Scam from bank

cx6

Unfortunately, NatWest (and Barclays) are less secure than Lloyds in that  they fall foul of one of the basic bits of security in that the first step in internet logon is to ask you to enter either your bank allocated user number OR card number. This is just plain stupid - allowing something as potentially public as your card number to replace your secret user number.

The scammers didn't know the user number but did have the card (or a copy of it) so could enter the card number.

Don't have Natwest now but I would bet the next step is to enter characters x y and z of password.

onomatopoeia99

Alderbank said:

My accounts are all with LBG but I suspect NatWest is similar...

Cashcard and PIN are of no use for accessing my accounts. Mobile banking needs a bank allocated user number, password and a phone which has been pre-approved (they must know IMEA) plus fingerprint.

Logging on from a pre-approved 'trusted' laptop (they must know MAC no) needs the same user number and password and 3 random numbers from a special word. If it's not a 'trusted' device it also needs a pass code each time sent to my phone.

The MAC for a network adapter does not propagate beyond the local network segment.  In a home that means it gets as far as your router.  A website you access will never see any MAC on your network, not even that on the external side of your router.

Mobile phone apps cannot get the IMEA, both google and apple block their APIs from providing this information to apps.

Alderbank

Thanks for putting me right on that, onomatopoeia. How does the bank's 'trusted devices' stuff work then? Is it just cookies?

cx6

Yes, when you tick 'trust this device' a cookie is placed - clearing cookies will un-trust the device.