santander changes

Zanderman

spenderdave wrote: »

Indeed - 'for now' implies the app will soon be mandatory.

No it doesn't. It implies that 'for now' they are not insisting on the App and will still use OTP - and this situation may last some time, possibly indefinitely. There's no implication of 'soon'.

Clearly they will risk losing customers if online access starts to insist on the app - as (despite some people finding this incredulous) there is still a significant minority who either don't use smart phones or don't have up to date ones.

So it's in Santander's interests to keep all options, inc OTP, open as long as possible. How long is anyone's guess. But my guess is that they won't remove OTP soon.

Having said that, the reason for the change, the legislation requiring two stage authentication, will impact on us all, with all banks. The OTP system is not as secure as many assume it is, so is, arguably, not fit for purpose long-term. So Santander, and all the other banks, will be trying new ways, other than OTP in the near future. It will be interesting to see how it all works out.

(btw, personally, as someone who prefers his banking on a proper screen with a proper keyboard sitting at a proper desk, I'm hoping mandatory use of apps is held back as long as possible, but I accept change will come, eventually)

hollie.weimeraner

alanwsg wrote: »

I setup a new payee a few days ago and, instead of sending an OTP as I expected, it said "Login to the app on your phone to authorise".

As soon as I logged-in to the app, the new payee was created.
So, it's already in use.

That happened to me last night

IanManc

spenderdave wrote: »

Indeed - 'for now' implies the app will soon be mandatory.

Zanderman wrote: »

No it doesn't. It implies that 'for now' they are not insisting on the App and will still use OTP - and this situation may last some time, possibly indefinitely. There's no implication of 'soon'.

I disagree. Like spenderdave I think that "for now" clearly implies that the use of OTPs will be temporary.

Why say "for now" otherwise?

Zanderman

IanManc wrote: »

I disagree. Like spenderdave I think that "for now" clearly implies that the use of OTPs will be temporary.

Why say "for now" otherwise?

I didn't suggest it wasn't temporary.

I only suggested it wasn't 'soon' - and indeed could be some time away.

Arthurian

I just feel very uneasy about using my smartphone for banking. However "safe" people tell me it is, I worry about a mugger running off with my phone and being able to ransack my life savings through some sophisticated hack. I have been very happy with Santander, but this might just make me move elsewhere.

cloud_dog

Whilst I appreciate there has been a directive to ensure additional security, this movement towards mandating the use of the institutions app really only benefits the institution by insulating them from individually transacted fraud. If it is transacted via the phone app you will be unable to offer any evidence of fraud.

Whilst this may sound a little paranoid or a bit hyperbol, security measures are there to be defeated and fraud wouldn't exist if there weren't people determined to obtain your hard earned.

Zanderman

Arthurian wrote: »

I just feel very uneasy about using my smartphone for banking. However "safe" people tell me it is, I worry about a mugger running off with my phone and being able to ransack my life savings through some sophisticated hack. I have been very happy with Santander, but this might just make me move elsewhere.

Smartphones really ARE safer for banking than PCs. But your unease is understandable - I don't grasp or understand why or how so many people run their lives through their mobiles - just one gadget that holds (or holds the access to) all their contacts, schedules, money, knowledge, conversations etc. They no longer have to remember anything - the gadget knows (or can find out) all. A gadget which is, er, very easily damaged/breakable, very nickable and stops working if you don't keep plugging it in. Madness.

But... if the banks really are moving towards app-based access for authentication of online banking, even if you do use a PC for the main process, a smartphone may become essential, for whatever bank - not just Santander. So moving elsewhere may not help long-term.

However... as I've said in posts above and you've indicated in your post, the banks will lose customers if they stop using existing systems like OTP so, as I've suggested above, I think they'll keep those 'older' systems going for some time yet. It's just a matter of how long that some time yet is - it may be years...

londoninvestor

Arthurian wrote: »

I just feel very uneasy about using my smartphone for banking. However "safe" people tell me it is, I worry about a mugger running off with my phone and being able to ransack my life savings through some sophisticated hack. I have been very happy with Santander, but this might just make me move elsewhere.

Tend to agree. My last Android phone still works fine, so that might be dusted off, kept at home, and any banking apps I have to use installed there rather than on the one I walk around with.

londoninvestor

Zanderman wrote: »

So Santander, and all the other banks, will be trying new ways, other than OTP in the near future. It will be interesting to see how it all works out.

A few possible ways that would be interesting to see:
- one-time code generators like RSA SecurID
- chip-and-pin based card readers that generate codes (which various banks still have)
- an app that *only* does authentication and doesn't allow your details to be seen or transactions to be initiated

All of which I'd be personally more comfortable with than having the full banking app.

Let's see...

eskbanker

londoninvestor wrote: »

Zanderman wrote: »

So Santander, and all the other banks, will be trying new ways, other than OTP in the near future. It will be interesting to see how it all works out.

A few possible ways that would be interesting to see:
- one-time code generators like RSA SecurID
- chip-and-pin based card readers that generate codes (which various banks still have)
- an app that *only* does authentication and doesn't allow your details to be seen or transactions to be initiated

All of which I'd be personally more comfortable with than having the full banking app.

Let's see...

As I was posting in another thread earlier, it's hardly surprising that banks have interpreted the new regulations in different ways and adopted varying approaches - the technical standards were published in March 2018, 18 months ahead of implementation in September 2019, but with less than three months left to go, the EBA have last week issued an opinion document about what's deemed acceptable!

https://eba.europa.eu/documents/10180/2622242/EBA+Opinion+on+SCA+elements+under+PSD2+.pdf