Using a card reader to sign in online

tribetown

To sign into one bank online and use certain functions I use a card reader and another bank do not have that option, they require a mobile number to send a pass code to.

Which do you think is the safest and least likely to get scammed?

kaMelo

Whichever method of security is used it is only as strong as the weakest link, the weakest link in any scam is almost always the user.

flaneurs_lobster

The card reader is secure when

- you have possession of the card
- you enter a PIN which only you know 

The pass code sent to your phone is secure when: 
- you have possession of the phone
- you need to unlock the phone to read the code

if you've not entered a lock code on your SIM
or you have a weak/no phone lock 
or you display notifications on a locked screen

then the card reader is more secure.

Overall answer is "It depends".

grumpy_codger

IMO, a card reader is safer - at least because of SIM swap fraud - https://www.natwest.com/fraud-and-security/fraud-guide/sim-swapping-scams.html

That said, both options can be 'scammed' and it's difficult to say which one is more likely.

Olinda99

for me the safest option has nothing to do with the two alternatives you mention, it is choosing a bank that gives you a unique online  'userid' that you can keep secret eg nationwide, lloyds compared with one that allows you to use your sort code account no as your userid eg barclays

Eyeful

1. Out of the two options mentioned, its the card reader.
Some banks provide a hardware card reader, some a card reader app.
2. Other ways if the bank allows it. is to use either
(a) Passkey
(b) Yubikey.: https://www.yubico.com/
Yubikey is just one make of security key, others are available.
3 You can investigate all ways by looking at YouTube videos.

sausage_time

Some of my financial institutions let me use an Authenticator app. 

tribetown

Many thanks for the answers.
To respond to a few points.

I was not aware that I could enter a lock code on my SIM.

I actually like the card reader method. The bank representative that does not provide this option told me the mobile phone method was safest.

I do have a Yubikey and use it for as many sites as I can, no banks that I use have a Yubikey option.

flaneurs_lobster

tribetown said:

I was not aware that I could enter a lock code on my SIM.

This lock is of use in the specific case where your (locked) phone is stolen and the SIM removed and placed in another phone. Not an issue for eSIMs which are locked to a specific handset.

Probably more important is to use a mobile service provider who enforces a robust process when a replacement SIM is requested - many don't. I'd like my SIM to be replaced only when I attend a store in person with photo ID and a PIN code.

Section62

tribetown said:

I actually like the card reader method. The bank representative that does not provide this option told me the mobile phone method was safest.

They were fibbing.

As others have already alluded to, bank security relies on certain assumptions being true.  The difference between a card reader and SMS is primarily in the specifics of the assumptions being made.

tribetown

flaneurs_lobster said:

tribetown said:

I was not aware that I could enter a lock code on my SIM.

This lock is of use in the specific case where your (locked) phone is stolen and the SIM removed and placed in another phone. Not an issue for eSIMs which are locked to a specific handset.

Probably more important is to use a mobile service provider who enforces a robust process when a replacement SIM is requested - many don't. I'd like my SIM to be replaced only when I attend a store in person with photo ID and a PIN code.

Thank-you for the reply.
I have a PAYG SIM with a company that does not have shops in the high street. I ordered the SIM online about 3 years ago and requested to keep my current phone number. I do not think the SIM is locked to my handset.
I have not needed to contact them before but there is a contact number. Is it worth me calling them and asking if I can set up a SIM lock code, word or number in case someone tries to order another SIM?