Nationwide still using a card reader?

[XFool]

I have read these posts with interest. I cannot see the point of Nationwide sending me a card-reader when I have long used a mobile phone to get codes - everyone has a mobile and it takes just a couple of minutes for a code to arrive.

A "couple of minutes"? I wouldn't have the patience for that. What if it doesn't arrive?

In any case, I cannot believe that nowhere on the Nationwide website are there precise instructions about using the card-reader - or even switching it on! Presumably it starts up when you insert a bank card ...

Good grief! You just put the card in... It's a card reader - not the space shuttle. The simple "instructions" accompany every needed transaction online. Look, it's a Chip & Pin device, surely you use much the same every other day when shopping? (Or does everyone now use RFID cards?)

I also watched the videos and then tried to open the battery compartment (in case I need to know how later). Nothing works, paper clip, pen etc. - the card reader stays resolutely shut and so it is now shoved away into a drawer!

I found the tip of a biro or some such worked easily enough to pop it out.

[XFool]

For transferring quickly between people, you should all get a Revolut card. Or one of the many similar cards. The other person receives the money in approx 10 seconds.

Oh no we shouldn't!

"10 seconds", huh? Convenient for some...

https://en.wikipedia.org/wiki/Revolut

"Since Revolut does not have UK bank status, it does not reimburse victims of authorized push payment fraud in that country, and the £85,000 protection of funds deposited in a bank by the Financial Services Compensation Scheme is not available for e-money."

[servodude]

Yeah it's a faff - and you do need to remember to take it with you
My big preference is for authenticator apps; which once set up work even if you swap to a local sim on your travels

The worst companies are those which only have one option, such as ii, with their text messages. That's inconvenient if I've swapped my SIM.

Although, Santander really screwed up when they asked me to phone them to approve a transaction. I was in Thailand, so that would be an expensive phone call and it couldn't possibly offer any additional security over them sending me a code. So I used my Halifax CC instead & haven't used the Santander one since.

At least Nationwide give their customers a choice of card reader or texts.

Better are the companies which offer the options of sending the code by phone or e-mail.

Also, I don't see what's wrong with a fingerprint and a PIN as 2FA.

Yeah I've been caught out with Nationwide before (it's the only UK transaction account I kept) when I've not had the reader and swapped SIM. It seems to be required if you're doing stuff like booking hire cars online

[seahermit]

Well, thanks for the comments, but I have never seen one of these before and I find it odd that it switches on when you shove a card into it - I wonder if that allows for some misuse/hacking by someone clever enough?!

And I think it would be courteous for Nationwide to provide at least basic instructions somewhere.

I'm quite good with technology (for an oldie) but this device does seem to be well and truly jammed - no amount of poking with biros/pins/smartphone pins would release the battery compartment.

But I can't see the point anyway - what could be simpler than a code sent to a mobile phone? Why carry a second device?

[XFool]

Well, thanks for the comments, but I have never seen one of these before and I find it odd that it switches on when you shove a card into it - I wonder if that allows for some misuse/hacking by someone clever enough?!

No - Apart from somebody with access to your card and a reader entering a wrong PIN three times behind your back and blocking your card's PIN.
(What happens if somebody steals your phone?)

And I think it would be courteous for Nationwide to provide at least basic instructions somewhere.

They did, when it was originally supplied. Plus the appropriate prompts are online, depending on the transaction.

But I can't see the point anyway - what could be simpler than a code sent to a mobile phone? Why carry a second device?

What could be simpler than Chip & Pin, which doesn't even need a mobile signal?

[JohnB]

A card is a physical token the bank is sure only exists once. No sure surety for phones where sims can be cloned, and messages can be intercepted and duplicated.

[6Tricia]

What could be simpler than Chip & Pin, which doesn't even need a mobile signal?

Couldn't agree more, there are still many who don't have, or want, a mobile phone!

Tricia

[servodude]

A card is a physical token the bank is sure only exists once. No sure surety for phones where sims can be cloned, and messages can be intercepted and duplicated.

Bank Cards are easier to clone than SIMs

[Lootman]

At least Nationwide give their customers a choice of card reader or texts.

Better are the companies which offer the options of sending the code by phone or e-mail.

Yes, Chase lets me get the code by email, which is better when overseas as 2FA by phone does not always work.

HSBC gave me a card reader 5 years ago and I still have not used it. It is in a box somewhere.

[XFool]

HSBC gave me a card reader 5 years ago and I still have not used it. It is in a box somewhere.

That reminds me. Barclays sent me one of their PINSentry machines years ago. I wish they would use it when I logon to my Barclaycard account.

[Lootman]

HSBC gave me a card reader 5 years ago and I still have not used it. It is in a box somewhere.

That reminds me. Barclays sent me one of their PINSentry machines years ago. I wish they would use it when I logon to my Barclaycard account.

I suppose that one potential use for it would be if I wanted to give access to my account to another person, who of course would not have my phone. In the past I have had to pass on my 2FA code to them.

But otherwise why would I go into my attic, find the box with it in, take it out, read up on how to use it and so on? A 2FA code to my phone is quicker and easer.

[Gersemi]

HSBC gave me a card reader 5 years ago and I still have not used it. It is in a box somewhere.

That reminds me. Barclays sent me one of their PINSentry machines years ago. I wish they would use it when I logon to my Barclaycard account.

They will if you select that option.

In the first screen you enter your surname and one of your membership number, your card number or your sort code and account number (select one of the tabs above the last name box).

In the next screen you have the choice of using the Barclays App or the PINsentry card reader (again select the relevant tab).

At least that's how it works when I log in.

[tjh290633]

HSBC gave me a card reader 5 years ago and I still have not used it. It is in a box somewhere.

That reminds me. Barclays sent me one of their PINSentry machines years ago. I wish they would use it when I logon to my Barclaycard account.

I have one for an account that I run for a local organization. Their software never accepted the result when I tried to pay someone new. Nationwide used a different function and worked with no problems.

Using Barclay's app does the job without problems.

I could never get to the bottom of the problem. Presumably Barclay's software people never tested the function.

TJH

[XFool]

Speaking of card readers, an amusing little conundrum about them comes to mind.

They all implement three secure functions via three blue keys. In words: Identify, Respond, Sign

These keys also have three symbols on them, one for Identify, up and down arrows for Respond and a tick for Sign. The Identify symbol is a solid blue figure, looking a bit like a pawn chess piece, on my NW reader, a blue outline on my Barclays PINsentry machine.

The question is: What is the blue Identify symbol meant to be? I always thought it looked rather like a keyhole, especially on the outline version on the PINsentry. Then it occurred to me it was likely supposed to symbolise a person - head and shoulders - for Identify.

But then again, wouldn't a keyhole be just as appropriate as it is used for sign in, i.e. point of entry? Perhaps it was chosen to represent both?

What do others think their card reader's blue Identify symbol is representing?

[swill453]

The question is: What is the blue Identify symbol meant to be? I always thought it looked rather like a keyhole, especially on the outline version on the PINsentry. Then it occurred to me it was likely supposed to symbolise a person - head and shoulders - for Identify.

But then again, wouldn't a keyhole be just as appropriate as it is used for sign in, i.e. point of entry? Perhaps it was chosen to represent both?

I'd say it's obviously a keyhole.

Note the third one is "sign", not "sign in", which would be a different thing.

Scott.

[the0ni0nking]

Certainly on the Barclays one it is a keyhole.

I have one just sat to the right of my laptop in respect of a business account. I used to have a white one but have now got a black one which matches the image shown on this pdf:

https://www.barclaycard.co.uk/content/d ... pp-v19.pdf

[jaizan]

Yes, Chase lets me get the code by email, which is better when overseas as 2FA by phone does not always work.

Exactly. Somebody should tell the people at ii.
I suspect it's too much of abrdn to care about customers being able to access their accounts
Even though they generate fees from activity.

[servodude]

Yes, Chase lets me get the code by email, which is better when overseas as 2FA by phone does not always work.

Exactly. Somebody should tell the people at ii.
I suspect it's too much of abrdn to care about customers being able to access their accounts
Even though they generate fees from activity.

Thing is though that's about the most insecure way of sending direct info since the Internet was invented. PGP would help if they offered it - and even then it's no real match for a proper authenticator application.
But practically though it sounds like it is less about security than it is the theatre

[Lootman]

Exactly. Somebody should tell the people at ii.
I suspect it's too much of abrdn to care about customers being able to access their accounts
Even though they generate fees from activity.

Thing is though that's about the most insecure way of sending direct info since the Internet was invented. PGP would help if they offered it - and even then it's no real match for a proper authenticator application.

But practically though it sounds like it is less about security than it is the theatre

It is more a matter of balancing accessibility and convenience with security. I am given a choice of code to my phone, code to my email and/or a couple of other options. I choose my phone most of the time. But if I am somewhere with no phone signal than getting the code by email is better than getting no code at all and being locked out of my account.

And anyone intercepting my email would need my email account password, my Chase account number and its associated password. So we are really quibbling here about 99.98% safe versus 99.99% safe.

[Gersemi]

I have one for an account that I run for a local organization. Their software never accepted the result when I tried to pay someone new. Nationwide used a different function and worked with no problems.

Using Barclay's app does the job without problems.

I could never get to the bottom of the problem. Presumably Barclay's software people never tested the function.

TJH

This function works for me. I never use the app.