Has your bank’s authentication changed?

I’ve gone back to Branch banking and monthly paper statements.
So much for this digital revolution.
It has become too complex and time consuming.
Customer Service (if you can find it) has become Customer Dis-service.
They wish to avoid Personal Service at all cost.
They forget that ‘my time’ is valuable too.

No issues (problems) have been caused when I have logged in to internet banking nor when I have made a credit card payment on-line. I use a card reader for the banking access and for the credit card payments the card issuer sends a One Time Password [OTP] to my mobile (portable) phone. I have to remember to have my phone to hand when I am placing an order on a website because the OTP times out quite quickly. The implementation of this long-overdue protection seems to have gone quite smoothly. My credit card issuer requires SCA for every on-line transaction. My bank requires no such control for debit card transactions made on-line [so far as I am aware – it could be that my payments have been below a threshold for strong authentication].

I use three banks for day to day money management. No problems at all with First Direct and Lloyd’s whose 2FA processes are fine but then…there’s Cynergy Bank. They have managed to introduce a process and an app that appears to be a (failed) primary school project. It is, possibly, the most inept app I’ve seen – you should read the comments on the Apple App Store as most others think so as well. Time to go elsewhere where the bank has actually done some customer trialling beforehand to check it actually works.

I have become accustomed to Natwest sending a one-time passcode to my mobile when logging in to online banking. That’s not a problem because I have the mobile with me if I am away from home, unlike my card reader.

I’m shocked that many banks and credit card issuers have recently introduced SMS as a form of two-factor authentication. SMS is one of the most dangerous forms of two-factor authentication, because it is susceptible to SIM swap fraud, which was covered in depth by BBC Watchdog.

Furthermore when travelling in some countries, I can’t receive SMS on my UK SIM card, so there needs to be an alternative. Some banks and card issuers can send an e-mail instead, but this breaks the principle of this additional factor being something you have and instead being something you know (i.e. the password to your e-mail account). There should be an outright ban on using SMS as a form of two-factor authentication; it represents extreme laziness by the financial services industry.

Logging in M&S Bank now requires you to have an app or a physical pass gadget that they will supply. As I only have a credit card account, all I need to do is view my statement once a month, so not worth downloading the app or applying for the pass gadget. Why can’t M&S send a one-time passcode to the customer’s mobile phone, a method which many other banks have adopted? The alternative is to go back to having statements sent by post.

Since February 2020, I’ve been in conversation with the Financial Ombudsman regarding Santander’s reduced (IMHO) security feature they apparently introduced as part of the Payment Services Directive (PSD2) regulation. Prior to the change it was necessary when logging on to enter one of 3 randomly selected characters from a password, combined with 3 randomly selected numbers from a passcode.

The new logon procedure requires me to enter all 5 of my passcode numbers only. In addition, if I Chat online or talk to a Santander agent (yes it does still happen occasionally), I have to supply 3 of the 5 passcode numbers. When I do logon, there’s not even the option of an OTP (which as said earlier has been discredited by the Watchdog TV programme.)

My complaint has not been upheld, as the Ombudsman advises Santander haven’t fallen foul of any of the directives contained in PSD2. I don’t think PSD2 was ever meant to strengthen security for logging on.

So, now I’m turning to the Financial Conduct Authority as I think Santander have made these changes to “simplify” logon across all platforms and allow me to look at my account wherever I am and whatever I’m doing – on the bus, in the gym, at the theatre, the possibilities are endless. I feel the combination of using the 5 numeric passcode for both logging on and communicating with Santander via chat or phone is a weak implementation of the changes. I ask why it’s supposedly necessary to be able to view my account at a moment’s notice with the minimum of fuss (i.e. security), but I think that’s a generational thing and I’m at the wrong end of the age gap to see the benefit.