HSBC Telephone Banking - No Security! 22 October 2004 at 6:40PM edited 30 November -1 at 1:00AM in Budgeting & Bank Accounts 11 replies 13.6K views

Paul_Varjak

If you have an account with HSBC and access to their telephone banking be aware that it is not secure!

Often you are told to visit your branch to give them the account number and password. That means one HSBC employee knows both your account number and password! Insist on entering the password yourself onto their computer at the branch!

If you change you password you can do so via HSBC telephone banking but, again, you have to do this by giving the account number and password to the HSBC employee on the end of a telephone line!

Banking institutions always say that you should not disclose your password to anyone - not even the Police. So, why is HSBC different?

I am now moving the accounts away from HSBC in haste!

bridiej

Bizarre, because they say it on their website etc that you should never ever reveal your password / security number!

Sounds a bit suss to me!

Paul_Varjak

Bridiej:

I have spoken to managers at three different branches of HSBC who all confirm that is the way that HSBC handles passwords for telephone banking.

One of those managers even read to me from the HSBC porocedures manual on dealing with passwords - and the normal method (in-branch at least) to set-up a password is to give your account number and password to them verbally and they type it in on the computer!

I have also spoken to numerous managers on telephone banking who confirm that any change of password over the telephone requires me to give account number and new password to one member of staff!

When I wrote with a complaint they phoned me up to say these are their normal procedures! Again, they quoted from the staff manual!

All the staff I complain to have the same answer. That their staff are bound by the Data Protection Act and would not steal my money because they would get the sack!

So far, HSBC have not had the nerve to confirm their policy/procedures in writing!

Spendless

I'm with First Direct - part of HSBC and have never encountered a problem with my password - you have several things to tell them and never the whole word just one of the letters from it eg the 3rd letter from your password.
Me and hubby both with FD and once when I had a cold and they misheard my initial cos it sounds similar to hubbys initial they not only told me it was incorrect and I realised what had happened and explained but they also informed my hubby that someone had tried to access his account.

Paul_Varjak

I have now received a written reply from Rupert Holroyd, deputy manager of Customer Support at HSBC.

Mr. Holroyd states that HSBC staff can access customers’ accounts at any time and they do not need a security number to do this. He also states that under the terms and conditions of their employment, staff may only access an account when there is a legitimate reason to do so. He also states that it is a disciplinary offence for any member of HSBC to access a customer account for any reason, other than in their official capacity as an employee of the bank.

I have since spoken to Mr. Holroyd and he accepts that a single member of staff has access to both account and corresponding password during password set-up. However, he also told me that he is absolutely satisfied that ALL HSBC staff are totally honest and that no member of HSBC staff would ever access a customer’s account using the account and password details the customer has given them for any fraudulent purpose.

How does he know every HSBC employee is 100% honest?

MarkyMarkD

I agree with you that this seems to be insecure. But honestly, any member of a bank's telephone banking staff can access your account and do what the heck they like with your money - say after the end of a genuine transaction which you have performed yourself.

The benefit of them having the password details is that they can pass the details on to an accomplice, or telephone the banking centre themselves from a payphone or PAYG mobile, and then make dubious transactions.

It's not that they can do any more than they could anyway, it's just that it would be harder (impossible?) to trace the perpetrator.

Sensible banks issue the security details separately directly to the individual and without details of the account appended.

MSE_Martin

I have been in conversations with HSBC as someone has been threatening to post security information about them on these boards.

Please be aware that will break all rules of this site and anyone doing so will have their posts removed and permission to participate removed.

If you have information about HSBC security breaches, please send them direct to me titled 'HSBC security breach'. I am happy to look at it and potentially publicise the story of a problem, but am not happy to participate in exacerbating the security of individuals accounts.

Martin

Paul_Varjak

Have now applied for a Lloyds TSB account online. And will, hopefully, get £7.50p cashback from GreasyPalm and £30 from Lloyds TSB.

Paul_Varjak

The security problems with HSBC banking apparently also apply to FIRST DIRECT - a telephone banking service owned by HSBC!

us,thecat&thedebt

Hi

I Dont Know If Its Do With Area's But We Bank With Hsbc And When Ever We Go Into Branch Like Last Week When We Wanted To Get An O/d The Member Of Staff Asked My Partner To Enter The P/w Into The Computer She Gave Him The Keyboard And Looked Awy....

As For Over The Phone I Dont Know As I Deal Online Were They Only Ask You For Parts Of Yr P/w

Dont Take No Rubbish You Dont Have To Give Your P/w To No One!!!

amandathepanda

Bank staff have access to your account number and password at any time , they need this information to be able to identify you . A staff member logs on to a computer with their own staff ID so that at any time the bank can identify who has looked at a customers account. They are only permitted to look at an account when requested, they are not allowed to look for marketing purposes, or for curiosity. Say for an example a famous person banked there , they would not be able to look at the account just for their own purposes. This would be classed as a disciplinary procedure. At no point are staff members allowed to known customers PIN numbers for their cards.