Realistic Brits want at least 3 security steps on bank accounts

Like Razors ...

3 is okay, but surely 4 would be better. Or even 5 !

(Are there 6 blades now ...?)

Stop using your mobile 'phone

Not using a mobile phone would figure highly on my list of how to keep my bank a/c safe. Next: not to login there from a MS Windows machine.

It would help a lot of the banks stopped 'phoning their customers about whatever and as a first step ask the customer to verify who they were by answering security questions!

Barclays still make you have a debit card in order to use PIN-Sentry for online banking - even if you have an "ATM only" card. The debit card authentication allows access to all your accounts online. You can disable the card for remote transactions - but not stop its use in shops.

The silly thing is that the "ATM only" account cards will also generate authentication codes with PIN-Sentry - but the online banking system apparently won't accept them.

So I have to have a separate debit card account with a couple of quid in it - just so I can do online banking with my main account which has an "ATM only" card.

Two glaring omissions

I notice they've not given an option to disable contactless or to disable use outside (say) Europe.

If you're going to allow people to lock their cards down you might as well do it properly.

Am I the only one happy with one security step, provided it's a 2FA token with a pin? More than that feels a bit belt-and-braces to me.

Bank Site Authentication

2FA is good, we know that. But, what about validating the bank sites? DigiNotar hack showed that certificates aren't always credible.

Having read all the stuff about payment scams on the BBC this morning and my father-in-law having been taken in by a scam, I feel that better, user configurable, payment limits might work better. It's not authenticated users that seem to be the current problem.

For example I don't want my account accessible in any way from Russia, China, Syria or the United States. If I'm not at home I don't want to transfer more than £500. If I am home I want to be able to transfer £lots to my accounts at other banks or to my solicitor, £1000 to family members, £100 to UK bank account holders or £500 if my girlfriend seconds the payment and nothing to anyone else.

Changing these rules should involve a wait, or a phone call. I can't see that any of that would be too hard to implement.

2FA is good

I believe I did see a post the other week stating 2FA is easily broken through intercetion techniques and as such is phsudo security.As to validation Id like the bank to actually use part of a specified phrase given by myself, to identify themselves to me not assume valid identification is all one sided.

"...it’s no surprise

...that loss of financial details is a top concern for consumers, who increasingly demand higher security to protect their money."

Those bastards... Always wanting to keep their money safe... Next thing you know, they'll want to be able to vote!

Actually, I think the Tories may have the answer to this ...

If we're all poor as shit, we won't be worth scamming ....

More

While 21% said they had accounts hacked, I would estimate that a much higher percentage have had their accounts/passwords compromised but are just not aware.

If your phone is used for 2fA via SMS then we know that is not secure thanks to the S7 protocol on mobile networks and it's being used to take funds from German banks already.

Personally I think a credit card with a digital changing number similar to RSA SecureID should be used as an additional authentication method. Doesn't matter if phones or pc's get compromised and keylogged if this code is needed for each transaction. Saying that, no doubt criminals would find a way to make use of the 30 second window and piggy back of an existing transaction. Always a cat and mouse game.

In other words

Even the more security-concious people don't actually understand security at all. Demanding more steps to log in meaningless if they're all essentially the same thing - having a password and a memorable word just means you have two passwords. Even in the best case that's not meaningfully different from having a single slightly longer password, but given that memorable words tend to be easily discovered things like "mother's maiden name", it barely even manages that.

The reason two factor authentication works is not simply that two is bigger than one and therefore twice as hard to guess, it's because the two factors are of different kinds; traditionally something you know and something you have. Adding lots of extra things you know and/or have doesn't make things more secure if they can still be compromised in the same way - needing two keys to get in your house doesn't make it harder to break in if you keep both keys on the same keyring.

2000 Brits

Good work by Equifax, asking 2000 Brits what security should be applied to on-line banking. I mean there's no way I could find 2000 people qualified to answer questions about secure system design, and I'm in the business.

Sure, I guess it could be that they just asked 2000 random idiots, but what would be the point of that? If you're going to ask a large number of people questions that they're not qualified to answer, at least do something useful with it like deciding the future of the country.

Factors schmactors

All banking portals use behaviour analytics as a backup to password authentication.

It baselines your behaviour where and when you access, how you flow through the site etc

Then throws up aditional authentication if somethings not right.

Also if the anyone rings you and ask for verification, and are un willing to verify themselves, hang up and call their organisation on an independantly sourced number.

SMS OTP has not been a recommended factor for a while and OAUTH TOTP is cheaper and easier to impliment, so why people are still using SMS i dont know.

the other issue is the x y and z letter trick is no better security, in fact its worse than asking for you password. As the passwords have to be stored with two way encryption instead of Complex hashes. plus it takes most people a while to work out what the x y and zth characters are, but they will rember their password/phrase/convoluted mess of symbols, substitutions, and cases that has a Capital at the start, special on the end and a number before that.

People are bad at chosing passwords, pins etc the most common pin is always 1234...n of up to 10 digits and all 0s and all 1s are not far behind.