NS&I online log-in authentication

emmachizit

I've just given up my landline which was the number I previously used for NS&I 2 step authentication so I'm trying to give NS&I my mobile phone number so that I can log in. 
You have to ring them to change your phone number so I rang. They asked me for my password. I never give anyone my password for anything. I have only one NS&I password - it's to log in online to my account so I ended the call.
Do NS&I really want my online log-in password before I can change my phone number  Do they mean some other password I don't know about?

emmachizit

Thanks  - the person dealing with my call asked me for my password and waited for me to answer  - he didn't say from your password can I have ......... .that's why I stopped the call. I will have to try again so I'll look at their docs before I do.

ColdIron

• Never tell another person your full password, not even someone who works for NS&I

https://www.nsandi.com/help/manage-your-savings/keep-account-safe

emmachizit

Exactly - feeling dumb and spooked, when I ring again - if I get past the robot again and now that I know he'll ask about my password - say the human asks for letter 5 and 10 of my password - what does he do with those bits of information - how does he know from that he's talking to the account holder?

Slinky

Assuming it's like many other financial organisations he (or she) will enter them into the system, and if computer says yes they will possibly ask questions about account number, name, DOB and address. You're expected to keep your password secret so they'll assume if you have the right answers that they are speaking to the right person. There's only so much any organisation can do to verify their security.

Swipe

There is also an NS&I 6 digit pin that you will have set which they may also ask for.

xylophone

You're expected to keep your password secret 

Exactly - and the guidance cites above confirms this - so why was OP asked (it seems) for password?

• Never tell another person your full password, not even someone who works for NS&I

  
  

Janie2008

I had to ring last year to add my phone number to my account.  I had set it up and forgotten to enter it and couldn't log in.  The person I spoke to put me through to another department to compete some security but I'm sure I wasn't asked for my password or any digits from it. 

AmityNeon

https://www.nsandi.com/contact-us

Have your details to hand

To manage your accounts or personal details, you'll need to be registered for our online and phone service. Please have your NS&I number and password to hand.

To whomever you spoke, they should not have asked for your full password. Internal systems used by agents may request specific characters from a customer's password, and if successfully verified, further account/personal details are revealed to the agent to further prompt the customer for identity verification. These systems are fully audited to prevent employee misuse.

It should never be possible for an agent to ascertain the authentication credentials of a customer that permit the agent to impersonate that customer through a customer interface (e.g. web login).

doublemalt

emmachizit said:

I've just given up my landline which was the number I previously used for NS&I 2 step authentication so I'm trying to give NS&I my mobile phone number so that I can log in. 
You have to ring them to change your phone number so I rang. They asked me for my password. I never give anyone my password for anything. I have only one NS&I password - it's to log in online to my account so I ended the call.
Do NS&I really want my online log-in password before I can change my phone number  Do they mean some other password I don't know about?

I phoned yesterday to try and add my mobile number.  I was passed to three different people who all work for NS&I.  Having given all my security answers eg mother's middle name etc I was put through to a different department who asked me to give them a new password.  I was horrified.  We are told time and time again never to give anybody our passwords.  After 30 minutes arguing the point with the poor man at NS&I I had no option but to do as he asked although I was terrified all my money would disappear.  Actually everything was okay and my withdrawal is on its way but I have made a complaint that to ask for your password is unethical and very dangerous.  Definitely open to abuse but no other way to get a partial withdrawal.  With other financial organisations, this would never happen and they have safer ways of altering users details.

Swipe

The person you will have been passed to create a new password will not have sight of your account details. They will have been obfuscated during the process, hence the reason you were passed to someone else.