Money moved between my own accounts before being stolen. Neither bank willing / able to help.

km1500

Halifax are still going to want to know how they got into the Halifax banking app because even if you dismiss face ID you are then asked to input random characters of your memorable information which they would not know

yes you can click 'forgotten log on details' but then they would ask you for your username which again a random person would be unlikely to know 

Halifax do say that if you don't know your username they will ask you for your account details instead which may be a weakness that you can complain about. your username is secret but your account details are less so. This may be a weakness in Halifax security.

I only mention this because these are the kind of questions you are likely to be asked. 

born_again

HillStreetBlues said:

dcs34 said:

noh said:

anonymouse666 said:

eskbanker said:

anonymouse666 said:

3 weeks ago my phone was snatched whilst unlocked and 2 of my 3 banking apps were successfully accessed by the thief/thieves.

First things first, how were the thieves able to access bank apps and authorise transactions, even though the phone was unlocked?  What security did you have on the apps, e.g. biometrics, PINs, etc?

Do you have a police report?

Face ID on Halifax, pin on Monzo. 

Once they had my unlocked phone they had access to every bit of personal information about me ever. With that they were able to answer all the security questions asked after clicking “Forgotten your sign in details?” - on Halifax at least. Monzo I’m less sure so far. 

I guess they were also able to change my Face ID / phone pin once they were in and had access to things like Apple. 

I do have a police report. 

Every bit?
I have just tried the Halifax app on iPhone and to gain access they would either need to know your username or sort code and account number of a bank or savings account held with them. Was this recorded without any security on your phone?

Quite possibly stored on an email app with a 'Welcome to your new account' email. Sort codes can be reasonably possible to guess using local branch addresses. 

Downloaded statements would give account info.

Sort code checkers online. Not too many actually relate to a bricks & mortar address now.

But in reality you can not contact that bank, as you have no account with them.
Only hope is money that funds were transferred out of can contact the other bank & freeze any funds that are in there. Of which the chance is very slim.

anonymouse666

eskbanker said:

anonymouse666 said:

Does anyone know if I can / should raise a complaint against Halifax at the same time? I don’t want it to conflict with the current case or anything. 

I think it would be worth complaining against Halifax too, and it won't conflict with the separate complaint against Monzo.  The fact is that you didn't apply for the overdraft or the loan, so even though the proceeds were transferred into an account in your name they still have a case to answer, especially if it was viable for the account security to be breached, although I'd expect them to hold you at least partly responsible for that.

I still can't understand exactly what happened in terms of overriding face ID but how long was it between the theft and you notifying the banks?

Thanks for the advice, i will submit a Halifax complaint too. 

I’m not sure on the specifics of the bank overriding unfortunately, just that they happened. 

The theft occurred about 2am and the reporting was about 8 hours - the time it took for me to get a taxi home, sleep for a few hours, and travel to a friend’s to use their phone to call everyone. 

masonic

Biometric login is usually disabled when any biometrics are changed on the device, with it falling back to password/memorable info, so this really demonstrates the weak link of offering a convenient and immediate password reset facility that relies mainly on possession of the device an knowledge of basic account info. Building in a day or two delay to this process would be somewhat inconvenient for the customer, but very effective against this sort of thing. How often does one genuinely need to reset their security details via the 'forgotten' link? I don't think I've ever done it.

On Android at least, the Halifax app makes you download statements in order to view them. Having those lying around on a device you take out and about is not a good idea. It would be preferable to at least have the option to view them securely within the app without leaving a footprint on the device storage.

Grumpy_chap

The OP needs to have a police report and crime number - this seems to have been done.

The OP needs to file separate complaints with each bank - the banks do not seem to be acting particularly well at present.

There is also a long shot that the OP might have some insurance that might cover the losses. 
Either mobile phone insurance, or as part of a home insurance policy, or even part of the insurance with a packaged bank account type product.  
It is not unusual for home insurance to cover loss / theft of devices away from the home.  Whether that type of element would cover the subsequent fraudulent acts or limited to the value of the device is something I have never considered before today.