Santander OTP code every time I want to look at my account

robatwork

sausage_time said:

robatwork said:

I sympathise as I have a similar issue, and Santander are intransigent regarding their use of SMS for one time codes. 

My house seems to be in a blackspot of phone reception, and while wi-fi calling makes calls very reliable, SMS doesn't use that network (despite promises otherwise for years - another story for another day). I can only receive SMS reliably on occasion upstairs, or about 200m away at the end of the road. 

When I get sent an OTP that means a trip upstairs or more likely wandering up the road waving my phone around like it's 1997. And hoping I make it back to the PC before it's timed out. 

Just about every other institution or important login that I use has a decent alternative. They will offer to call and read out the OTP. Or send in WhatsApp. Or use Authenticator like like a proper grown-up security proposition. But not Santander. I've asked them a few times if they will offer another OTP method. 

It's a shame as I'm actually very happy with them as my main bank, and this isn't quite annoying enough to leave. 

I'm confused by this.  I just logged into Santander on my computer for the first time in months (checking for interest due on my Easy Access Saver account).  I had to approve via the app, not by SMS.  If that is true for all users won't that work for you @robatwork and others?  App will use Wifi and not rely on the legacy phone network for texts.

That's logging on. Try sending a payment from your desktop. It will either just work, or send an SMS. Not ask for approval via the app. 

sausage_time

robatwork said:

sausage_time said:

robatwork said:

I sympathise as I have a similar issue, and Santander are intransigent regarding their use of SMS for one time codes. 

My house seems to be in a blackspot of phone reception, and while wi-fi calling makes calls very reliable, SMS doesn't use that network (despite promises otherwise for years - another story for another day). I can only receive SMS reliably on occasion upstairs, or about 200m away at the end of the road. 

When I get sent an OTP that means a trip upstairs or more likely wandering up the road waving my phone around like it's 1997. And hoping I make it back to the PC before it's timed out. 

Just about every other institution or important login that I use has a decent alternative. They will offer to call and read out the OTP. Or send in WhatsApp. Or use Authenticator like like a proper grown-up security proposition. But not Santander. I've asked them a few times if they will offer another OTP method. 

It's a shame as I'm actually very happy with them as my main bank, and this isn't quite annoying enough to leave. 

I'm confused by this.  I just logged into Santander on my computer for the first time in months (checking for interest due on my Easy Access Saver account).  I had to approve via the app, not by SMS.  If that is true for all users won't that work for you @robatwork and others?  App will use Wifi and not rely on the legacy phone network for texts.

That's logging on. Try sending a payment from your desktop. It will either just work, or send an SMS. Not ask for approval via the app. 

Absurd that they will use two different mechanisms. I only have £1 in that account so little scope for attempting a transfer.  In the past I transferred to my main current account from the saver from the Santander App.  I don't recall SMS used in that context, but that was a few months ago.

robatwork

I must put my banking cards on the table and say I've had accounts with most if not all the top 10 banks (switching deals mainly) and had a good play with their Apps. Santander's app is superior to all the others and they are excellent in almost every other respect, even when I've needed to call when they blocked some payments. So it's not bad enough to make me move my main day-to-day account away, but when it happens my neighbours do get a dose of healthy Anglo Saxon.

wiseonesomeofthetime

Same, but different , in that Cahoot are part of Santander, but, in the absence of an app, I have had to receive two separate OTP, for two separate logins, about 15 minutes apart, via online banking.

Seems that I can tell Cahoot whether I am sharing my device (laptop), but cannot tell it that I am not and to trust the device 🤷‍♂️

JohnSwift10

Stargunner said:

Do you not have the Santander app on your mobile phone, because if you did Santander would ask you to approve the log in via the app which would be connected to your wifi

But you still need your mobile phone next to you.
I am 80 years old and have my computer upstairs and usually leave my phone downstairs

.........................................................

fluffy_kittens47

Also interested in this, but the reverse. I believe 2FA is an essential component of web based online banking. But my issue is that occasionly, logging into my Santander does not require an OTP.

Unfortunately, contacting Santander was fruitless, as the rep said he understood my issue (though I could barely understand HIM!), but couldn't answer basic questions about browsers, cookies, or even asking me the method by which I was attempting to access my account (app, desktop).

Pehaps Santander should offer the option to the customer of level of security, but in choosing a low level, you accept liablity? If that's not an option legally, then surely always use 2FA, but give the customer choice on how to recieve the OTP (SMS, email).

Accounts with all other institutions REQUIRE an OTP. To have a system that requires OTP SOMETIMES, but not all the time? regardless of cookies, Reckless imo.

GeoffTF

https://forums.moneysavingexpert.com/discussion/comment/81911678#Comment_81911678

Santander has to balance customer convenience with the compensation that they have to pay when something goes wrong. They have to decide when it is worthwhile for them to ask for an OTP on login. For some that is always. For others it is never. In your case it seems to be sometimes.

molerat

https://forums.moneysavingexpert.com/discussion/comment/81911678#Comment_81911678

If access to your device is secure then there is not really a need for OTP every time you log in. If your device is not password protected then you are part of the proble. And if you set your computer to clear cookies on exit it will ask every time I believe.

pafpcg

https://forums.moneysavingexpert.com/discussion/comment/81911678#Comment_81911678

"Accounts with all other institutions REQUIRE an OTP"

Neither LBG (Lloyds, Halifax, BoS) nor RBS/NatWest/Ulster group banks regularly require an OTP to login . In my experience, for both bank groups, an OTP is necessary to login only several times per year (~quarterly?).

What's curious is that Santander asks for an OTP when logging-in only occasionally - it seems to be about weekly (I login daily). But Cahoot demands an OTP every time I login. An OTP is also required when setting-up a new payee, etc.

Santander must use a cookie setting to allow the OTP check to be skipped - logging-in to a different user account resets that cookie. Because my partner and I use the same computer to access our Santander accounts, it's proved simpler to set-up different profiles in our Firefox browser for each of us so we can preserve our own cookies and login, most of the time, without needing an OTP.

The frustrating issue with the Santander/Cahoot OTP is that they use an eight character alphanumeric string - much more cumbersome than the usual six-digit numeric string of most other banks.

fluffy_kittens47

pafpg: regarding the 8 digit alphanumeric thing…absolutely! Why? No need whatsoever! 6 digit numeric is more than enough, and easier to remember!

My browser is set to always delete cookies. So again, why sometimes an OTP not required? Surely this should be something you could adjust in your account, but if it is, I can't find it!

molerat: How do you guarantee a device is 100% secure? 2FA was invented for a reason.

I also have a bit of gripe about their 'person you've paid before' payee list. Without looking at the actual account numbers, I can't verify whom i'm actually paying.

Ah well, I suppose none of them are perfect are they, I wonder if they've ever thought about working together towards a standard…not that any of them seem to be interested in web-based banking…!