Simple fraud

[csearle]

Something happened - did the bank explain how the fraudster bypassed the username and password requirement that every banking app requires?

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

[AF62]

PS smart watches? Only know two people with them and they can never really explain why they bought them. Who wants to know their blood pressure all the time?

I think that you are confusing fitness measurements, which smartwatches can often do, with their other functions. Though, I think many might understand tracking heart rate and blood pressure while exercising at a Gym.

I don't use a smartwatch, but you know how it's possible to tap in and tap out while travelling with your rail card. Well, young people use a device on their wrist* for the same function charging their bank account. Or to buy coffee or crushed avocado on brioche.

They can also use it to read SMS messages or receive diary alarms. It means that for many things, they can use their phones while their phone is in a handbag or pocket.

I do actually have a smartwatch, but unfortunately it acts as the phone's speaker and mic during calls, like Dick Tracy. The quality was so bad I refuse to use it.

*Coincidentally, you can buy wristbands that will hold keys and/or cards intended for running. It achieves the same purpose. They just look like the rest of your outfit should be spandex.

Pretty much.

I have used an Apple Watch for a couple of years now, and it was bought primarily to use at the gym and although personally I am not bothered about tracking exercise (although I do let it do that), what I do find useful is that I can synchronise music and podcasts from my phone so I can listen to those whilst in the gym on Bluetooth earphones and leave my phone at home - in essence avoiding the issues in this story.

It also allows me to add credit cards onto the watch, so I can pay for things if I don't have my phone or my wallet handy - handy if you are out and about and don't want to carry too much. And you can also keep copies of any loyalty cards on the watch and also cinema tickets, boarding passes, etc.

There is the range of timers, alarms, calendar that appears on your phone, and with the timers there is a useful app I installed on mine which allows you to set a range of different timers for when you are cooking something more complex where lots of things need to be done at different times.

Mine is also cellular version so it has a esim in it and can make and receive phone calls even if not near the phone (when it would use Bluetooth or WiFi to do that) but it shares the same number as the phone, and the calls are acceptable if using earphones. You can also receive and send text messages.

When using walking directions with Google Maps then the watch will also give directions, and not just a little map, but gentle taps on your wrist to indicate to turn left or right - handy if you are somewhere where you might not want to be getting your phone out of your pocket.

And perhaps more suited to any 'old codgers' it will recognise if you fall over and will call for help, plus coming with the latest update next week it will remind you when to take your pills.

Is it worth it - for most probably not, but it wasn't that expensive (certainly a lot less than many spend on watches) and if it keeps me in the gym for an extra 15 minutes or half an hour because I am not bored, then it delivers value to me.

[AF62]

Something happened - did the bank explain how the fraudster bypassed the username and password requirement that every banking app requires?

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

[csearle]

Something happened - did the bank explain how the fraudster bypassed the username and password requirement that every banking app requires?

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Yes I do have such an app.

These fraudsters use the information on the victim's debit card to link their copy of the app to the victims account. In order to activate it, all that is needed is the one-time-passcode delivered to the victim's phone (in the fraudsters possession). Clearly several apps require more security, so they are not compromised by this particular trick.

Chris

[AF62]

Something happened - did the bank explain how the fraudster bypassed the username and password requirement that every banking app requires?

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Yes I do have such an app.

And can you *do* anything with the app, e.g. move money, or is it just a look at balances?

These fraudsters use the information on the victim's debit card to link their copy of the app to the victims account. In order to activate it, all that is needed is the one-time-passcode delivered to the victim's phone (in the fraudsters possession). Clearly several apps require more security, so they are not compromised by this particular trick.

So not only does the banks app you have on your phone allow you to *do* things without logging in, there is damn all security to install it as well.

Why on earth do you use that bank?

None of the banking and other financial apps I use do not require a secondary login in (or biometric security) and those include, HSBC, First Direct, Amex, Halifax, Nationwide, iWeb, Revolut, PayPal, NS&I, EE, BT, HMRC, Octopus Energy.

For any financial institution to only protect it's customers information by the phone lock itself is incredible, but then to actually let them transact, is well, utter madness.

[DrFfybes]

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Simpler explanation here...
https://www.bbc.co.uk/news/uk-england-london-62809151

Thief registers YOUR bank card on THEIR phone as if you had changed phones.
Your bank sends a verification code to your old phone, which most people have set up to have the first line readable without unlocking the phone. Then your bank account is linked to their phone number, and off they jolly well go.

Simple to avoid if the phone user or the bank took a slightly different approach.

Paul

[Arborbridge]

Something happened - did the bank explain how the fraudster bypassed the username and password requirement that every banking app requires?

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Yes I do have such an app.

And can you *do* anything with the app, e.g. move money, or is it just a look at balances?

These fraudsters use the information on the victim's debit card to link their copy of the app to the victims account. In order to activate it, all that is needed is the one-time-passcode delivered to the victim's phone (in the fraudsters possession). Clearly several apps require more security, so they are not compromised by this particular trick.

So not only does the banks app you have on your phone allow you to *do* things without logging in, there is damn all security to install it as well.

Why on earth do you use that bank?

None of the banking and other financial apps I use do not require a secondary login in (or biometric security) and those include, HSBC, First Direct, Amex, Halifax, Nationwide, iWeb, Revolut, PayPal, NS&I, EE, BT, HMRC, Octopus Energy.

For any financial institution to only protect it's customers information by the phone lock itself is incredible, but then to actually let them transact, is well, utter madness.

I know you've couched this in terms of "I don't understand" but you coming close to suggesting it can't have happened, or that the victims are somehow to blame. In fact, you sound a bit like a bank's response

As for why on earth would you use that bank?: maybe they won't now! In any case, that's hardly a fair question because until the BBC investigated, I doubt many people were aware of this problem - or if they did they didn't bother publicise it or they were fraudsters.

Thanks to the BBC and a really good piece of journalism, we are now all discussing it, are more aware of the potential loopholes and will do something about it where necessary. We should also bear in mind when commenting, that the general run of Mums and Dads will not be so tech savvy as most people here who have of necessity been thinking about security of pension pots and investments for many years. Part of our hobby, so to speak, but not for ordinary people who would just assume "the authorities" have set up a safe system. Don't laugh: I believe that's how most people would think - that the banks had done their duty and created something virtually foolproof for them. Indeed, a bank's first priority should be to safeguard its customers' cash: they know this and that's why they always initially deny it is their fault until there is overwhelming evidence to the contrary.

And can you *do* anything with the app, e.g. move money, or is it just a look at balances?

Yes!!! At least £35,000 from two people were sucked out of savings accounts into current accounts, then stolen.

Arb.

[AF62]

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Simpler explanation here...
https://www.bbc.co.uk/news/uk-england-london-62809151

Thief registers YOUR bank card on THEIR phone as if you had changed phones.
Your bank sends a verification code to your old phone, which most people have set up to have the first line readable without unlocking the phone. Then your bank account is linked to their phone number, and off they jolly well go.

Simple to avoid if the phone user or the bank took a slightly different approach.

Paul

That article doesn't explain.

When you have installed a banking app on your phone, has the app not required a user-name and password (plus possibly other information) *in addition* to the 2FA OTP sent by text?

I am not aware of any cases where just the card number and OTP is sufficient to log into an account and transact with no further information.

[AF62]

Haven't read all the responses but this stood out as factually incorrect.

At least one of the banking apps on my phone just starts up without any further security.

But the point is that the fraudster doesn't start your app. He starts his/her own app using his own password/biometrics on his/her own phone. So for systems where additional devices can be added without explicitly logging onto the existing app and removing the device there exists this risk (as was highlighted by the BBC report showing that many thousands of £ were nicked this way).

Chris

Sorry I don't quite understand what you mean.

Do you have a banking app on your phone that does not require you to log in or use any biometric security to perform that log in? If so, that is astonishing and I have never heard anything like that before.

And for the fraudster starting their app on their phone, it still needs the details of the customer they are defrauding - otherwise how does the app know it is the other customer's account?

Yes I do have such an app.

And can you *do* anything with the app, e.g. move money, or is it just a look at balances?

These fraudsters use the information on the victim's debit card to link their copy of the app to the victims account. In order to activate it, all that is needed is the one-time-passcode delivered to the victim's phone (in the fraudsters possession). Clearly several apps require more security, so they are not compromised by this particular trick.

So not only does the banks app you have on your phone allow you to *do* things without logging in, there is damn all security to install it as well.

Why on earth do you use that bank?

None of the banking and other financial apps I use do not require a secondary login in (or biometric security) and those include, HSBC, First Direct, Amex, Halifax, Nationwide, iWeb, Revolut, PayPal, NS&I, EE, BT, HMRC, Octopus Energy.

For any financial institution to only protect it's customers information by the phone lock itself is incredible, but then to actually let them transact, is well, utter madness.

I know you've couched this in terms of "I don't understand" but you coming close to suggesting it can't have happened, or that the victims are somehow to blame. In fact, you sound a bit like a bank's response

No.

It has been mentioned that there is a banking app that does not require you to log into it after you have unlocked your phone.

I have never encountered such an app, and I have used an awful lot of banking apps.

It would seem amazing that a bank would offer such an app, hence my astonishment.

As for why on earth would you use that bank?: maybe they won't now! In any case, that's hardly a fair question because until the BBC investigated, I doubt many people were aware of this problem - or if they did they didn't bother publicise it or they were fraudsters.

I think you are conflating two different things - the Santander app which is the focus of the BBC article *does* require a log in when the app is installed. It is just that the security on the user-name reminder and password reset appear to be very weak.

That is completely different to a banking that once installed does not require any further log in and will operate simply if the phone is opened - a design that I have never seen.

Thanks to the BBC and a really good piece of journalism, we are now all discussing it, are more aware of the potential loopholes and will do something about it where necessary. We should also bear in mind when commenting, that the general run of Mums and Dads will not be so tech savvy as most people here who have of necessity been thinking about security of pension pots and investments for many years. Part of our hobby, so to speak, but not for ordinary people who would just assume "the authorities" have set up a safe system. Don't laugh: I believe that's how most people would think - that the banks had done their duty and created something virtually foolproof for them. Indeed, a bank's first priority should be to safeguard its customers' cash: they know this and that's why they always initially deny it is their fault until there is overwhelming evidence to the contrary.

Of course banks should protect their customers, although the issue for the banks is that when they do increase security then there are an awful lot of moans from the general public - the recent implementation of 2FA checks on payments online for example

And can you *do* anything with the app, e.g. move money, or is it just a look at balances?

Yes!!! At least £35,000 from two people were sucked out of savings accounts into current accounts, then stolen.

Arb.

That was a question about a banking app that was said to not require a login after opening the phone, not the BBC story.

[csearle]

I have never encountered such an app, and I have used an awful lot of banking apps.

It would seem amazing that a bank would offer such an app, hence my astonishment.

I have though. The one I use pretty much every day. The reason I use it is because it is such an amazing app. It is absolutely streets ahead of the two other banking apps I use. I have switched off the abbreviated push-notification on the lock-screen as a consequence of the BBC's report.

Chris

[AF62]

I have never encountered such an app, and I have used an awful lot of banking apps.

It would seem amazing that a bank would offer such an app, hence my astonishment.

I have though. The one I use pretty much every day. The reason I use it is because it is such an amazing app. It is absolutely streets ahead of the two other banking apps I use. I have switched off the abbreviated push-notification on the lock-screen as a consequence of the BBC's report.

Chris

Would you care to reveal which bank offers this amazing app that allows you to access your accounts and perform transactions without logging in, only relying on the phone lock?

[csearle]

Would you care to reveal which bank offers this amazing app that allows you to access your accounts and perform transactions without logging in, only relying on the phone lock?

Monzo. (I'm not affiliated in any way, other than being a satisfied customer.)

Chris

[AF62]

Would you care to reveal which bank offers this amazing app that allows you to access your accounts and perform transactions without logging in, only relying on the phone lock?

Monzo. (I'm not affiliated in any way, other than being a satisfied customer.)

Chris

Rather you than me!

I see that biometric security is available in their app but it is off by default. I suppose there must be some reason for that, but I can't see what that might be and it certainly exposes customers to a higher risk.

[Infrasonic]

Would you care to reveal which bank offers this amazing app that allows you to access your accounts and perform transactions without logging in, only relying on the phone lock?

Monzo. (I'm not affiliated in any way, other than being a satisfied customer.)

Chris

Rather you than me!

I see that biometric security is available in their app but it is off by default. I suppose there must be some reason for that, but I can't see what that might be and it certainly exposes customers to a higher risk.

It gets even better than that AF..https://community.monzo.com/t/privacy-s ... tes/103255

Issue: Face ID unlock setting lost when app updated

Details to reproduce: Update the app
OS: 13
Device: IPhone XS
App Version: latest as of 6th August

When the app updates, the security settings which are both enabled fo UNLOCK USING FACE ID and AUTHENTICATE USING FACE IS are lost.

I can immediately open the app without any details needing to be entered.

Used to have this issue with the Android version.

Updating the app would disable the Fingerprint Authentication access.

Strange

So thanks to this thread I now know to never use Santander or Monzo! Any more that people know of with such appalling security defaults? Please list them here...

[UncleEbenezer]

Back in the 90's a friend had his Filofax stolen. He described it as having his life stolen. All contacts and addresses GONE. I've had a smartphone for decades and would really struggle without. I know I could cope, but I would certainly be sad.

If you're not paranoid, you would just need to get a replacement phone, and when you log in to your account, it'll offer to sync with your contacts as held by - typically - apple or google.

Of course if you are paranoid then it's unlikely anyone holds those contacts in the cloud for you, so you're on your own.