Bank request full password for SCA

creativecritique

This morning CO-OP bank verbally requested I provide a full password to set up SCA on a Visa card, on querying the sanity of this (I.e. bank will never ask you for a full password) it was explained by the advisor they were processing so many request about password issues they would never remember mine and therefore it’s was not a security risk.  Am I missing something here, that’s bonkers isn’t it ?

TadleyBaggie

Are you certain you were talking the real Co-op bank? Did you call them their published contact number?

creativecritique

Absolutely it was the COOP bank 03457 212212.  

penners324

Did they call you or vice versa? Sounds like a scam

creativecritique

I called them, I know it was the Coop for sure, the call wait time was over 20 mins.  Needless to say I didn’t proceed, but something is badly wrong if they think that’s ok yeah ?

Chino

creativecritique said:

Needless to say I didn’t proceed, but something is badly wrong if they think that’s ok yeah ?

If you're sure it was The Co-operative Bank that you telephoned you would have been better off making a formal complaint to the bank than posting here:
https://www.co-operativebank.co.uk/help-and-support/feedback/index

creativecritique

I did complain to the advisor on the original call.  Further, here’s the response from CO-OP following my Trustpilot review today - “I'm really sorry to hear about the issues that you've had with this and I will ensure your feedback is passed on regarding this. Advisors do need to set up passwords on Verified by VISA for customers and they do need you to provide the full password in order to do this”.  Seems CO-OP consider sharing a password with their staff is NOT a security breach.  They don’t seem to understand the fundamentals of password security; very very wrong they are operating in this way.  It’s not clear however if this is CO-OP or constraints of VbV, whatever it makes a mockery account security IMO.  How many accounts are potentially being put at risk is anyones guess.

SuperAllyB

If you're wanting to set up a new password over the phone, how else can they do it? The "bank will never ask you for your full password" surely refers to existing passwords.IMO you're getting your knickers in a twist about nothing.

[Deleted User]

Can't you then change that password after the process is set up ?

Grumpy_chap

I had a similar issue when setting up password for First Direct.
Not sure what the resolution need to be, but setting password over the phone is crazy.

Marchitiello

SuperAllyB said:

If you're wanting to set up a new password over the phone, how else can they do it? The "bank will never ask you for your full password" surely refers to existing passwords.IMO you're getting your knickers in a twist about nothing.

I cannot remember which bank it was as I bank with many banks and I rarely use telephone banking, but I have experienced processes where the advisor put the call on an automated system where you reset the password, then once is done the call is returned to the advisor. Pretty sure it was at least two banks that had similar processes in place.