Card reader vs mobile app

Harry227

I've been using Nationwide's card reader for several years now via my laptop, for online banking, and all seems well (so far!).  However, I keep getting hints from the bank to use their mobile app.  Reading about the app, I can see the relative greater convenience, but for me it's not convenience per se but security that is most valued.  But I've wondered whether the mobile app with biometrics is more, or at least equivalent, in its security compared to the car reader. 

I've tried online searching for the answer 'card reader vs banking apps, which is best?" but the results aren't helpful.  Does anyone have any technical knowledge in this area to provide advice? 

Thanks in advance for all helpful feedback. 

HillStreetBlues

Harry227 said:

I've been using Nationwide's card reader for several years now via my laptop, for online banking, and all seems well (so far!).  However, I keep getting hints from the bank to use their mobile app.  Reading about the app, I can see the relative greater convenience, but for me it's not convenience per se but security that is most valued.  But I've wondered whether the mobile app with biometrics is more, or at least equivalent, in its security compared to the car reader. 

I've tried online searching for the answer 'card reader vs banking apps, which is best?" but the results aren't helpful.  Does anyone have any technical knowledge in this area to provide advice? 

Thanks in advance for all helpful feedback. 

My very simple view is banks wouldn't be pushing to use apps if they are inherently unsafer than the card reader.

Olinda99

technically all card readers (with a few exceptions) are interchangeable so there is no benefit in hiding your card reader for example - you might as well leave it in full view 

what card reader security does rely on is the debit card you put in it and of course the debit card PIN both of which you must keep safe 

banking apps rely on a) getting into your phone in the first place and then b) getting into the banking app either by a banking app pin or by biometrics 

so in the generality of things I would suggest banking apps are more secure 

One exception I know of would be First Direct whose card reader is tied to the account and therefore is not interchangeable with any other card reader and therefore if you hid it or put it in a safe or something it would make your account very much harder to hack.  In this case I would choose that over their banking app

although you didn't specifically mention it there was another method of authentication by means of OTP to your phone I would avoid banks that do this as this is the lowest level of security lower than either card reader or app

tacpot12

Your phone can be stolen, and theives can steal them from your hand while you are using them, which means that all the biometric security to unlock the phone is bypassed. They can then use photos of you on your phone to unlock apps that use your face.

OTPs sent to your phone are also insecure if the thieves have grabbed the phone from your hand.

To my mind, the card reader and card are more secure than an app unless the app requires a PIN and biometric data that you are unlikely to keep on your phone. 

lr1277

Technically First Direct’s ‘gizmo’ is a number generator and not a card reader. No card is required but a PIN is required, but I can’t remember if it is the same PIN as your debit card.
I used to have one till 3-4 years ago. When the battery failed and I asked for a replacement, FD said it would take a few weeks. FD suggested using their app which I am now doing. They did say at the time I could go back to the number generator if I was not happy with the app.
However in terms of the code generator I don’t know if that delivery time was due to covid or if FD are trying to nudge people to move to the app. Nor do I know how quickly the code generator will take now if requested.

DasTechniker

Harry227 said:

I've been using Nationwide's card reader for several years now via my laptop, for online banking, and all seems well (so far!).  However, I keep getting hints from the bank to use their mobile app.  Reading about the app, I can see the relative greater convenience, but for me it's not convenience per se but security that is most valued.  But I've wondered whether the mobile app with biometrics is more, or at least equivalent, in its security compared to the car reader. 

I've tried online searching for the answer 'card reader vs banking apps, which is best?" but the results aren't helpful.  Does anyone have any technical knowledge in this area to provide advice? 

Thanks in advance for all helpful feedback. 

I bank with NatWest and this morning wanted I wanted to change the title of one of my accounts. I’m not 100% certain that this can be in online banking but my iPad is to hand so I thought I’d do it via the app. I had to enable and register for biometrics to do this and when that was done, it took three attempts before the new title “took”. Needless to say, I disabled the biometrics after. I always use a card reader when banking online and have done for years.

SacredStephan

lr1277 said:

Technically First Direct’s ‘gizmo’ is a number generator and not a card reader. No card is required but a PIN is required, but I can’t remember if it is the same PIN as your debit card.

Nor do I know how quickly the code generator will take now if requested.

My HSBC device is a Onespan Digipass 270. You choose the pin when you set it up to pair with the account.
I got it from a branch of HSBC - they had a drawer full of them.

sausage_time

I have moved to apps for verification.  The problem with the card reader is that (a) I need to remember where I left it and (b) where my cards are.   Often they are are in different places.  Like many others, I am permanently attached to my phone so it is generally to hand.  So more convenient for me.

Nebulous2

You may find that you need both with Nationwide. Some of the transactions in the app still ask you to approve them with a card reader. I understand that will change with a new app, but it's still the case at the moment. 

jbrassy

tacpot12 said:

Your phone can be stolen, and theives can steal them from your hand while you are using them, which means that all the biometric security to unlock the phone is bypassed. They can then use photos of you on your phone to unlock apps that use your face.

I don't think this is true. Even if someone stole my phone (iPhone) from me while it's unlocked, they would still need face ID, my phone unlock code, or my banking passwords to get into my apps. Face ID is smart enough to differentiate a picture from an actual face as Face ID uses depth information which you would not get with a 2D photo.

In terms of whether to use an app or a card reader, I think both are relatively secure. For the card reader, someone would need your physical debit card and PIN and with the phone someone would need your actual phone, plus your phone unlock code and banking password. Perhaps that makes phones slightly better, but it isn't anything I would lose sleep over.

Nasqueron

tacpot12 said:

Your phone can be stolen, and theives can steal them from your hand while you are using them, which means that all the biometric security to unlock the phone is bypassed. They can then use photos of you on your phone to unlock apps that use your face.

OTPs sent to your phone are also insecure if the thieves have grabbed the phone from your hand.

To my mind, the card reader and card are more secure than an app unless the app requires a PIN and biometric data that you are unlikely to keep on your phone. 

Face ID has long been improved to stop photos working, it uses depth readings which aren't present on photos and won't accept them