Bank account hack without breaking into (stolen) mobile phone

Granadalad

Just discovered from a BBC broadcast that online banking typically allows your cashpoint card PIN to be viewed. If your phone and card are stolen together, fraudsters can easily set up online banking on THEIR phone. A one time access code is then sent to YOUR phone, but unless you have blocked notifications to your locked screen, the access code will briefly be revealed without even having to hack your phone.

Just checked my Android phone and altered settings to "Don't show notifications" on Lock Screen. Easy to fix, but some poor souls had lost thousands in no time.

Bradden

Good tip about notifications on lock screens.. thanks for sharing.

Thumbs_Up

Usefull to know. You should post on the Banking section. More traffic there.

Brie

Same applies to those of us with a smart watch.  I can see the notifications looking at my watch.

MalMonroe

Hi, many thanks for that. I wasn't aware and I have now also turned off 'notifications' on my android phone. 

I also realised I was daft (not daft now, though) because my debit card was tucked into one of the little pockets of my mobile phone cover. Handy for me but of course really handy for thieves and hackers. Duh!

Rectified.         

SiliconChip

Granadalad said:

Just discovered from a BBC broadcast that online banking typically allows your cashpoint card PIN to be viewed.

I don't know what the BBC broadcast actually said but it's not typical for the PIN to be visible in online banking. A few banks do allow it but most don't. None of the banks that I worked for on PIN processing systems between 1987 and 2008 held the PIN in a form where it could be viewed by either the customer or a member of staff, and i think it's extremely poor security for those banks that do allow it. I'm actually rather surprised that it's not against the VISA/Mastercard/Amex regulations, but apparently it isn't.

tacpot12

For iPhones, if you use the notification centre, you should also stop this being visible on the lockscreen. Instructions for this (for iPhones) are available here: How to Disable Notification Center on iPhone Lock Screen (howtogeek.com)

Browntoa

I don't buy it

My banking app doesn't open without biometrics ( fingerprint) , a pin , or password and 2FA .

Without any of the above your card PIN in never visible to a Thief.

I suspect someone had their app pin stupidly written down and available for use by the thief.

To set the app up on another phone I need access to the app on the old phone .

custardy

This will be the usual half story from the media.
I have 5 banking apps on my phone. 
All require passwords/fingerprints to access the app, let alone pin details.
Thats assuming someone got my phone whilst it was unlocked in the first place.

Mnoee

Well, I tried this with my amazon newday card - to see if I could set up the app on a different device with just my locked phone and card.

It asks for my username. 

If I have forgotten my username, it wants my last name (on the card), date of birth, postcode AND card details.

That seems secure enough to me!

Edited: Tried first direct too. It wants my username, no option at all if I can't remember it. 

Edit again: Starling needs a text message sent to my phone!!!... And then my password. Seriously, what banks only need your mobile number, as I am running out of cards here. 

It might be possible with some banks, but in my very scientific experiment looking at just two three cards... 

Ectophile

I don't think it's got anything to do with breaking into banking apps.

If you use your card online these days, it's very common to get a text message with a one-time code that you have to enter into the web site.  So someone can go on a spending spree with your card (or even a photograph of both sides of your card) and phone without ever hacking into any apps.