Chip Feedback

masonic

Bridlington1 said:

allegro120 said:

Bridlington1 said:

I set the chip pin up yesterday. There doesn't seem to be any option to set up face ID though this is not unique to the Chip app to be fair.

This option appeared only after I set up 4 digit PIN. 

All I can find is this:

What's needed is a device-controlled face ID system. This should involve sensors that can't be fooled by pictures etc. If you device doesn't have its own robust faceID technology (where your biometrics never leave your device), then the app absolutely should not offer it as it is horrendously insecure using just a smartphone camera (and involves the app developer harvesting your biometrics). If you don't have a proper face ID set-up on your device, then any app that offers it should be treated with the greatest suspicion and contempt - these are the organisations that will compromise your identity information and give you a massive identification headache. Don't let them scan your face!

Bridlington1

masonic said:

Bridlington1 said:

allegro120 said:

Bridlington1 said:

I set the chip pin up yesterday. There doesn't seem to be any option to set up face ID though this is not unique to the Chip app to be fair.

This option appeared only after I set up 4 digit PIN. 

All I can find is this:

What's needed is a device-controlled face ID system. This should involve sensors that can't be fooled by pictures etc. If you device doesn't have its own robust faceID technology (where your biometrics never leave your device), then the app absolutely should not offer it as it is horrendously insecure using just a smartphone camera (and involves the app developer harvesting your biometrics). If you don't have a proper face ID set-up on your device, then any app that offers it should be treated with the greatest suspicion and contempt - these are the organisations that will compromise your identity information and give you a massive identification headache. Don't let them scan your face!

I don't know if my phone has any sensors or not but I know it doesn't have the option to be locked with face ID so I'd assume it doesn't have any. I have tried face ID in the Natwest and Atom apps before but these tend to be a bit hit and miss as to whether they actually work or not with them struggling to recognise my face if it's raining or dark outside so I reverted to using pins in the end. As a result I don't normally bother with face ID. I appreciate the warning though.

Zaul22

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

masonic

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

grumbler

masonic said:

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

What extra security? You send them a message through the very same app and they remove the nominated account. Then your add a new one.

masonic

grumbler said:

masonic said:

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

What extra security? You send them a message through the very same app and they remove the nominated account. Then your add a new one.

Are you saying that they go through no identity verification steps before removing the existing linked account?

grumbler

masonic said:

grumbler said:

masonic said:

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

What extra security? You send them a message through the very same app and they remove the nominated account. Then your add a new one.

Are you saying that they go through no identity verification steps before removing the existing linked account?

Not that I remember. And it took them more than 24 hours despite they "typically reply within a day". Hardly a surprise if they are busy with manually dealing with such routine actions that can be done by customers without their intervention.

masonic

grumbler said:

masonic said:

grumbler said:

masonic said:

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

What extra security? You send them a message through the very same app and they remove the nominated account. Then your add a new one.

Are you saying that they go through no identity verification steps before removing the existing linked account?

Not that I remember. And it took them more than 24 hours despite they "typically reply within a day". Hardly a surprise if they are busy with manually dealing with such routine actions that can be done by customers without their intervention.

Wow. If true, then that's a red flag, and a potential breach of the Payment Services Regulations around carrying out actions that may imply a risk of payment fraud without strong customer authentication. At best, a message being sent from within an app that doesn't come with any sort of password protection by default, is single factor authentication.

Bridlington1

masonic said:

grumbler said:

masonic said:

grumbler said:

masonic said:

Zaul22 said:

I just realised Chip can't even change your nominated bank account without having to talk to the apparently non existent customer service staff. Why would they not add that feature when it's pretty much a basic function of Truelayer anyway? Maybe you can do it by going into the current account and removing Chips Truelayer permissions? 

Mainly because of the lack of security in the App. It would be quite a concern if the nominated account could be freely changed without additional security. Customer service staff exist on working days 8am-8pm.

What extra security? You send them a message through the very same app and they remove the nominated account. Then your add a new one.

Are you saying that they go through no identity verification steps before removing the existing linked account?

Not that I remember. And it took them more than 24 hours despite they "typically reply within a day". Hardly a surprise if they are busy with manually dealing with such routine actions that can be done by customers without their intervention.

Wow. If true, then that's a red flag, and a potential breach of the Payment Services Regulations around carrying out actions that may imply a risk of payment fraud without strong customer authentication. At best, a message being sent from within an app that doesn't come with any sort of password protection by default, is single factor authentication.

I can confirm I changed my nominated account from Lloyds to Nationwide by sending them a message in the app only 2 months ago. No additional security was required.

If someone else had got hold of my phone at that time and got past my lock screen I wouldn't have known until I'd checked my emails and seen an email from Chip telling me that my nominated account had been removed and that I would be prompted to add a new debit card next time I logged into the app. They never even sent me a message telling me they'd received a request to change my nominated account details beforehand. 

I was able to make a withdrawal to my new nominated account that same day. 

masonic

Well that is an unsatisfactory way to handle such a change, to say the least. They don't actually have any password or security questions on file, other than personal information collected during application, so that puts them at quite the disadvantage when confirming they are chatting to the account holder.

Zaul22 is probably on to something when mentioning revocation, as requiring the customer to revoke TrueLayer access, which can only be done after logging in to the linked bank, would verify that it is really the customer who wishes to make the change (any fraudster who could do this probably wouldn't need to change the linked account). They could fall back to the selfie holding ID document method that they use for changing the phone number for situations where the customer cannot revoke access. All could be done without CS intervention.

It gives me pause to reconsider my use of Chip. A change of linked account does require verification of the new linked account holder's name, I don't know how strictly that is being checked, and it might not be enough for a targeted attack involving identity theft. Personally I think I keep my devices sufficiently secured not to be too concerned about that, but if they are not following regulatory obligations here, what else are they doing wrong that I don't know about?..