Halifax Clarity Credit Card Security

[jaizan]

Today I received a text message, asking if I was trying to make a payment of XX to a company on my Halifax Credit card.

I replied NO.

I immediately got an incoming call from their fraud prevention team. They started asking security questions.

I never answer security questions to incoming calls, as I don't know who is making them. To fake this, all a company needs is my phone number and the last 4 digits of my credit card number.
So if they call me, surely they need to ask questions that would not allow someone else to phone Halifax and get through the security checks using that information ?

I ended the call & then phoned the number on the back of my card. After a considerable wait, I was able to go through it, identify one other fraudulent transaction and they will be sending me a new card.

Overall, I'm quite pleased with my Halifax Clarity Credit Card. I would be happier if the app gave me live notifications of any transactions, as my bank does.

My other zero forex load credit card is from Santander & they do not impress me. When they have made security checks for online purchases, they are actually asking me to phone them to request a code to put in the website payment box. That is no more secure than directly texting me the code, as other companies do, yet since I was in Thailand at the time, it would have cost me significantly more to make the call. So I simply used the Halifax card instead.
Guess which card hardly ever gets used ?

[Laughton]

I immediately got an incoming call from their fraud prevention team. They started asking security questions

Yes, it's really bizarre isn't it? Banks constantly tell us never to give out secure information and yet they phone us and start asking for just that. They're phoning us - shouldn't it be us asking them security questions (btw, I've tried that and they don't like it)

Must be a better solution.

[richfool]

Today I received a text message, asking if I was trying to make a payment of XX to a company on my Halifax Credit card.

I replied NO.

I immediately got an incoming call from their fraud prevention team. They started asking security questions.

I never answer security questions to incoming calls, as I don't know who is making them. To fake this, all a company needs is my phone number and the last 4 digits of my credit card number.
So if they call me, surely they need to ask questions that would not allow someone else to phone Halifax and get through the security checks using that information ?

I ended the call & then phoned the number on the back of my card. After a considerable wait, I was able to go through it, identify one other fraudulent transaction and they will be sending me a new card.

Overall, I'm quite pleased with my Halifax Clarity Credit Card. I would be happier if the app gave me live notifications of any transactions, as my bank does.

My other zero forex load credit card is from Santander & they do not impress me. When they have made security checks for online purchases, they are actually asking me to phone them to request a code to put in the website payment box. That is no more secure than directly texting me the code, as other companies do, yet since I was in Thailand at the time, it would have cost me significantly more to make the call. So I simply used the Halifax card instead.
Guess which card hardly ever gets used ?

I had a very similar situation occur a couple of months ago. First a text asking if I was making a particular transaction, which I wasn't, and saying it had been declined. So I froze my card, then rang them and on through to their fraud dept. I confirmed I had not used my card for a couple of months and that it was with me. They cancelled my card and account and opened a new one later, after having refunded a small transaction which had been paid.

[Lootman]

I immediately got an incoming call from their fraud prevention team. They started asking security questions

Yes, it's really bizarre isn't it? Banks constantly tell us never to give out secure information and yet they phone us and start asking for just that. They're phoning us - shouldn't it be us asking them security questions (btw, I've tried that and they don't like it)

Must be a better solution.

They should send an email as well as trying to phone you.

There was fraudulent acrivity on one of my cards whilst I was overseas. I typically have my phone switched off when I am overseas and so never received any phone call. But thankfully they also emailed me and I was able to respond by email that the charges were not mine.

Had my card issuer relied only upon a phone it might have been days before the fraud was detected and the card account frozen. There are various situation where I will see an email before I get a text or voicemail.

[jaizan]

They should send an email as well as trying to phone you.

There was fraudulent acrivity on one of my cards whilst I was overseas. I typically have my phone switched off when I am overseas and so never received any phone call.

A very good point.
I often spend several weeks abroad and may go the whole time without putting my UK SIM in a phone. So I would also miss such correspondence.

Incidentally, my Starling banking app provides instant notifications for any transactions, so I can keep an eye on that anywhere in the world.

The Halifax app provides no such notifications. It would make sense if they had notifications for every transaction AND warnings about anything suspicious.
Halifax do provide better foreign exchange rates than Starling, but for a lot of contactless transactions, I prefer to use something which instantly confirms the transaction value.

[Dod101]

I immediately got an incoming call from their fraud prevention team. They started asking security questions

Yes, it's really bizarre isn't it? Banks constantly tell us never to give out secure information and yet they phone us and start asking for just that. They're phoning us - shouldn't it be us asking them security questions (btw, I've tried that and they don't like it)

Must be a better solution.

On the odd occasion I have been phoned by my bank (HSBC) when asked the same thing I have responded with 'How do I know that you are genuine?' and they have said ' Agreed. Call us on the number XXXXXXX and quote this number'. Not much better I suppose but at least I then got hold of someone I felt I could speak to without disclosing security stuff. And it was fine.

Dod

[chas49]

Yes, it's really bizarre isn't it? Banks constantly tell us never to give out secure information and yet they phone us and start asking for just that. They're phoning us - shouldn't it be us asking them security questions (btw, I've tried that and they don't like it)

Must be a better solution.

On the odd occasion I have been phoned by my bank (HSBC) when asked the same thing I have responded with 'How do I know that you are genuine?' and they have said ' Agreed. Call us on the number XXXXXXX and quote this number'. Not much better I suppose but at least I then got hold of someone I felt I could speak to without disclosing security stuff. And it was fine.

Dod

It would be better if they said "call us on the number on the back of your card, or go to the website and find the number" - otherwise how do you know who you are calling???

[Dod101]

On the odd occasion I have been phoned by my bank (HSBC) when asked the same thing I have responded with 'How do I know that you are genuine?' and they have said ' Agreed. Call us on the number XXXXXXX and quote this number'. Not much better I suppose but at least I then got hold of someone I felt I could speak to without disclosing security stuff. And it was fine.

Dod

It would be better if they said "call us on the number on the back of your card, or go to the website and find the number" - otherwise how do you know who you are calling???

Actually I think they may have done that but my point is that I would never speak to anyone who just calls me up however genuine they sound. It has come to something though that we cannot really trust anyone!

Dod

[GoSeigen]

On the odd occasion I have been phoned by my bank (HSBC) when asked the same thing I have responded with 'How do I know that you are genuine?' and they have said ' Agreed. Call us on the number XXXXXXX and quote this number'. Not much better I suppose but at least I then got hold of someone I felt I could speak to without disclosing security stuff. And it was fine.

Dod

It would be better if they said "call us on the number on the back of your card, or go to the website and find the number" - otherwise how do you know who you are calling???

Er... you can check the number they've given you before calling it???


GS

[XFool]

On the odd occasion I have been phoned by my bank (HSBC) when asked the same thing I have responded with 'How do I know that you are genuine?' and they have said ' Agreed. Call us on the number XXXXXXX and quote this number'. Not much better I suppose but at least I then got hold of someone I felt I could speak to without disclosing security stuff. And it was fine.

It would be better if they said "call us on the number on the back of your card, or go to the website and find the number" - otherwise how do you know who you are calling???

Er... you can check the number they've given you before calling it???

Or waited some time before calling the number and ensuring there was dialling tone* on your phone before dialling?


* Although, as scams seem to get more sophisticated over time, perhaps now we should expect some call-back scammers to play recordings of dial tone down the line?

[jaizan]

I would never speak to anyone who just calls me up however genuine they sound.

Agreed.
I don't even give my name when answering the phone these days. It's just a "hello".

I also never follow a link on an e-mail from a bank. The only bank I know of who has sent a genuine link was Halifax, but I still don't click on them as a matter of principle.

[Lootman]

I would never speak to anyone who just calls me up however genuine they sound.

Agreed. I don't even give my name when answering the phone these days. It's just a "hello".

Same here. Nor do I use my name on the outgoing greeting I have on my voicemail.

[chas49]

AFAIAA there's no dial tone on a mobile phone and mobiles aren't vulnerable to the 'caller stays on the line' scam?

So, don't give the bank your landline, give them your mobile number. And don't answer your landline anyway

(Getting a bit off-topic, but our landline is now set so all calls go to voicemail without ringing. IF anyone ever leaves a message, we get notified. Approximately 99% of calls to the landline now are spam so they never leave a message)

[jaizan]

My landline is now switched off.
Reasons:
#1 Most of the incoming calls were spam and it is much easier to block spammers on my Android phone
#2 My phone package has a lot of minutes. There is no reason to pay for more minutes or calls on a landline

Another security feature I have is one e-mail for close friends and financial services & another e-mail for everything else. The difference in the volume of mail in the spam folders is incredible.

As for the credit card, Halifax got the replacement to me today, the day after the problem was identified.
Well done Halifax.

However, they lose points for giving me the same expiry date as the old card, just 18 months away. Due to intended holidays, I am likely to ask for a replacement within 12~15 months.

[XFool]

AFAIAA there's no dial tone on a mobile phone and mobiles aren't vulnerable to the 'caller stays on the line' scam?

So, don't give the bank your landline, give them your mobile number. And don't answer your landline anyway

So, a good solution!

Approximately 99% of calls to the landline now are spam so they never leave a message)

Amazing. Nowadays, none of my landline calls are ever spam. But that really is a whole different topic...

[Loup321]

When my bank has ever phoned me, they say something like "If I tell you the year of your birth, can you confirm the day and month?" or "Tell me the first half of your postcode and we'll tell you the second half." They are always offering to give me some security information to verify them, as well as asking me for some of my own.
I appreciate that if someone were intent on defrauding me personally, they could probably get quite a bit of information. However, I don't use social media, and I believe that most people trying to commit fraud do things with as little effort as possible, because even if only 0.01% fall for it, that's a reasonable return on the time invested. If 10% fall for it, they might put in more effort, like harvesting information from the internet.

If I get called by "Virgin Media," I ask them what my name is, and they usually just hang up. If the real Virgin Media were to call, for a legitimate reason, I would expect them to know my name, and not be bound by data protection not to be able to tell me who I am.

[jaizan]

Well, today my Halifax Clarity Credit card was blocked when I tried to make yet another routine hotel booking on Agoda.
Perhaps their algorithm stillcannot recognise that I have regular long holidays ? After many years.

I tried to resolve this via messaging on the app. All they could do is tell me the card is blocked and instructed me to call them. Which will be very expensive at international call rates.
They don't even have WhatsApp.

Halifax also insist on conducting 2FA via text messaging.
Problem #1: This is not secure. When I put a foreign SIM in my phone, I usually put the UK SIM in my wallet. If that's stolen, they have my card and SIM.
Problem #2: It does not work when my UK SIM is not in the phone.

Far better to do 2FA via an app, with fingerprint login. That's more secure AND works with any SIM in the phone, or on WiFi.

[jaizan]

Incidentally, the Halifax website directs me to contact them via the app, but by that means, they cannot resolve a problem.

The Halifax app messenger gave me a phone number to call. I called it and that was the Debit Card team, not the Credit Card team. So they provided the wrong contact number.

[kempiejon]

Incidentally, the Halifax website directs me to contact them via the app, but by that means, they cannot resolve a problem.

The Halifax app messenger gave me a phone number to call. I called it and that was the Debit Card team, not the Credit Card team. So they provided the wrong contact number.

jaizan I know exactly what you mean. I raised an issue with Halifax via chat on the PC internet banking interface. There is a mistake on a notification on my account only when using the PC interface. That chat team couldn't help me so suggested I contact via the app on handheld device. I had to download and activate the app as I usually use the PC for my Halifax interactions. The app chat couldn't help me either. I explained my problem and the helpful johnny on the app chat suggested I turn the pc off and on again. I've escalated to a complaint now and should expect to be contacted in 4 days. The erroneous message is still there 4 days later.

[puffster]

Halifax also insist on conducting 2FA via text messaging.
Problem #1: This is not secure. When I put a foreign SIM in my phone, I usually put the UK SIM in my wallet. If that's stolen, they have my card and SIM.
Problem #2: It does not work when my UK SIM is not in the phone.

A partial solution might be that some recent phones (definitely iPhones) allow dual SIMs (although for iPhones one of them has to be an eSIM and not all UK networks support this) to be used so you can then have both numbers active on holiday.

Regards, Puffster