Radio 4 today mobile phone theft

[Dicky99]

A feature on R4 today concerned mobile phones theft targeted at phones while in use in order get round screen locks. It suggested that by doing so thieves could target phone banking apps by resetting the login access, because reset instructions would be sent to the stolen phone.
There was an invited guest describing how her phone had been grabbed, while she was in mid call, by a thief on a bike and it happened so fast he was gone before she knew what had happened.
As said, the feature was warning about the growth of stealing an unlocked phone in order to access banking apps. It was an alarming prospect and I was anticipating hearing how the victims bank account had been emptied but in fact the guests monetary loss was not this but the use of her chip and pin card which was tucked inside her phone case
Nevertheless I looked at each of the money related apps on my phone of which there are 4 and if I select "forgotten password" they all ask for some information which the thief wouldn't know. Username, email address, account number etc
How much of a risk is it having banking apps on phones and what protective measures over 2FA need to be taken?

One really useful nugget of information on the programme was the emergency telephone number 159 which can be used to quickly contact any bank to report fraudulent activity. It's now stored in my phone.

[servodude]

How much of a risk is it having banking apps on phones and what protective measures over 2FA need to be taken?
.

Both my banking and authenticator apps require either my finger or passcode to open; so even the SMS being defeated doesn't help a thief.

The main problem would be the lack of the phone as 2FA corroborator for any other way to my accounts; and the risk of compromise to my Google account.

So there would be a bit of a race against time - but similar to having lost a wallet. My phone and wallet essentially back each other up for this kind of thing (& travel)

[Mike4]

I heard the article too and as an aside, I found it irritating how much of the article was devoted to discussing how awful it all was and how dreadful the guest felt to have had her phone snatched. After what seemed like several minutes of this I was beginning to wonder if that was all that was going to be discussed.

But no, they eventually got around to some constructive discussion. Much of it covered upthread except for the point that the thief is likely to attempt to reset passwords, and firms often send an email to the registered account to initiate this. And having just nicked the fone, the thief also gets instant unfettered access to the victim's email app. Another big security hole for us to consider.

[simoan]

But no, they eventually got around to some constructive discussion. Much of it covered upthread except for the point that the thief is likely to attempt to reset passwords, and firms often send an email to the registered account to initiate this. And having just nicked the fone, the thief also gets instant unfettered access to the victim's email app. Another big security hole for us to consider.

This is not necessarily the case if the apps in question are individually protected by biometrics, such as my Outlook email. It’s slightly annoying that I have to use Face ID every time I open Outlook but the best form of security is to use multiple layers, so a thief could nick the phone but not get into my email. Good security practice and convenience are at odds with each other but most people are lazy and prefer the latter over the former.

[Dicky99]

I have just two email accounts. One for important stuff and people I know and one for day to day crap. Only the latter has an app on my phone so if someone nicked my phone they'd only have access to my spammy account

[Mike4]

But no, they eventually got around to some constructive discussion. Much of it covered upthread except for the point that the thief is likely to attempt to reset passwords, and firms often send an email to the registered account to initiate this. And having just nicked the fone, the thief also gets instant unfettered access to the victim's email app. Another big security hole for us to consider.

This is not necessarily the case if the apps in question are individually protected by biometrics, such as my Outlook email. It’s slightly annoying that I have to use Face ID every time I open Outlook but the best form of security is to use multiple layers, so a thief could nick the phone but not get into my email. Good security practice and convenience are at odds with each other but most people are lazy and prefer the latter over the former.

But, but.... the point of the article was to highlight the risk of the phone getting grabbed while you are using it.

So you've done the face ID thing and opened the mail app. And the thief grabs your fone while its open....

[servodude]

This is not necessarily the case if the apps in question are individually protected by biometrics, such as my Outlook email. It’s slightly annoying that I have to use Face ID every time I open Outlook but the best form of security is to use multiple layers, so a thief could nick the phone but not get into my email. Good security practice and convenience are at odds with each other but most people are lazy and prefer the latter over the former.

But, but.... the point of the article was to highlight the risk of the phone getting grabbed while you are using it.

So you've done the face ID thing and opened the mail app. And the thief grabs your fone while its open....

...and then keeps the screen on by avoiding its 30sec timeout
...and has your biometrics for when they've switched to the banking app to do some dodgy stuff
and then again when they've switched back to the mail to autheticate the transaction

serioulsy though if they've taken my finger or face to get round the 2FA I've got bigger things to worry about

[simoan]

This is not necessarily the case if the apps in question are individually protected by biometrics, such as my Outlook email. It’s slightly annoying that I have to use Face ID every time I open Outlook but the best form of security is to use multiple layers, so a thief could nick the phone but not get into my email. Good security practice and convenience are at odds with each other but most people are lazy and prefer the latter over the former.

But, but.... the point of the article was to highlight the risk of the phone getting grabbed while you are using it.

So you've done the face ID thing and opened the mail app. And the thief grabs your fone while it’s open....

Ok. I’d have to be using Outlook at the time for them to access my email when they would have a short window of time to use it. If I wasn’t, they couldn’t access it without Face ID ir a 6 digit passcode. I don’t consider that unfettered access.

[simoan]

But, but.... the point of the article was to highlight the risk of the phone getting grabbed while you are using it.

So you've done the face ID thing and opened the mail app. And the thief grabs your fone while its open....

...and then keeps the screen on by avoiding its 30sec timeout
...and has your biometrics for when they've switched to the banking app to do some dodgy stuff
and then again when they've switched back to the mail to autheticate the transaction

serioulsy though if they've taken my finger or face to get round the 2FA I've got bigger things to worry about

Thanks. At least someone gets the point I was making!

All the best, Si

[richfool]

One really useful nugget of information on the programme was the emergency telephone number 159 which can be used to quickly contact any bank to report fraudulent activity. It's now stored in my phone.

Thanks, I didn't know that one. Though note, that number will be on the phone that has just been stolen.

I keep my "screen on" time to 30 seconds. I also have my text messages not showing the content, so I have to open them to read the security code or whatever message it is. I read somewhere that biometric fingerprints are more secure than face recognition.

[jaizan]

Currently, people can buy mobile phones, do a factory reset and sell them.

I would think it should be relatively easy to discourage that.
1 Ensure every phone has a unique serial number stored internally & registered with the phone maker
2 Allow customers to register their ownership of that phone on a database
3 Require all the mobile phone networks to check the serial number against the database

Obviously this wouldn't prevent export to countries that don't participate or breaking for spares, but it should cut out a lot of demand for stolen mobiles.

As for Radio 4 Today, I listened to it for over 25 years, but eventually stopped as I'd had enough of the political bias.

[Urbandreamer]

But no, they eventually got around to some constructive discussion. Much of it covered upthread except for the point that the thief is likely to attempt to reset passwords, and firms often send an email to the registered account to initiate this. And having just nicked the fone, the thief also gets instant unfettered access to the victim's email app. Another big security hole for us to consider.

This is not necessarily the case if the apps in question are individually protected by biometrics, such as my Outlook email.

To be blunt this entails installing a more secure email app than the one provided with the phone.
It's something that I have not done, and I care about phone security. I suspect that most people just use the default email client.

I must look at replacing mine.

[Bminusrob]

I think many of the replies make it clear that even if the phone is grabbed while in use, most of the apps are secure enough. in addition, if the caller is on an incoming call, the phone will still be locked.

However, I think it raises a more important point. I know a lot of people who have "wallets" holding their phone, and also with slots for credit cards. If a phone in such a wallet is stolen, the victim not only loses their phone, but also their credit cards, and having both cards and phone stolen makes it quite difficult to cancel the cards.

[didds]

A feature on R4 today concerned mobile phones theft targeted at phones while in use in order get round screen locks.....

... One really useful nugget of information on the programme was the emergency telephone number 159 which can be used to quickly contact any bank to report fraudulent activity. It's now stored in my phone.

how do you quickly call them if your phone has been stolen?

[dionaeamuscipula]

A feature on R4 today concerned mobile phones theft targeted at phones while in use in order get round screen locks.....

... One really useful nugget of information on the programme was the emergency telephone number 159 which can be used to quickly contact any bank to report fraudulent activity. It's now stored in my phone.

how do you quickly call them if your phone has been stolen?

Find someone wandering about on a phone call....

DM

[simoan]

I think many of the replies make it clear that even if the phone is grabbed while in use, most of the apps are secure enough. in addition, if the caller is on an incoming call, the phone will still be locked.

However, I think it raises a more important point. I know a lot of people who have "wallets" holding their phone, and also with slots for credit cards. If a phone in such a wallet is stolen, the victim not only loses their phone, but also their credit cards, and having both cards and phone stolen makes it quite difficult to cancel the cards.

This is obviously stupid though, isn’t it? Even the dumbest of people should understand the old saying about not keeping “all of your eggs in one basket”. Laziness, ignorance and convenience are the enemy of good security.

[didds]

how do you quickly call them if your phone has been stolen?

Find someone wandering about on a phone call....

DM

you are of course right ... but...

everybody is going to hand over their phone to a total stranger to borrow who "has to report a stolen phone" aren't they?

[Arborbridge]

As for Radio 4 Today, I listened to it for over 25 years, but eventually stopped as I'd had enough of the political bias.

Your loss!

Incidentally, whichever party gets in always complains to the BBC about policial bias.

[Mike4]

As for Radio 4 Today, I listened to it for over 25 years, but eventually stopped as I'd had enough of the political bias.

Your loss!

Incidentally, whichever party gets in always complains to the BBC about policial bias.

And I've heard representatives of the BBC on more than one occasion say they keep a close track of complaints about political bias. And they record whether the complaint is about the BBC being too lefty or too righty. They take the view that provided the complaints of left bias and right bias are arriving in broadly equal numbers, they are getting the balance about right.

[kempiejon]

And I've heard representatives of the BBC on more than one occasion say they keep a close track of complaints about political bias. And they record whether the complaint is about the BBC being too lefty or too righty. They take the view that provided the complaints of left bias and right bias are arriving in broadly equal numbers, they are getting the balance about right.

I have heard that too but as you say it's from a BBC rep who like the lass said - would say that.
I forget the satire that used the tag "because of the unique way the BBC is funded..."