Good bank for web-banking? (no phones used)

[John Martin]

I have a mobile but it's not a smart phone, so that's why I don't use mobile apps... apart from maybe 'snake' now and again...

 

[eteb3]

@ThatDevAaron I’ve used Lloyds which is basic and NatWest which has three-to-sign payment control

Both did what I want: pay bills, check balance, export csv

NatWest had facility to upload bulk transfer request, never used it. NatWest was also massively more complicated interface , thanks to the extra capabilities

Can’t see there’s much to choose between them, but I’m not a dev and I can imagine you might be more choosy about your UI

 

[ThatDevAaron]

I have a mobile but it's not a smart phone, so that's why I don't use mobile apps.

the situation at hand, we dont use smart phones, and don't rely on them, they are a massive security risk.

 

[ThatDevAaron]

@ThatDevAaron I’ve used Lloyds which is basic and NatWest which has three-to-sign payment control

Both did what I want: pay bills, check balance, export csv

NatWest had facility to upload bulk transfer request, never used it. NatWest was also massively more complicated interface , thanks to the extra capabilities

Can’t see there’s much to choose between them, but I’m not a dev and I can imagine you might be more choosy about your UI

will look into natwest

 

[Russ Michaels]

Not if you are phished into going to a fake site that intercepts/relays the 2FA messages. All to easy and common, unfortunately.

If you use a password manager, then the passwords stored are linked to the real domain, so will not show up for fake phishing urls'

 

[ThatDevAaron]

If you use a password manager, then the passwords stored are linked to the real domain, so will not show up for fake phishing urls'

not how phishing works sadly..

 

[fisicx]

the situation at hand, we dont use smart phones, and don't rely on them, they are a massive security risk.

Can you please explain this.

 

[ThatDevAaron]

Can you please explain this.

1. sim swapping
2. easy access point for hackers
3. not everything should be accessible from the palm of your hand

 

[fisicx]

1. sim swapping
2. easy access point for hackers

Not sure I understand either of these.

I’ve got an eSIM so nothing to swap. How do hackers access my phone? Surely it would be easier to access your network and from there your PC.

 

[ThatDevAaron]

esims are easier actually.

with the new invention of esims, fraudsters now don't even need to go through the tedious process of waiting for a sim card to be posted via mail (allowing you to hopefully realize whats happening as your main sim card would be unusable for this period); or instead having to go in a branch with ID etc to collect the SIM, now they just need get given the unique ESIM code, that is it.

Banks offer security, but, its best to employ your own practices, its not like people aren't getting robbed for their funds every day.

 

[fisicx]

Reading up on this and it seems the sim swap only works if the fraudsters have sufficient info to trick the phone company into making the transfer. It may be a prevalent activity but it’s not the smartphone that’s the problem. It’s people making their personal info available and falling for the phishing emails and calls.

Smartphones are secure. People are the problem.

 

[ThatDevAaron]

Reading up on this and it seems the sim swap only works if the fraudsters have sufficient info to trick the phone company into making the transfer. It may be a prevalent activity but it’s not the smartphone that’s the problem. It’s people making their personal info available and falling for the phishing emails and calls.

Smartphones are secure. People aren’t.

yes and no.

they really only need a few bits of information, when you call up your provider, what do they ask you for? Date of birth, name, address, nothing hard to get. Lookup your emails in haveibeenpwned.com - and thats a small dataset - you're info, just like portions of mine etc, are probably out there.

That is why its vital to minimize the access you give these things, by using a banking app, every single one requires a phone number for something, that is a big risk as that number may be used to confirm your identity at any point in time.

Nothing is secure.

 

[fisicx]

They also need the OTP to make the switch.

Whilst I agree to your points to some extent in the majority of cases mobile banking apps are ok. And your funds are safe in cases of fraud.

 

[ThatDevAaron]

They also need the OTP to make the switch.

Whilst I agree to your points to some extent in the majority of cases mobile banking apps are ok. And your funds are safe in cases of fraud.

OTP is easy to avoid - all ISPs have alternative ways to verify customers, if an OTP isn't available, they can prove their identity by, for instance, confirming the amount you pay per month (usually a ballpark), and/or numbers you frequently call/get calls from (once again, not hard to get at all).

Trust me, if you think this stuff is secure, you're a pending victim of this shit

 

[eteb3]

will look into natwest

I see Lloyds does bulk payments, too - I didn't realise. If I didn't say, Lloyds give access through a device that gives one-time codes from a combination of a bank card (ours isn't a debit card, only for web access) and a pin. (To slake your next tech question, it's an "Ezio Classic Reader".)

NatWest requires some mindbogglingly complex password that has to be changed every ?30 days. Or you can get a reset link to your ... email. (But it does add a 30 min delay, and emails other signatories first to tell them a reset has been requested, which is something.)

 

[ThatDevAaron]

I see Lloyds does bulk payments, too - I didn't realise. If I didn't say, Lloyds give access through a device that gives one-time codes from a combination of a bank card (ours isn't a debit card, only for web access) and a pin. (To slake your next tech question, it's an "Ezio Classic Reader".)

NatWest requires some mindbogglingly complex password that has to be changed every ?30 days. Or you can get a reset link to your ... email. (But it does add a 30 min delay, and emails other signatories first to tell them a reset has been requested, which is something.)

yeah Natwest sounds good, just would need to prob use another bank for day to day activity

 

[Daria Kapnina]

not how phishing works sadly..

You're right—phishing often works in ways that bypass password manager protections, especially through social engineering and deceptive tactics.

<Mod: removed self-promotion>