One Time Password

bookshelf

Virgin Money emailed me yesterday saying I had to have a mobile phone number to receive One Time Passwords because of the introduction of Strong Customer Authenication (becomes law on 14 Sept 2019). I have a mobile but it doesn't work where I live. On enquiry they said they are not sending OTPs by email. Are other savings providers going to use only mobiles for OTPs? I rang a couple of providers and they hadn't heard of SCA or OTPs. Seems a bit of a muddle...

Asghar

bookshelf wrote: »

I have a mobile but it doesn't work where I live.

Why? Switch to a mobile network where you do get a signal at home.

bookshelf wrote: »

Seems a bit of a muddle...

There is no muddle, you must have been asking the wrong questions.

When banking or shopping online, they are preparing to use their banking app, mobile number or landline to confirm it is you. No email as far as I know.
So be prepared to have them all up to date and working.

DrSyn

1. After reading your post I googled:-

strong customer authentication (becomes law on 14 sept 2019), this turned up among others.

https://stripe.com/gb/guides/strong-customer-authentication

It does appear to be going ahead.


2. My understanding is that each institution can handle it in their own way. If you do not have a mobile phone or the reception is bad, some may do it via landline. Some via secure Email (as normal Email is just an electronic post card).

eskbanker

While SMS has its well-documented security weaknesses, it still seems to have been adopted as the de facto standard for OTPs, so I'd have thought that any financial institution sticking their head above the parapet and announcing an even lower level of security would be asking for trouble!

No doubt the new regime will attract more publicity in the run-up to September, so customer service reps will hopefully be briefed by then, but most of the major players seem to have been making announcements recently....

capital0ne

You can use a landline rather than a mobile - the text will be spoken to you NS&I do this already as do other organisations. If you're online you CAN recv the OTP one way or another

Uxb1

Asghar wrote: »

Why? Switch to a mobile network where you do get a signal at home.

If I may say you are talking from a seemingly "city-urban-centric" position where mobile coverage is a given.
In rural UK the situation is quite different.

I certainly know several places covering parts of several villages where mobile coverage is essentially zero from all networks due to local topography, and the mobile networks are not willing to do anything about it. Presumably becasue for only a few 100 homes is is not worth their while bothering.
In my own location 2G voice sometimes does not get though so the call defaults to voicemail though the subsequent text notification of the message does work.
I can ring several other villages with the same result via mobile - nor does radio reception in my car work in these villages either Not surprisingly the landline still reign supreme.

What would be nice is if HMG ordered the mobile networks to make wifi calling functional on all tariffs as part of this 2FA mobile authorisation roll out.

The change to compulsory 2FA authorisation for all online payments about I think £10 is part of the EU mandated Payment Services Directive 2 rules applying from later this year.

talexuser

I do believe a landline option should be available with a robot voice reading out the 4 pin code.

dividendhero

bookshelf wrote: »

. On enquiry they said they are not sending OTPs by email..

They wouldn't use email for OTP's, the number has a very short lifespan - a few minutes typically

eskbanker

capital0ne wrote: »

You can use a landline rather than a mobile - the text will be spoken to you NS&I do this already as do other organisations. If you're online you CAN recv the OTP one way or another

That could be answering a slightly different question, so could you clarify exactly which institutions you're aware of that will definitely support non-mobile OTPs to authenticate online transactions once SCA is introduced?

talexuser wrote: »

I do believe a landline option should be available with a robot voice reading out the 4 pin code.

'Should' is a bit ambiguous here - do you mean 'my opinion is that Virgin ought to offer this' or 'I have seen something that indicates that Virgin are going to be offering a landline option so OP has been misinformed'?

ColdIron

dividendhero wrote: »

They wouldn't use email for OTP's, the number has a very short lifespan - a few minutes typically

Marcus offers email as an option for its verification code/login PIN. Valid for 15 minutes

dividendhero

ColdIron wrote: »

Marcus offers email as an option for its verification code/login PIN. Valid for 15 minutes

Poor practise..email is inherently insecure. 15 minutes is plenty of time for a hacker to grab and use the OTP