Investec Bank Security

Peregrina

After a lengthy search for a temporary 'home' for my life savings, I opened an Investec 90-Day Notice Saver account 5.25% AER and am disconcerted to see how shockingly easy it is to access my account. 

The bank gets good reviews on Trust Pilot but there are almost no security checks in place (email address plus simple one-step password entry) and seemingly nothing to deter hackers. It's more difficult to get into a Gmail account!

My question is: If the bank fell foul of hackers or a ransomware attack, is there a legal obligation for my money to be repaid in full?

I am planning to transfer my life savings of £85,000 (ahead of a long-awaited house purchase as a first-time buyer in midlife following a pending Grant of Probate on my late father's will) and need this confirmation in writing before transferring any funds into my account.

There are other possibilities like Monument Bank but I don't want to use an App-only account. 

I'd be grateful for your advice. A swift response would be most helpful. 

MattMattMattUK

Peregrina said:

After a lengthy search for a temporary 'home' for my life savings, I opened an Investec 90-Day Notice Saver account 5.25% AER and am disconcerted to see how shockingly easy it is to access my account. 

The bank gets good reviews on Trust Pilot but there are almost no security checks in place (email address plus simple one-step password entry) and seemingly nothing to deter hackers. It's more difficult to get into a Gmail account!

My question is: If the bank fell foul of hackers or a ransomware attack, is there a legal obligation for my money to be repaid in full?

I am planning to transfer my life savings of £85,000 (ahead of a long-awaited house purchase as a first-time buyer in midlife following a pending Grant of Probate on my late father's will) and need this confirmation in writing before transferring any funds into my account.

There are other possibilities like Monument Bank but I don't want to use an App-only account. 

I'd be grateful for your advice. A swift response would be most helpful. 

If the bank is hacked the yes, ransomware attack then yes (although that would not give them access to accounts in general and I think you misunderstand what one is). If you allowed your account to be compromised then not necessarily no. 

However, banks are not hacked, their actual banking systems do not get compromised in that way. When people say that their bank account has been "hacked", what they mean is that they gave their banking details to a third party (involving an element of deception) and that allowed a third party to access and potentially empty their account. 

Peregrina

That's helpful, Matt. Many thanks for your response. I am well-informed and alert to scams and would not be giving my details away. So your sense is that the easy login process is not an issue? I wonder why all other banks I know of go to such lengths and involve complicated processes to access an account. 

CouldntResist

If you have to use more than one factor to log on it makes it less likely that someone will giveaway the required data to someone asking for it. In theory that is as some people still achieve it

I'd be interested to know how often a bank really gets 'hacked' by someone who has no knowledge of what a valid login would be. I would has hazard a guess it is almost never, and it is always a result of giving the details away or using compromised data for every login

Heedtheadvice

Yes the latter compromised login could be the greatest risk.

Note that some banks do use two factor authentication and more for online access such as password, hardware authorisation and 'random' selection of memorable word letters

Do not forget FCA cover for some cases of any loss up to £85k

Peregrina

Thank you so much to Couldntresist and Heedtheadvice for taking the time to respond. I really appreciate your helpful and well-informed comments. That's really useful and very much appreciated. 

Vitor

Surprising that a bank is not offering multi-factor authentication in this day and age. I'd use a passphrase that followed NCSC guidance and only login from an InPrivate browser session so that passphrase isn't stored.