Using mobile banking/investment apps - Security and liability

masonic

rathernot wrote: »

I think the interesting thing is what should be necessary in the ideal world and what happens in the real world

A good example of Natwest doing something dumb that could be pretty easily exploited if you were using Public Wi-Fi or an evil VPN provider.

https://www.troyhunt.com/im-sorry-you-feel-this-way-natwest-but-https-on-your-landing-page-is-important/

Love to know what happens in that scenario where thanks to Natwest's poor decisions you visit their legitimate site and get bounced off to a malicious site because you were on an untrusted or malicious network.

A great example of why banking apps should not be assumed to be secure.

techwatcher

My take on the OP's points:

1. Laptop vs mobile phone. Given your use case with the laptop rarely leaving the house I would say that yes, there is a greater chance of a mobile phone being stolen.
2. Phone security vs laptop. Android DOES have viruses but as long as you're reasonably careful about the apps you install then you shouldn't have a problem. No need for AV on Android.
3. Liability. No difference between mobile phone and laptop.
4. Banking app security. Many banking apps DO have fewer items of information to enter than when accessing via their website. Barclays for example asks for a 5-digit PIN only. However, access is limited to registered devices so someone would have to have your device AND be able to unlock it AND have the 5-digit PIN. Even with such access they could only pay existing payees and transfer funds between accounts. To add a new payee requires information from your debit card.
5. Public Wi-Fi. There are security concerns with public wi-fi, mainly around the use of unencrypted links and the potential for 'man-in-the-middle' attacks where people COULD intercept the communications and redirect them to a 'fake' page from whence they could, potentially, harvest your banking credentials. This IS a risk but it doesn't seem to be a common problem. Banking apps use end-to-end encryption where your data is encrypted all the way from the device to the banks servers and isn't vulnerable to interception so should be safe to use on public wi-fi. Being somewhat risk-averse I would not do banking aware from home, where I have a bit more control over my comms configuration.

badger09

techwatcher wrote: »

My take on the OP's points:

...............
Banking apps use end-to-end encryption where your data is encrypted all the way from the device to the banks servers and isn't vulnerable to interception so should be safe to use on public wi-fi. Being somewhat risk-averse I would not do banking aware from home, where I have a bit more control over my comms configuration.

That is my understanding. I travel extensively, sometimes for several weeks and often use mobile banking apps, sometimes over public wifi.

I've never had a problem. Perhaps I've just been lucky:cool: