Another Victim of NatWest's Insecure Banking Security Systems

jonnygee2 wrote: »

Barclays real line of security is its card reader system. I don't know Natwest but by the sounds of it this works in a similar way. This system is effectively a three step security system which needs a physical card + reader + pin number + online banking details to break, making it pretty much impenetrable.

Physical card and PIN would be enough.

That gives you the surname (1st step) and card number (2nd step) (either that or account number work in lieu of membership number).

Then last 4 digits of the card number (again) and the PINSentry code. (3rd step and bingo!)

Any PINSentry device will work, so you only need to steal/obtain the physical card and PIN.

A_Nice_Englishman wrote: »

The OPs mother may or may not have been a victim of 'NatWest's Insecure Banking Security Systems' but she has been a victim of crime. Has it been reported to the police?

Gordon Bennett, you're right. Someone (including me) should have thunk of that.

https://www.actionfraud.police.uk/reporting-fraud-and-cyber-crime

Barclays allow you to log in without the card reader. Actually, all those using card readers or number generator gadgets allow you to log in with or without them. If you logged in without them, you'll need the card reader etc for certain transactions, e.g. for setting up a new payee.

Yes you are right of course. But this is where you have to differentiate between privacy and security. While logged in you can see someones bank account info, maybe their salary and a load of confidential information. But that doesn't actually jeopardise the money itself.

Barclays, Natwest etc then have this really funny, but perhaps sensible, split where they allow you to send money to known payees using only the login details. I guess this is a kind of 'known risk'. They know these details are not perfectly secure, but also the risks of sending to known payees is very low.

So they only put in the real security steps for transfers to new payees. Personally, I don't like this split between known/new payees at all and the first time I understood it I thought it was kind of doomed.

But actually, I will admit that it does seem to prevent the vast majority of fraud and I;ve come round to see the logic in it. I don't think it's as frictionless as it could be for the user and I think the 'accepted risk' of letting people transfer money to known payees with just the login information is not necessary. There has been an (admittedly incredibly rare) version of fraud that exploits this known vulnerability. But by and large, it does seem to prevent a lot, Imagine in the OPs scenario, for example - they wouldn't have even needed to phone her, and the fact they needed to go through all the rigmarol of phoning her and getting her to authorise the transaction for them shows how secure they think the system is, even after they've gained access to her online banking.

If you are with these systems my best recommendation would be to delete all saved payees. This causes a lot of friction to the user (you!) but it does make your account far more secure.