doesn't let anyone do anything then next time you get one would you send it to me or post it on this forum?

[Deleted User]

It's not a case of having control of a phone. It's a case of having access to it when the code is sent. Don't try to make things more complicated than they are.

etienneg

johnsmith1890 wrote: »

It's not a case of having control of a phone. It's a case of having access to it when the code is sent. Don't try to make things more complicated than they are.

The truth is that the banks don't have a consistent policy on these things and evolution of their systems over time only adds to the inconsistency and confusion.

OTPs are being introduced for making online purchases using a credit card, which is fair enough. However, for many couples one partner has a credit card and the other is an additional cardholder on the same account. My CC provider has confirmed that the OTP will always be sent to the main card holder, whichever card is being used to make the purchase. They simply have no mechanism for registering and using a second phone number associated with the additional cardholder. They accept that this will introduce problems, but are just going ahead anyway!

I'm afraid things are more complicated than you seem prepared to accept.

Ergates

OPENSPACES wrote: »

Is this the sort of thing that should be referred to the FCA?

No, why would it be?

OPENSPACES wrote: »

Having said that as the banks cannot verify ownership what difference does it make?

The difference is that if you, the customer, lie to them about the phone, then they're not responsible for the consequences (if there are any) of the phone not being yours.

soulsaver

Is it the school hols?