Halifax credit card and ISA + trading accounts linked

[Deleted User]

Hello

I have a Halifax credit card and a Halifax stocks & shares ISA + a linked share trading account.

I have two separate sets of login user names and passwords:

- One for the credit card account.

- One for the ISA + linked trading account.

Recently the Halifax linked the accounts together. What this means is that when I now log in to my credit card account I can see my ISA + trading account details without having to enter my ISA & trading account username and password. I was very uncomfortable with this from a security point of view so I complained to the Halifax. Their response in not so many words was effectively "Sorry but that's how it now is so I'm closing your complaint".

Today I have logged in to my credit card account & then later (as a test) clicked through to my ISA and went as far as the share dealing screen without having to enter any ISA username or password relating to this account. To me this seems incredibly stupid and is a security breach waiting to happen.

I assume this affects everyone with Halifax credit cards and ISAs and trading accounts. Is what the Halifax have done illegal in any way or does it breach any regulatory code, data protection code etc?

[Deleted User]

No, it's not illegal.

noh

Halifax have as you say made a customer's share dealing account available when logging into online banking.
I don't have any problems with it. It doesn't appear to be less secure than it was previously.
Money can only be paid out of the sharedealing account to the nominated bank account and money can only be paid into the share dealing account from the nominated debit card.
It certainly is not illegal and does not breach any regulations.
More info here 
https://www.halifax.co.uk/investing/help-and-guidance/existing-customer/online-banking-updates.html

eskbanker

Bill_66 said:

Hello

I have a Halifax credit card and a Halifax stocks & shares ISA + a linked share trading account.

I have two separate sets of login user names and passwords:

- One for the credit card account.

- One for the ISA + linked trading account.

Recently the Halifax linked the accounts together. What this means is that when I now log in to my credit card account I can see my ISA + trading account details without having to enter my ISA & trading account username and password. I was very uncomfortable with this from a security point of view so I complained to the Halifax. Their response in not so many words was effectively "Sorry but that's how it now is so I'm closing your complaint".

Today I have logged in to my credit card account & then later (as a test) clicked through to my ISA and went as far as the share dealing screen without having to enter any ISA username or password relating to this account. To me this seems incredibly stupid and is a security breach waiting to happen.

I assume this affects everyone with Halifax credit cards and ISAs and trading accounts. Is what the Halifax have done illegal in any way or does it breach any regulatory code, data protection code etc?

But everything is still protected by a username and password?

If you're unhappy about it, vote with your feet and take some or all of your business elsewhere - if you're concerned about linkages you could use two (or more) different companies next time....

[Deleted User]

Yes everything is still protected by a username and password - mainly my credit card username and password, which now gives me full access to my ISA and trading account (the separate ISA/trading account username and password does not give me access to my credit card account).

I still think this is a security breach waiting to happen. Yes I can vote with my feet but where to? I already have accounts with Hargreaves Lansdown and AJ Bell (in order to keep within FSCS limits) so don't want to transfer to them. I'll need to find another (decent) stocks and shares ISA provider. What a hassle.

eskbanker

Bill_66 said:

Yes I can vote with my feet but where to? I already have accounts with Hargreaves Lansdown and AJ Bell (in order to keep within FSCS limits) so don't want to transfer to them. I'll need to find another (decent) stocks and shares ISA provider. What a hassle.

Keeping investment holdings to £85K per platform doesn't have the same significance or benefit as doing so when capping cash per institution if that's what you're doing, but there are plenty of other options out there anyway!

https://monevator.com/compare-uk-cheapest-online-brokers/ is a summary of the pros and cons of many players - IWeb is a badged version of the Halifax platform so is probably best avoided if you're wanting to make a point of moving away from Halifax.

[Deleted User]

"Keeping investment holdings to £85K per platform doesn't have the same significance or benefit as doing so when capping cash per institution"

Not sure what you're saying there. In the event of a stocks & shares ISA / trading account provider going bankrupt (it has happened) then the investments are protected upto £85,000 per institution (limit now the same as for cash). If the individual investments within an ISA/trading a/c turn bad then that's not covered, obviously. But it's the account provider/platform cover that I deem desirable - so I keep each provider a/c below the FSCS limit from an initial investment standpoint - although the less said about that the better given how stock markets have performed recently.

[Deleted User]

Oh, forgot to say thanks for the link (I cannot see how I can edit my post).

eskbanker

Bill_66 said:

"Keeping investment holdings to £85K per platform doesn't have the same significance or benefit as doing so when capping cash per institution"

Not sure what you're saying there. In the event of a stocks & shares ISA / trading account provider going bankrupt (it has happened) then the investments are protected upto £85,000 per institution (limit now the same as for cash). If the individual investments within an ISA/trading a/c turn bad then that's not covered, obviously. But it's the account provider/platform cover that I deem desirable - so I keep each provider a/c below the FSCS limit from an initial investment standpoint - although the less said about that the better given how stock markets have performed recently.

It's because of the way investment assets are ring-fenced from those of the platform itself, meaning that failure of the latter is highly unlikely to impact on the recoverability of the client assets, and so losses actually requiring FSCS protection to be deployed would typically only be a small proportion of holdings (if any), unless investing in particularly niche or exotic instruments.

The issue of not needing to cap investments on a platform at £85K is discussed fairly regularly over on the savings and investments board, so there's one just started this afternoon but plenty of others going back further:
https://forums.moneysavingexpert.com/discussion/6191685/fsa-account-protection-for-stocks-and-share-accounts
https://forums.moneysavingexpert.com/discussion/6070466/fscs-for-investments-query/p1
https://forums.moneysavingexpert.com/discussion/6024411/fscs-investment-protection/p1
https://forums.moneysavingexpert.com/discussion/5973788/fscs-protection-on-investments

[Deleted User]

Sorry but I strongly disagree with your assertion "of not needing to cap investments on a platform at £85K".

There have been a number of brokers go into administration. See here for a brief overview:

(Argh - I cannot post links as I'm new. It was an article on the Investors Chronicle website covering this issue with examples of brokers who have gone into administration)

Ultimately most people have not lost money but plenty of nightmares were had by account holders when administrators made claims against client accounts. Suffice to say that the last ditch FSCS £85K protection is something that I want on my accounts after looking into this issue extensively, although everyone has to decide on their own level of risk acceptance / aversion.

But this is way off topic and it's a discussion I did not come here for.

D3xt3r5L4b

Halifax OLB login is a username, password and then random characters from a memorable/chosen word, right?

I don’t see the issue...