First Direct Internet Banking Plus closing

[genou]

TY for the extra info, Urbandreamer. The AJ Bell Mywealth software looks close to what I have with Internet Banking PLus, but I would need to open an account with them....

I wouldn't rush. I just had a play - I can add a bank account ( SAN ) but there is as yet no functionality I can see to reach out to access the account. I imagine it is "coming soon" .

I'm not so sure that there ever will be anything beyond viewing the accounts with A J Bell. (NOTE that SAN needs to check that you are OK with even sharing that).

I've not made my self clear. There is no live link from AJB to Santander that I can find. I added a bank account ( sort code/ ac ) and was asked for a balance - no suggestion that it could access my SAN account via open banking. I would not expect more than read only, but that is not on offer AFAICS.

[gbjbaanb]

I'm sure the new open banking regulations include many features that are designed to make things secure, and the IBP is simply not compliant, so they've looked at the people using it and decided the expense of making it compliant far outweighs the benefit (to them).

Open banking is still in its infancy so while since forward thinking places like AJBell offer a placeholder, it's little more than that at the moment. I expect and hope it'll get better in time.

The security is better than what you had with IBP, the open banking specs mean you won't be holding passwords with one bank, but modern auth tokens that can be used for read-only access. Very similar to how you can log on to sites using your Google or Facebook login without Google or Facebook having access.

Apparently NatWest, Lloyds and Halifax have this already. Not noticed myself...

https://www.altfi.com/article/5100_natw ... en-banking

The ability to get write access as well will come with the next phase "later this year"....

Having browsed around a bit it seems Barclays are very into it, so maybe that's a first place to look for an aggregator service.

[swill453]

I'm sure the new open banking regulations include many features that are designed to make things secure, and the IBP is simply not compliant, so they've looked at the people using it and decided the expense of making it compliant far outweighs the benefit (to them).

Actually I think the explanation for the end of Internet Banking Plus is more simple than that, and not necessarily related to open banking.

First Direct's own Internet Banking now informs you that from September the option of logging in without a secure key will no longer be available. IBP uses this option, and it's quite difficult to see how they could integrate the secure key into the "update all accounts" function of IBP.

If other institutions go the same way, and require the use of a 2nd factor in the authentication process, then the whole thing becomes completely unwieldy.

Scott.

[gbjbaanb]

I'm sure the new open banking regulations include many features that are designed to make things secure, and the IBP is simply not compliant, so they've looked at the people using it and decided the expense of making it compliant far outweighs the benefit (to them).

Actually I think the explanation for the end of Internet Banking Plus is more simple than that, and not necessarily related to open banking.

First Direct's own Internet Banking now informs you that from September the option of logging in without a secure key will no longer be available. IBP uses this option, and it's quite difficult to see how they could integrate the secure key into the "update all accounts" function of IBP.

If other institutions go the same way, and require the use of a 2nd factor in the authentication process, then the whole thing becomes completely unwieldy.

Scott.

It turns out its even more simple:

Screen-scraping is being phased out, and should eventually be banned under regulations taking effective from September 2019. But, until then, third party apps and websites may still rely on this method of accessing your data.

[Nocton]

gbjbaanb, I don't understand your argument about two-factor logging in, screen scraping and IBP. I use IBP and all the bank, credit card and BS accounts it accesses require two-factor entries. The passwords are stored on my computer, not in the cloud and First Direct/IBP does not know them, and when they are entered automatically into an account it is the same as if I typed the characters in myself. Once in, I can use the entered account just as if I had logged in myself, whereas all the Open-banking options I have seen just allow me to look at the balances, which is mostly not very useful. It is such a tremendously useful facility that the banks seems to have avoided here, whereas in the US such money aggregating software - like ewise - is very common. If this is a result of Open Banking, then we seem to be going backwards in functionality.

[swill453]

I don't understand your argument about two-factor logging in, screen scraping and IBP. I use IBP and all the bank, credit card and BS accounts it accesses require two-factor entries. The passwords are stored on my computer, not in the cloud and First Direct/IBP does not know them, and when they are entered automatically into an account it is the same as if I typed the characters in myself.

Two-factor means password(s) plus something else, usually either a physical key or a one-time code sent by text. Correct me if I'm wrong, but as far as I know IBP can't handle the latter.

Scott.

[Nocton]

Two-factor means password(s) plus something else, usually either a physical key or a one-time code sent by text. Correct me if I'm wrong, but as far as I know IBP can't handle the latter.
Scott.

OK, thank you. I thought two-factor was the need to enter at least two passwords/other information. At any rate, none of my bank or other financial accounts require a one-time code. The only place where I have that is from HMRC when I fill in my tax form. I don't use a mobile phone for financial stuff, so when I get a one-time code from HMRC it is extra security as it is a different device. But if I am using a mobile phone and get the one-time code on that then it adds nothing to the security since it is the same device and someone who has stolen/misused my phone has everything in one place.
And as I said, the idea of a money aggregator is well established, but here in the UK we seem to be going backwards with finance/banking as we move forward in things like rail and bus 'aggregator' apps.

[swill453]

But if I am using a mobile phone and get the one-time code on that then it adds nothing to the security since it is the same device and someone who has stolen/misused my phone has everything in one place.

But that's where the password comes in. Two-factor is typically implemented as something you have (e.g. mobile phone) plus something you know (password).

Most (or all) online banking is moving that way.

Scott.

[mc2fool]

But if I am using a mobile phone and get the one-time code on that then it adds nothing to the security since it is the same device and someone who has stolen/misused my phone has everything in one place.

But that's where the password comes in. Two-factor is typically implemented as something you have (e.g. mobile phone) plus something you know (password).

Most (or all) online banking is moving that way.

And/or something you are (e.g. biometrics such as fingerprint, voice, face).

Highly relevant to this whole discussion is the 2nd Payment Services Directive (PSD2), which comes into full effect on 14 Sep 2019 and requires Strong customer authentication:

"Article 97(1) of the directive requires that payment service providers use strong customer authentication where a payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.

The directive defines strong customer authentication in Article 4(30) as:
an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data."

So, basically from 14 Sep two factor authentication will be needed to login to any bank, etc, and to make any electronic payment (over 30 Euros, see Barclays links below), which includes using credit/debit cards online.

I'm a bit surprised we haven't heard more about this so far ... all of my banks (at least, the ones that don't limit withdrawals to a "nominated account") already require a one-time passcode texted to my mobile to setup a new payee, but so far only Santander has sent me anything saying they'll soon be requiring two factor authentication to login. https://www.santander.co.uk/personal/support/ways-to-bank/changes-to-how-you-log-on-to-online-banking

Some readable pages from Barclays on the matter: https://www.barclaycard.co.uk/business/news-and-insights/what-is-psd2 & https://www.barclaycard.co.uk/business/news-and-insights/strong-customer-authentication-sca

An article from Which saying "customers who don't – or can't – use a mobile phone may be forced to call their bank or visit their local branch to complete online security checks". https://www.which.co.uk/news/2019/06/new-online-security-checks-exclude-people-without-mobile-phones-or-decent-signal/

PSD2 also brings about Open Banking. https://www.wired.co.uk/article/open-banking-cma-psd2-explained

[Nocton]

Thank you every one for the extra information - there seems a lot more to this than first appeared or that First Direct have bothered to tell me. The only time when I need two-factor authorisation is when I set up a new payee and then I use a card reader. I do not, at present need it for logging in, although out of the blue NatWest sent me a special card and card reader for on-line banking - rather surprising since I already have a card reader and use a debit or credit card with it. So maybe this special on-line banking card is just for logging in? We shall see.

I still don't see much extra security if the code is sent to the same device on to which I have entered the password, as once a criminal has my password and phone he has everything needed, whereas with password and PC he cannot get further.
Now the card reader does add something extra. I once enquired of HMRC why the code was not emailed and was told just that, that it should not go to the same device on which I was doing the on-line tax.

[swill453]

I still don't see much extra security if the code is sent to the same device on to which I have entered the password, as once a criminal has my password and phone he has everything needed, whereas with password and PC he cannot get further.

In both cases he needs the phone and the password, therefore fairly good security.

There's always a balance between convenience and security.

Scott.

[mc2fool]

... so far only Santander has sent me anything saying they'll soon be requiring two factor authentication to login.

It's still the case that of my banks only Santander has sent (emailed) me anything about this, but I've just noticed that on the Bank of Scotland login page there's a notice telling people to get ready for extra security checks and a link to https://www.bankofscotland.co.uk/aboutonline/changes-to-internet-banking.html.

Seems like whereas Santander will require people to have a mobile phone (a smart phone for their app or a dumb one for receiving a text), Bank of Scotland will also allow spoken passcodes over a landline and, for logging in, "trusted" devices, where presumably a device may be verified once and trusted thereafter (much as 2FA for logging into Google works).

[paulnumbers]

A quick heads up to anyone using First Direct Internet Banking Plus. This service is to close on the 26th August.
This apparently due to legislative changes and the new security requirements coming in September. A bit of a shame, I've been using this for years and always found it to be extremely useful.

Does this look familiar by any chance?

https://i.imgur.com/IvQLr16.png

https://www.ewise.com.au/accunity/aa/home.asp

[BBLSP1]

It's still the case that of my banks only Santander has sent (emailed) me anything about this, but I've just noticed that on the Bank of Scotland login page there's a notice telling people to get ready for extra security checks and a link to https://www.bankofscotland.co.uk/aboutonline/changes-to-internet-banking.html.

Seems like whereas Santander will require people to have a mobile phone (a smart phone for their app or a dumb one for receiving a text), Bank of Scotland will also allow spoken passcodes over a landline and, for logging in, "trusted" devices, where presumably a device may be verified once and trusted thereafter (much as 2FA for logging into Google works).

NatWest have information on their website. I was concerned as my area, on the edge of the Peak District but only 15 miles from Manchester, has next to no mobile signal - however, I went on their chat line and in the case of NatWest, online banking will still be possible using the card reader which I already have, no mobile required. Useful, especially if abroad. So anyone in a similar situation with NatWest is best advised to get a card reader now if they do not already have one.

[TopStar74]

I know people are going to say - well, just get used to it, like the rest of us who do not have IBP. But I am finding I am freaking out.

I seriously would like to know from the rest of the friendly folk here who have never used IBP or heard of it......how did you manage all your multiple logins to different banks and have one consolidated picture? I do have 3 credit cards (of which I am willing to close one, just because IBP is closing and I want to reduce the number of things I need to login to) and several savings accounts, mortgage accounts, loyalty cards....and several manually setup balances. It was SO BLOODY USEFUL to me! Was almost disturbed and distressed and then angry. Fired an agitated reply to FD. Started looking around to see if any other bank offered this and found possibly none did or there is no such alternative. So the only alternative is to keep individual track of things.

I felt liberated and progressive in terms of the burden for over 13 years since 2006, and now only when I am losing this do I suddenly realise how much IBP was a blessing to me. I really should be grateful to FD for making my life so much easier for 13 years. Thank you FirstDirect!

[vrdiver]

I seriously would like to know from the rest of the friendly folk here who have never used IBP or heard of it......how did you manage all your multiple logins to different banks and have one consolidated picture?

I have a spreadsheet with all my financial accounts listed and I update the balances monthly (manually).
I use keepass to store all my login details for those accounts, so I only have to remember my keepass password, not the others.

I have a "budget" spreadsheet that forecasts monthly expenditure, including future credit card payments and cash withdrawals (usually an overestimate, just to be safe) and since most of our actual spending is through credit cards (paid off in full of course!) the current account cash requirements are easy to manage, so the whole exercise takes about 15 minutes (for 22 accounts requiring 10 login IDs) between Mrs VRD and me).

The upside to the system is that if anything happens to me, Mrs VRD has a document that records where all the money is. I have a document that I can use to play out different scenarios with. The spreadsheet also includes notes like "savings rate due to end on..." etc. so it helps me be a bit more proactive in making my cash buffer earn its keep.

It's a pain to lose a facility you have gotten used to. However, I suspect that you will find an alternative method of getting that financial overview and may even find additional benefits of your new method.

VRD

[paulnumbers]

I know people are going to say - well, just get used to it, like the rest of us who do not have IBP. But I am finding I am freaking out.

I seriously would like to know from the rest of the friendly folk here who have never used IBP or heard of it......how did you manage all your multiple logins to different banks and have one consolidated picture? I do have 3 credit cards (of which I am willing to close one, just because IBP is closing and I want to reduce the number of things I need to login to) and several savings accounts, mortgage accounts, loyalty cards....and several manually setup balances. It was SO BLOODY USEFUL to me! Was almost disturbed and distressed and then angry. Fired an agitated reply to FD. Started looking around to see if any other bank offered this and found possibly none did or there is no such alternative. So the only alternative is to keep individual track of things.

I felt liberated and progressive in terms of the burden for over 13 years since 2006, and now only when I am losing this do I suddenly realise how much IBP was a blessing to me. I really should be grateful to FD for making my life so much easier for 13 years. Thank you FirstDirect!

Jesus wept. Ewise is the same software, and I’ve posted the link above.

[Nocton]

Jesus wept. Ewise is the same software, and I’ve posted the link above.[/quote]

I am fully in agreement with topstar. As previously said, we are going backwards in functionality and convenience. Unless you know differently Paul, ewise is not available in the UK as previously noted, which makes the situation even more frustrating. The link posted is to ewise in Australia.

[paulnumbers]

I am fully in agreement with topstar. As previously said, we are going backwards in functionality and convenience. Unless you know differently Paul, ewise is not available in the UK as previously noted, which makes the situation even more frustrating. The link posted is to ewise in Australia.

Yes they cover the UK.

As far as I can tell it’s the same software. I haven’t used the First direct one for at least 10 years, so would need someone to check, but I’ve compared what the first direct one looks like according to google, and what ewise looks like, and they look more or less the same. I've used ewise for 10-15 years.

First Direct

http://www3.firstdirect.com/demos/ibplu ... ations.gif

Ewise

https://i.imgur.com/HCYAxyS.png

Here is an article from 15 years ago where it mentions that ewise run the first direct system.

https://www.pcworld.idg.com.au/article/ ... s_service/

[mc2fool]

I've used ewise for 10-15 years.

And have you been using it on the same computer for all that time?

The site you linked to looks like one from a bygone age, and it does say, on that page, "... accountunity has been designed to take advantage of the security features of Internet Explorer 6 ..."! And their FAQ says, "The Portable Profile feature allows you to save your private details onto a floppy disk ..."!

In any case, the real question for folks looking for something like this is how does it deal with two factor authentication -- and will it still work after the 14th of September?