Strong Customer Authentication - **Now delayed** changes to online verification

Stompa wrote: »

I have no objection to Nationwide requiring an OTP sent via SMS in order to log in to my account. But I'm rather surprised that, in order to tell them my mobile number, I am required to complete a paper 'change of address' form. I would have expected to be able to simply log in to my account (using my existing security credentials - which still work) and add the number.

It would be rather worrying if you could change the mobile number used for security using just your existing security credentials. Though they ought to be able to update this information by phone after asking additional security questions, and of course what is feasible by phone can be replicated online.

Stompa wrote: »

Well, they do say here:

https://www.nationwide.co.uk/support/support-articles/how-to/update-details/change-your-address-or-phone-number

"We can't change your contact details over the phone."

However, it does suggest that I might be able to do so if I used their banking app. So I installed it, and a few screens in it said they didn't have my mobile number, and gave a phone number to call to let them know! That was very straightforward, though I found it somewhat concerning that the only information they asked for were customer number, full name, dob, postcode and email address.

It also suggests there that you can update those details through online banking using your card reader (which I've done myself in the past), so it seems you were misinformed about the need for a paper 'change of address' form.

The reason you can change your details in app without additional security is that the app requires 2FA to set up on your device (card reader, or SMS if mobile is already registered), so your device can thereafter be considered a second factor (as it would anyway once SMS authentication is set up).

Stompa wrote: »

Indeed, but for me it's only use was as a mechanism to get the appropriate phone number to call. The app has now served it's purpose and has been uninstalled.

How did you activate the app if you don't have a card reader and didn't have a registered mobile phone for SMS authentication? Did they send a one time code to your registered email address?

Stompa wrote: »

I didn't. It asked me for a few details (customer number, postcode & dob I think), then informed me that they didn't have my mobile number and gave me a number to call them on.

So they completed the activation of the app when you phoned them? Seems a bit pointless not to make the changes by phone if that is the case.

Stompa wrote: »

Yes, I agree. I didn't bother completing the activation of the app, since all I wanted was to add my mobile number to my account (to enable me access it online when OTP is introduced). Once I'd checked that that had been successful, the app was surplus to requirements.

I'm a bit confused about what actually happened. This is what I originally thought:

1) Installed app
2) Entered information into app to identify yourself
3) Prompted to call Nationwide (as no 2FA options possible)
4) App activation completed over phonecall
5) Mobile number added within app

Or did the app allow you to edit your details after step 2, without NW intervening? Or did NW add the number for you when you used activation of the app as an excuse?