The security of so-called ‘two-factor authentication’ is a joke!

Tweet

Ever since this was first brought in I have been saying this, but no-one is listening! If a mobile ‘phone is stolen, and this is one of the devices used by your bank in its two-factor authentication process, especially if you use a banking app on the same device, how can this possibly be secure? When banking staff try to persuade me to switch to a more technical way of accessing my account and I ask them this they just smile and assure me it’s all fine, but that I don’t have to use it if I don’t want to – in that kind of ‘Well never mind, she’s obviously just too old to understand this modern way of doing things’ kind of way. When I use online banking at home, the bank sends a supposedly secure code to my ‘phone, but because the ‘phone shows alerts even on the locked screen, anyone who picks it up and presses the button to turn the screen on can read the first five or six words of any email or text message. And guess what – the codes sent by the bank are only a few words long, normally along the lines of ‘your one-time passcode is 123456’ Now it seems a thief (or a group) have been taking advantage of this to steal thousands of pounds, and it’s so simple! Even I can see how easy it is. They just have to steal someone’s bank card and phone and they’re all set – and many people use a phone case which is also a card wallet so what could possibly be easier? Just handing everything necessary to the thief on a plate, so to speak. How to avoid this: #1 Don’t keep your bank card and ‘phone together! Those smart-looking wallets are so tempting, but don’t go for it! #2 Change your ‘phone settings so that alerts are not shown on your locked screen (instructions are in the linked news story – I just have to figure out how to do this because I fall at the first hurdle – ‘go to settings’ – how do I do that??) Of course the little alerts are rather useful, so many people won't want to do that. #3 This one is for the bank – if they just changed the messages so that they said something longer before giving the code, that would solve this particular problem. For example ‘Thanks for using online banking, Your one-time passcode is below’ You can read the story here: All rights reserved. © Text copyright Fleur 2022.