Strong Customer Authentication - **Now delayed** changes to online verification

18cc wrote: »

Hi esk could I suggest it is made a bit clearer if you are referring in tnis thread to changes to signing into internet banking (many banks currently use passwords, memorable info etc - this will change) or the second scenario of internet shopping eg using your debit (or indeed credit) card to buy something.

For example, the Natwest link above seems to be for shopping, not internet banking sign in.

A fair point - I think that most are aiming not to reinvent the wheel and to use the same or similar approaches to verification for both purchases and logging in to banking, but that's not universal, as the LBG brands offer trusted devices for online banking but this doesn't apply for purchasing.

However, not all of the banks seem to be making any distinction in what they're publishing, so it's not always clear.

I'll try to think of how to represent this in a reasonably clear way (anyone know how to use tables on here without pasting pictures in from external sources?)

etienneg wrote: »

Credit cards is the area that's concerning me more than debit cards. Joint bank accounts seem to cope properly with 2FA for both of the account holders (that is, OTP is sent to phone of whichever card is being used).

However, it's a different story for credit cards The two I have as main cardholder where my wife is an additional cardholder (Nationwide and Tesco) only support OTP being sent to main cardholder, which is hopeless for the additional cardholder making purchases online. When I enquired, I got the impression nobody had thought of this problem, or maybe just ignored it!

I'd be very pleased for additional or updated information from anyone on this.

Doesn't sound very clever! Hopefully they'll publicise their policies on this to help people decide - I didn't see anything explicitly mentioned in any of the pages linked above.

Edit: I take it back, the M&S page states that they support separate mobile numbers per card, not just one per account.

etienneg wrote: »

One other issue that's arisen for a family member who spends a lot of time abroad is that texts can take a long time (around 1 hour) to arrive, which isn't any use when the OTP expires after 10 minutes!

That'll be the time difference from central Europe

I think this is an inherent weakness in relying on mobile phone networks - the banks already have no control over the networks within the UK and sending messages abroad is another degree of separation. There have been numerous other threads about the obsolescence and poor security of SMS but it's effectively the lowest common denominator at the moment - it'll be interesting to see how much more timely app verification is from overseas, for those in a position to make a direct comparison once these measures are in place.