Security for online transactions

[swill453]

local branch of nationwide are now saying that verification might be possible by card reader next year, up till then of course security or lack of it will be down to the customer if the customer lacks a mobile phone or connection to receive their texts. Such forward planning!

The specific security test that the "text to mobile phone" is checking is "Is the person doing the transaction in possession of the registered mobile phone".

One would have thought that it's not beyond the bounds of technology to come up with a way of verifying this fact when the phone doesn't have a mobile signal but is connected to the Internet by other means (wifi).

I know this probably isn't very easy to do securely, but surely it's not impossible?

Scott.

[supremetwo]

Oh well good try.

local branch of nationwide are now saying that verification might be possible by card reader next year, up till then of course security or lack of it will be down to the customer if the customer lacks a mobile phone or connection to receive their texts. Such forward planning!

But if the customer loses the phone or has the phone nicked and hacked or its number cloned, there is nothing to stop a thief receiving the code and proceeding with a fraudulent transfer.

Must apply to many who only use a smart phone for all their transactions.

[swill453]

But if the customer loses the phone or has the phone nicked and hacked or its number cloned, there is nothing to stop a thief receiving the code and proceeding with a fraudulent transfer.

Must apply to many who only use a smart phone for all their transactions.

There's usually more than one security factor in play though. For an online purchase usually the CVV code is required as well.

It's never 100% secure though.

Scott.

[stooz]

Oh. I didn't think it did.
Sorry.
Maybe there is an alterative from your supplier.
Also Vodafone sell a mobile booster?

[AF62]

One would have thought that it's not beyond the bounds of technology to come up with a way of verifying this fact when the phone doesn't have a mobile signal but is connected to the Internet by other means (wifi).

I know this probably isn't very easy to do securely, but surely it's not impossible?

There is a method, and it exists now!

As I posted above, Amex will be sending a push notification to the Amex app if you have it installed on your phone, which will obviously use WiFi. Only if you don't have the Amex app will they send you a verification code, and even then they say they will do this "by text and/or email".

https://www.americanexpress.com/uk/bene ... u/safekey/

This technology using an authenticator on your phone (and using WiFi) is perfectly standard as anyone using Microsoft or Google 2FA will tell you (and I hope that is everyone here - and if you are not, then turn on 2FA now!).

[scotia]

Also Vodafone sell a mobile booster?

for several years, until Vodafone improved their coverage, we used a Vodafone Sure Signal box that connected to our broadband router, and provided us with a Vodafone (3G ?) Signal. However, it was not always reliable, and my first box died.

[AF62]

Also Vodafone sell a mobile booster?

for several years, until Vodafone improved their coverage, we used a Vodafone Sure Signal box that connected to our broadband router, and provided us with a Vodafone (3G ?) Signal. However, it was not always reliable, and my first box died.

I have a similar device from EE and it works very well. However they stopped issuing them to residential customers several years ago when WiFi calling became available on more phones so the need for them dropped away.