> most online payments above €30 to go through an extra level of verification such as entering a code received via a text message. [2]
Most banks unwisely chosen SMS as Strong Customer Authentication providing little choice to customers.
https://ec.europa.eu/info/law/payment-services-psd-2-directi...
Most banks do try very hard to push you to use their Android or IOS app though. I agree that it is becoming increasingly hard to exist without either an Android or IOS smartphone.
The Dutch government is mandating the use of a stronger level of authentication to access your personal medical data. Currently, the only system that meets this standard is the government Android or IOS app. An alternative is being considered that allows people to use an NFC-reader on any modern computing platform with a suitable driver's licence or ID-card, but this won't be available to every citizen until 2029 due to the renewal cycle of these government issued cards. But even then I can't escape a certain sense of complacency with the government branch developing these techniques; they really seem to want everyone to either get an Android or IOS smartphone, or authorize a relative or friend to manage your digital affairs on your behalf. This latter option is of course geared towards the elderly and the digitally encumbered.
It was possible to participate digitally as citizen in the age of the personal computer even if you didn't get Windows or Mac OS X, but in the smartphone era this freedom does not seem to exist for much longer.
Although our own government really takes the cake in terms of 'gently nudging' people to use their app for authentication:
https://twitter.com/jdhoek/status/1214969536333651968 (in Dutch, but with screenshots illustrating the 'nudging')
The problem lies in the presentation. The styling of the “no smartphone” link is meant to convey that you are doing something undesirable, unsafe, obsolete, weird. That's behavioural nudging. This is fine when the upgrade path is clear and available to all (e.g., “Don't use Internet Explorer, get automatically updating Chrome, Edge, or Firefox”), but it is not fine if the only upgrade path is buying a smartphone and going into an agreement with (foreign) Apple or Google (for the required use of their respective app-stores).
The government should simply not be mandating citizens to own a smartphone just because they can't be arsed to embrace authentication solutions that work on any modern computer (e.g., WebAuthn, or accelerated roll-out of NFC-chip ID-passes and a way to use these with an NFC-reader on any modern OS).
Combined with the push to get rid of anonymous accounts and phone numbers there has also been a push to get rid of cash. I expect to see a time in my lifetime where a country will fully do away with all anonymous forms of payment, effectively making it impossible to be anonymous.
If you gave it as a security contact number to a financial institution you’d care if it was disabled.
It's not sharing that is lowering the privacy level, it's having to disclose all the information to the mobile operator, in addition to the hassle of needing an additional contract with a third, unrelated party.
That would mean either the elimination of poverty or a country that so hates its poor, it's willing to remove them from the economy altogether. I highly doubt that will happen, even in the US, where the poor are despised and hated by almost everyone. But then again, you never know.
In fact, the last internet banking transaction I would have made would have been at least 10 years ago!
1. EU didn't force the banks to use SMS
2. EU is aware of the privacy/security issue of SMS and is planning to actually ban using SMS otp as a form of strong auth
https://www.zdnet.com/article/german-banks-are-moving-away-f...
It's like being an outlaw, or a member of an untouchable caste: sure, you could just hide in a hole forever and wouldn't be breaking any laws, but in order to do anything you'd have to do it in a way that breaks a law.
Bunq is also a troubling development, because it is the first Dutch bank to require the use of their app, offering no alternative authentication methods (like the larger banks do). If they are allowed to do that, then what is stopping the other banks besides good customer service? ING is already notorious for having waited as long as possible before offering an alternative to their app to users of their former outdated numbered one-time code system.
When you say "practically illegal" I can only assume you mean "not illegal."
Most institutions I know have chosen SMS for Strong Customer Authentication which means sooner or later you in practical life will need your personal SIM card (banking, doctor visit, e-prescription, e-government etc.). Unless you chose to live off the grid for real.
SMS was chosen because everyone has it already. So it's not a matter of being forced to have it, it's a matter of "all other alternatives are less widespread."
I think there are actually more people globally with access to mobile phones than people who have access to basic sanitation, i.e. flushing toilets.
I'm sure that many or most of those organizations have alternative, non-electronic means of interaction - such as phone, paper (writing checks), or in-person. That is the alternative to using a SIM card.
Now imagine taking all my six SIM cards on vacation to Thailand just because you may be in need to urgently use one of my multiple bank or brokerage accounts ;-)
https://www.zdnet.com/article/german-banks-are-moving-away-f...
>> To fulfil its statutory objective of contributing to supervisory convergence in the EU/European Economic Area (EEA), and to do so in the specific context of the RTS, the EBA is issuing a further opinion with a view to responding to the large number of queries that the EBA and national competent authorities (CAs) have received from market participants on SCA and, in particular, on what procedure or combination of authentication elements may or may not constitute SCA
When you make a payment over a certain size, you're required to verify that it's you making the payment. It's 2FA for payments essentially, you enter the code sent by SMS or you tap the approval button in your banking app, or enter your PIN again for contactless transactions.
It seems a lot of payment institutions have allegedly implemented SMS verification for these transactions. I bank with Monzo (https://monzo.com) which offers an approval notification in their app.
Unless you switch to a "challenger" bank like Monzo, you're going to be getting SMS to verify transactions (otherwise the transaction won't go through) and while I consider it hyperbole to mark this as "practically illegal", it does make things rather difficult for those with no phone or SIM card.
Its rather that banks have phased out other methods like tokens as too expensive and troublesome.
https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-...
https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku...
One big advantage is that number-porting attacks are much harder to pull-off with them as they have better security than most phone companies.
One downside is that the SMS must come from the same country. It's a weird limitation of their platform.