Strong Customer Authentication - **Now delayed** changes to online verification

adindas

pafpcg wrote: »

That's what it says on the website, but in practice.....

My partner has always had difficulty with the tiny physical keypad so has inevitably used the password route to login to online banking. To check that this month's payment to the regular saver was credited this morning, she tried to login but having supplied the passphrase etc, the system demanded that the smartphone app be downloaded and activated before proceeding - there was no other option such as using her Digipass keypad. She now has to ring up FirstDirect to somehow regain access (inevitably, FirstDirect phone lines are busy).

Investigating further, I found that she has no option at ANY stage to choose the login route using the physical keypad. For my account, at the first step, I was given a choice or either using the keypad or the password route; I was able to login using my keypad. Could it be that someone who used the password route the last time they logged-in (a month ago) is directed to a login screen which doesn't give the keypad option?

PS: We don't use smartphones - we use a simple PAYG mobilephone for Santander's OTP text messages.

It happened recently so it might be something to do with Strong Customer Authentication to online verification ??

It might be similar to my personal experience with HSBC as well.
I used to login using the "physical" secure key. But since about a a year ago I stop using it to log in as I could by pass it with memorable information.

But since recently it keep asking me to login with secure key. I still had the secure key so tried to log in with my secure key but it seemed no field to enter the secure code.

I rang them and they informed that my secure key has been unlinked. They were asking to install the apps to get access to digital secure key, I rejected it. They informed me I could still use the Physical secure key for future online banking login but they will need to send me a new one and need to be activated again. I now have had the new physical secure key for about two weeks and I could do logging again using "physical" secure key.

Your op experience might be the same with mine. At least you could try to ring them to explain it.

Rich2808

Just to add the 5 September HSBC deadline for using a physical or digital secure key for all logins is not correct.

As of today I must use a secure key to login to my account via the app - internet banking was changed last week. Same applied to another family member.

So this supposed 5 Sept deadline is entirely arbitrary and they can impose it at any time - and for some already have.

Would have been useful to know they were going to change things today in advance rather than just doing it!

Would be nice to give a firm date and stick to it for all customers!

mrochester

I now can’t login to the HSBC app on my tablet without my phone being nearby to provide a code. Somewhat makes the tablet app redundant, does it not, HSBC? I also can’t activate the digital secure key on my tablet because that’ll deactivate the key on my phone.

How do I get out if this silly loop?

Rich2808

mrochester wrote: »

I now can’t login to the HSBC app on my tablet without my phone being nearby to provide a code. Somewhat makes the tablet app redundant, does it not, HSBC? I also can’t activate the digital secure key on my tablet because that’ll deactivate the key on my phone.

How do I get out if this silly loop?

So does that mean you can only use the HSBC digital secure key on one device only - or can you use multiple devices (e.g. tablet, phone etc)?

And if you set up digital secure key does that make the physical key redundant or can you use both still (e.g. digital for app and physical for PC/laptop)?

I have set up digital secure key on my first direct account app - which they also removed password access on this morning again without any prior warning of the date it would happen. Luckily I had my phone and access to my email account to do this.

If the changes are supposedly coming in on 5 September (as advertised) - why are HSBC/FD making the changes now with no warning on your previous login (i.e. this is the last time you can login with your username and password only - so check your email and phone details or you may be locked out next time).

I accept the change is being made - but implementing the change 3 weeks before the advertised date isn't great!

mrochester

Rich2808 wrote: »

So does that mean you can only use the HSBC digital secure key on one device only - or can you use multiple devices (e.g. tablet, phone etc)?

And if you set up digital secure key does that make the physical key redundant or can you use both still (e.g. digital for app and physical for PC/laptop)?

I have set up digital secure key on my first direct account app - which they also removed password access on this morning again without any prior warning of the date it would happen. Luckily I had my phone and access to my email account to do this.

If the changes are supposedly coming in on 5 September (as advertised) - why are HSBC/FD making the changes now with no warning on your previous login (i.e. this is the last time you can login with your username and password only - so check your email and phone details or you may be locked out next time).

I accept the change is being made - but implementing the change 3 weeks before the advertised date isn't great!

You can definitely only have the digital key active on one device at a time meaning you always need to have your digital key device with you when you login via another device (curiously enough, the HSBC website still allows login without the digital key).

I don’t know whether you can use digital and physical keys at the same time.

masonic

mrochester wrote: »

I don’t know whether you can use digital and physical keys at the same time.

No you cannot. A physical key will be deactivated upon set up of a digital key. It is strictly one active key per online banking account and one online banking account per key.

It's a shame really, because having two or even three devices active does not significantly weaken the security, though it should be limited to a small number with the ability to deactivate any device that was no longer used.

mrochester

masonic wrote: »

No you cannot. A physical key will be deactivated upon set up of a digital key. It is strictly one active key per account and one account per key.

It's a shame really, because having two or even three devices active does not significantly weaken the security, though it should be limited to a small number with the ability to deactivate any device that was no longer used.

It just makes it inconvenient to use. I login frequently login Via my tablet when I don’t have my phone and now I can’t do that.

Rich2808

masonic wrote: »

No you cannot.

It's a shame really, because having two or even three devices active does not significantly weaken the security, though it should be limited to a small number with the ability to deactivate any device that was no longer used.

FD also forced me to activate a digital secure key to login in via their app today (no physical key option was given) - and therefore I assume my existing FD physical secure key is redundant (as I was only given the digital key option when I logged in on my pc later - the six digit code is a bit of a faff to generate!)? I only use FD for the regular saver so not a big deal. I see this has caused real issues for customers above - how many physical keys are FD going to have to issue with a 2 week wait to get round this?

But it sounds like its best to stick with the physical key then for my main account which is with HSBC - as that's free to replace in a branch (so you can get back on line within hours) and allows you to login on multiple devices (whether I have my phone or not) whereas if the phone I have the app/digital key on is lost or stolen I won't be able to login for days until I get a new phone and sim?

Or is there an alternative process in place for logging in if your digital key phone is lost or stolen or no longer works - which of course can happen?

masonic

Rich2808 wrote: »

I see FD forced me to activate a digital secure key to use the app today - and therefore my physical secure key is redundant (as I was only given the digital key option when I logged in on my pc later - the six digit code is a bit of a faff to generate!)?

Yes, FD appear to be phasing out the physical ones. I was pushed towards making the switch earlier this year (though I don't think it was mandatory at that time).

So best to stick with the physical key then for my main account which is with HSBC - as that's free to replace in a branch (so you can get back on line within hours) whereas if the phone I have the app on is lost or stolen I won't be able to login for days until I get a new phone and sim?

Or is there an alternative process in place for logging in if your phone is lost or stolen or no longer works - which of course can happen?

If you have another mobile device (such as a tablet), the process of setting up a new digital key is quite straightforward (or so I understand). Failing that, you'd probably have to fall back to telephone banking for a few days (presuming of course you have a landline ).

Rich2808

masonic wrote: »

Yes, FD appear to be phasing out the physical ones. I was pushed towards making the switch earlier this year (though I don't think it was mandatory at that time).


If you have another mobile device (such as a tablet), the process of setting up a new digital key is quite straightforward (or so I understand). Failing that, you'd probably have to fall back to telephone banking for a few days (presuming of course you have a landline ).

Maybe HSBC and FD could provide free smartphones or tablets to all their banking customers - just so they can continue to bank with them?!..

Its fine for me - annoying yes - but if you have elderly parents who are HSBC customers and don't have smartphones........So best to keep it physical rather than digital!

What is poor is that FD/HSBC have given a publicly stated changeover date of 5 September - and ignored it and forced people to change over nearly a month before.

Any one know what M&S are planning - as they fall under the same umbrella with the similar secure key etc. Will this also affect credit card online access too - or just bank accounts?