Here in scandiavia, we've had hardware tokens (or phone apps) to offer 2fa for ages. And you need a new token for every transaction. In addition to the password for logging in. When you reset your password, you get an email and an SMS saying that your password was reset.
Last time I needed a new token issuer dongle, I had to actually visit the bank and sign stuff.
My UK bank had a hardware token for years. They recently "upgraded" my security for online banking, and now use SMS 2FA codes for login and authorising new transfers. The hardware token is now unusable.
I'd change banks, but I doubt the others are better.
Seriously, switch bank.
I did wonder if it was some unintended consequence of the EU banking interop changes, but that didn't seem especially convincing. OK, changing bank it is then. At least it's so much easier than it used to be. :)
Of course, I expect that eventually they'll move to SMS too since it's easier for them and more on line with the rest of the industry.
Some Polish banks definitely allow using SMS as a second-factor.
(And some even let you use a permanent cookie for that. :-O)
That's fine for sending £100 to an account already in your list of payees, but to set up a new account, where's the second factor in an app? That, to me, seems a large step backwards.
2FA is usually fake anyways, there's usually a way to reset stuff with only one factor (e.g. use phone number to reset password, or login with password and change phone number, ... same with PIN), so it's all a misnomer anyways.
I'm glad UK banks try to avoid physical dongles because having to go to the bank and sign stuff to get one is not always convenient, not to mention you need to carry around the dongle everywhere, and if you lose it while you're in vacation it's yet more troubles.
Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. Personally I'm satisfied with the way UK banks handle security - it's secure, they block suspicious transactions, etc. yet it doesn't get too much in your way.
I don't think UK banks are less competent, it's just a fine balance between usability and security.
This is exactly like having a physical token with you. If it gets stolen, they have the tokens. But, at least, having token on the phone app is waymore convenient for customers and also has another layer of protection (think of the fingerprint/passcode ecc you need to access your phone)
You need my phone unlocked and my six digit pin in order to identify as me.
There are still possible social engineering attacks, though.
My banks hardware token also needs a PIN before it generates a one-time code.
Some bank tokens just give you the code when you press a button, though. Those, you have to worry if stolen.
Can't you just lock the stolen phone?
Meanwhile, banking security in the US is stuck in the Stone Age. Last I checked Wells Fargo, one of the largest US banks, still does not allow passwords greater than 14 characters in length and passwords are not case sensitive.
The worst offender is ING, you can set a payment limit in the app but then you can also change the payment limit in the app itself. If I take a nap on the train, you can drain my bank account my pressing my thumb on the reader.
The process is user-friendly while keeping security high:
- The place where you want to login has to trigger the authentication from their server on every login - and have to be certified for BankID.
- You then have to open the app, enter your fingerprint or 6-pin code before you can enter.
It's available for all state-run services including all banks and post offices.
Big yikes, that's a no for me.
https://www.expressen.se/dinapengar/sparande/bedragerier-med...
With the real BankID, the computer accessing the bank web site needs access to the smart card. Exploitation is still possible of course, but the bar seems higher.