West Brom BS Security

dosh37

Should I be concerned by the apparent lack of online banking security on the West Brom BS website?

To login, all you need is account number, date of birth and a 4 digit PIN.

There is no password, memorable information or two factor authentication.

AmityNeon

If you try to do anything involving account management, SMS (or landline phone call) OTP verification is then required.

flaneurs_lobster

Well I'm concerned, it does seem to be an outlier when considering the dozens of other institutions that hold money for me, I'm not recalling any other that hasn't implemented at least some form of 2FA (or an app protected by the app & device security).

You might argue that this is of less concern since withdrawals can only be made to authenticated nominated accounts in the same name - but that is not really the point.

subjecttocontract

I agree I can see why you are concerned but, I only have a regular saver with them and the sums of money involved are relatively  small so I think the risks are ok for me. 

[Deleted User]

It doesn't concern me tbh.

NanookOfTheNorth

Having two different areas to log in for their WebSave or Savings Portal isnt very user friendly needing different password/PIN, just have one common platform with 2FA etc

x44

dosh37 said:

Should I be concerned by the apparent lack of online banking security on the West Brom BS website?

To login, all you need is account number, date of birth and a 4 digit PIN.

There is no password, memorable information or two factor authentication.

Have a look at GS Marcus's login then....

All you need is email (hardly secret) and a password and you are in

The rational is as with others that you can only withdraw to your nominated account so if anyone unauthorised does gain access they cannot themselves get any money to their own accounts.

Santander I recall just has a username which you can 'save' on your computer and a pin for login

It is quite possible though that GSMarcus (and probably West Brom/Santander ) are storing cookies on your computer so that if those are not present then some form of 2FA is then used....

pafpcg

x44 said:

dosh37 said:

Should I be concerned by the apparent lack of online banking security on the West Brom BS website?

To login, all you need is account number, date of birth and a 4 digit PIN.

There is no password, memorable information or two factor authentication.

.....

It is quite possible though that GSMarcus (and probably West Brom/Santander ) are storing cookies on your computer so that if those are not present then some form of 2FA is then used....

Definitely true in the case of Santander.

Section62

pafpcg said:

x44 said:

dosh37 said:

Should I be concerned by the apparent lack of online banking security on the West Brom BS website?

To login, all you need is account number, date of birth and a 4 digit PIN.

There is no password, memorable information or two factor authentication.

.....

It is quite possible though that GSMarcus (and probably West Brom/Santander ) are storing cookies on your computer so that if those are not present then some form of 2FA is then used....

Definitely true in the case of Santander.

Not for just logging in to Santander online banking.  I clear everything from each session, the Santander login process sometimes requires an OTP, but more often than not will allow me through to the accounts page with only user ID + 5-digit security number.

Once in I don't always need an OTP to make a payment either.

As for West Brom, I'm on the 'not really an issue' side - the PIN prevents other people seeing what I have in the accounts and accessing other information, and is as 'secure' as any of the PINs on debit cards I have, which (in the right circumstances) could allow access to thousands of pounds.

DRS1

NanookOfTheNorth said:

Having two different areas to log in for their WebSave or Savings Portal isnt very user friendly needing different password/PIN, just have one common platform with 2FA etc

And you cannot transfer direct from one to the other.  To get money from a WebSave account to a West Brom account it has to go out to an external account.

allegro120

dosh37 said:

Should I be concerned by the apparent lack of online banking security on the West Brom BS website?

To login, all you need is account number, date of birth and a 4 digit PIN.

There is no password, memorable information or two factor authentication.

I think these three provide enough security for viewing your accounts.