Martin Brown wrote:

> Some bank apps contain your bank card PIN in the clear - which I do not consider
> a safe or sensible practice. That's why I won't have one.

They can display it in the clear, but I highly doubt they have it stored it in
the clear, they'll either obtain it from the bank's servers or have the
intermediate pin stored, and obtain your actual offset from the bank's servers.

Is the intermediate pin still stored on the magstripe?

Yes, you have to trust they wipe the result from memory afterwards, but they
only display it for a few seconds.

On 23/10/2022 15:22, Chris Hogg wrote:
> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
> <'''newspam'''@nonad.co.uk> wrote:
>
>> On 23/10/2022 13:49, Chris Hogg wrote:
>>> I got scammed at the end of last week. All sorted and no harm done,
>>> but the scammer told me that the normal security checks such as
>>> mother's maiden name etc was no longer being used, and everything was
>>> being done via the Pinsentry system. After resistance from me I
>>> eventually went along with it and gave him all he asked for! :-(
>>
>> So you mean he tricked you into entering your card number
>
> Yes, that.
>
>> and doing the
>> ID me by PIN and passing him that information
>
> No, I didn't give him my pin, at least not directly, unless he is able
> to deduce it from my pinsentry response. Could that happen, and if so,
> what's the point of pinsentry? Not a sentry at all.
>

It should prove that the card is in your possession unless it has been
stolen *and* the thief knows what your pin number is, since PinSentry
readers are fairly generic and not in any way tied to your account.

On 24/10/2022 08:41, Chris Hogg wrote:

> I hope that's the end of it.
>

Err, no. Now you should download the Barclays App onto
your SmartPhone and setup the key words that only a
Genuine person calling from Barclays would know about.

On 24/10/2022 10:51, John Rumm wrote:
> On 24/10/2022 10:29, Theo wrote:
>>
>> So we shouldn't be complacent that we won't be taken in, because
>> eventually
>> we will.  The thing to think about is what defences we might use to
>> prevent
>> the hook turning into actual damage.

I am fairly sure that it is only a matter of time before I get caught
out by a parcel non-delivery scam at least to the point of clicking on
it. Likely to happen when I am in a hurry, expecting a parcel from that
courier and see the non delivery message appear at about the right time.

Sometimes it does happen although the regular guys know where to put
stuff if I'm not in (increasingly rare in the Covid and post-Covid era).

> Indeed, one of the things I try to get across when training people on
> this stuff, is that the moment you think "I am too smart to get caught
> out like this" you are more rather than less vulnerable. It only takes
> the right circumstances to come together, and you can get fooled. As you
> say it is the defence in depth that then matters.

All cold calls are presumed hostile is a very workable heuristic.
I don't know why it isn't more widely advertised as a fix.

I guess if everybody did it then the cold calling sales model would
break down and with it the income of telcos and cold calling centres.

--
Regards,
Martin Brown

On 24/10/2022 11:33, Andy Burns wrote:
> Martin Brown wrote:
>
>> Some banks now allow you to pay cheques in by photographing the
>> original from their app. The same functionality is not present in web
>> banking.
>
> Handy for the occasional refund cheque, but not especially useful due to
> limited numbers and values of cheques that can be paid in by phone.

I get paid by cheque about twice a year so it is entirely academic now.
There are still a few Luddites who still insist on using them.

I use about the same number of cheques per year too. To pay Luddites
that are afraid to give me their bank details and be paid online.

--
Regards,
Martin Brown

On 24/10/2022 11:38, The Natural Philosopher wrote:
> On 24/10/2022 11:04, Chris Hogg wrote:
>> On Mon, 24 Oct 2022 10:55:20 +0100, The Natural Philosopher
>> <tnp@invalid.invalid> wrote:
>>
>>> On 24/10/2022 08:41, Chris Hogg wrote:
>>>> I made sure that
>>>> Barclays had also blocked any on-line banking and telephone banking -
>>>> I don't use them, have never used them and don't need them
>>> then why do you have a pin sentry?
>>
>> Because two years ago I got the impression it would be essential, so I
>> went into the bank and asked for one. Was given it, no questions
>> asked,
>>
> Blimey.
>

They are not tied to any account. You can even use another banks
pinsenty device with a Barclay debit card and vice-versa

This is why Barclays are trying to cajole people into using
the PinSentry that is part of their SmartPhone App (as opposed
to using a PC to login to Barclays online banking).

The former allows you to set up extra secret words to confirm
the identity of a genuine call from the bank.

On 24/10/2022 10:46, Martin Brown wrote:
> On 24/10/2022 07:51, Chris Green wrote:
>> Andy Burns <usenet@andyburns.uk> wrote:
>>>
>>> Chris Green wrote:
>>>
>>>> You should never tell anyone the 'magic number' the card reader
>>>> gives you.
>>>> The only thing you should ever do with it (as far as I am aware) is
>>>> to enter
>>>> it in the right field when logging in to your bank or when confirming
>>>> payments and such.
>>>
>>> The counter staff sometimes ask you to put your PIN into their
>>> PINsentry to
>>> verify your ID in branches
>>
>> I don't think I have been to my personal banking bank for decades! :-)
>
> I have never been inside my bank branch (which for peculiar reasons of
> takeovers and mergers was not my nearest branch with bank name on it).
>>
>> The above wouldn't work for HSBC anyway as their equivalent of
>> pinsentry is personalised and doesn't require your bank card.
>
> HSBC and several others have recently closed their branches. The High
> Street now quite literally has several "holes in the wall" where bank
> machines used to reside. Last men standing are Barclays and Santander.
>

You can't be living that far out in the sticks then if you still
have 2 physical banks. I have to drive 10 miles to the nearest
large towns in Sussex to visit a Barclays branch.

On 24/10/2022 08:56, Andy Burns wrote:
> Chris Green wrote:
>
>> John Rumm wrote:
>>
>>> Barclays also use it in branch - say when making  a cash withdrawal
>>> over the counter.
>
> For paying in batches of cheques I take them to the counter (the app
> only allows a small number per week and a low value per cheque) the auto
> cheque scanners in branch are comically inaccurate.
>
>> You mean your card in the reader and enter your PIN?  I think I'd
>> run a mile!
>
> Paying-in slips no longer seem to exist (nor pens on dangly chains)
> after you explain why you refuse to use the cheque scanners, they
> harrumph and ask you for your debit card hand it back within their
> pinsentry for you to enter pin, then swipe the cheques through the MICR
> slot on their keyboard.
>

On the rare occasion that I have to pay a cheque into my account,
they just swipe my debit card on their keyboard and auto-scan
the cheque. Never been asked for my pin number and the receipt
is just stapled into the paying in book.

On 23/10/2022 15:35, The Natural Philosopher wrote:
> On 23/10/2022 15:20, Chris Hogg wrote:
>> On Sun, 23 Oct 2022 14:32:49 +0100, Andrew
>> <Andrew97d-junk@mybtinternet.com> wrote:
>>
>>>>
>>>> Different banks may have different names for the system. It's
>>>> basically a card reader that can confirm a person's identity. It's a
>>>> pity the banks don't have a similar system for confirming who they
>>>> are, so that the private individual can check they're not talking to a
>>>> scammer.
>>>>
>>>
>>> Barclays does have just that system. You set up a word or phrase
>>> on your Barclays PinSentry app that only the genuine bank will
>>> know about.
>>
> No, you dont.
>

YES, you do. I am referring to the Barclays App for Android
or iPhones which has its own software PinSentry and you can
also create words or phrases which will confirm the identity
of an unknown caller who claims to be from Barclays.

If the OP had this on his SmartPhone (if he has one) then
the scammer would have fallen at the first fence.

The physical PinSentry is being deprecated, certainly by
Barclays. They only like to supply the extra large ones
to people with poor eyesight, everyone else is steered
towards the Smartphone App

On 23/10/2022 22:54, Bob Eager wrote:
> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>
>> Out of interest, what online banking can you do with a phone app that
>> you can't do with a computer at home? More to the point, why would you
>> need to do it then rather than wait until you got home?
>
> Pay in a cheque.
>
>
>
Confirm that an unknown caller really is a genuine Barclays employee

On 24/10/2022 07:46, Jeff Layman wrote:
> On 24/10/2022 02:02, John Rumm wrote:
>> On 23/10/2022 22:16, Jeff Layman wrote:
>
>>> Out of interest, what online banking can you do with a phone app that
>>> you can't do with a computer at home?
>>
>> Pay by bonk. (i.e. using the phone for a contactless payment device)
>
> You've convinced me! :-))))
>

I believe even those ladies (?) now offer contactless facilities

On 24/10/2022 10:49, The Natural Philosopher wrote:
> On 23/10/2022 22:16, Jeff Layman wrote:
>> On 23/10/2022 19:20, Andy Burns wrote:
>>> The Natural Philosopher wrote:
>>>
>>>> I dont use a phone app.
>>>> I use a PIN sentry
>>>> It wants my membership number, my credit card number and a pin
>>>> sentry generated
>>>> code
>>>
>>> the phone app incorporates the functionality of a PINsentry, without
>>> having to
>>> carry around a bit of blue plastic.
>>
>> I don't use a banking app, but if it has the function of a PINsentry
>> wouldn't the OP have got caught in the same way?
>>
>> Out of interest, what online banking can you do with a phone app that
>> you can't do with a computer at home? More to the point, why would you
>> need to do it then rather than wait until you got home?
>>
> The millennial snowflakes cant use a keyboard. They have to do
> everything on StupidPhones

Cough. Everytime you fill a text or number box on a Smartphone,
a software touch sensitive keypad appears. The only problem is
that it is tad small for those without 20/20 vision and difficult
to see in direct sunlight.

On 24/10/2022 11:57, The Natural Philosopher wrote:

> Every time I give an email to a new online entity "your details will be
> held securely and not shared with third parties" I get up to 50 spam
> emails selling me everything from sex to a an invitation to collect my
> lottery winnings.
>

I hardly ever get an spam emails, but then I use Windows 10 and
BT Internet. Perhaps your problem is caused by your obsession with
Linux ?.

> My PIN numbers are not written down anywhere, In the case of my main
> one, it is engraved into my brain cells, my HSBC one is written down in
> a personal shared secret code.
>
> I have other passwords in a password manager, the pass key  to which is
> again engraved in my brain and is utterly unguessable.

Including by you if you ever have a stroke or similar brain accident.

On 23/10/2022 17:59, Martin Brown wrote:
> On 23/10/2022 16:13, Rod Speed wrote:
>> On Mon, 24 Oct 2022 01:49:13 +1100, Martin Brown
>> <'''newspam'''@nonad.co.uk> wrote:
>>
>>> I won't touch phone banking apps though. Anything daft enough to have
>>> my PIN available in plaintext isn't going to have me as a user.
>>
>> But the best phone apps use touch ID or facial recognition on the
>> phone, no PIN involved.
>
> AT least in the UK the banking phone app contains the bank card PIN and
> there has been a spate of recent thefts from gyms where the mobile phone
> and bank card(s) were stolen and account emptied before the individuals
> affected even knew they were missing. It hinged on the flash up display
> of a TFA OTP code sent to the real users mobile phone which could be
> read momentarily by any Tom, Dick or Harry.
>
> Bank then says "Your problem you must have disclosed your PIN".
> BBC discovered otherwise after a bit of experimentation. BBC R4 5/9/22
>
> https://www.bbc.co.uk/programmes/m001brf0
>
> The scam is still in play right now.
>
> Most UK banks have now adjusted their TFA txt preamble so that the OTP
> is no longer visible in the preview flash up msg on a locked phone.
>

Android phones allow you to hide sensitive notifications. You must
unlock the phone to see them.

On 24/10/2022 11:30, The Natural Philosopher wrote:

> You can hack a stupidphone, you can't yet hack my brain for my PIN which
> is the first one I was ever given by Barclays bank in around 2000.

Crikey. Anyone determined enough will shoulder surf you while
standing behind you in the queue and use instant messaging to
pass the PIN to his mate(s) outside who will follow you and
watch you getting in your car or pinch you wallet while
you don't know what is happening.

Or they follow you home and come back later for a bit of
burglary and take the expensive car too. All while you
are in the land of nod.

Sometimes making contactless payments when there are too
many people about is better.

On 24 Oct 2022, Tim Streater wrote

> On 23 Oct 2022 at 13:49:48 BST, Chris Hogg <me@privacy.net> wrote:
>
>> I got scammed at the end of last week. All sorted and no harm
>> done, but the scammer told me that the normal security checks
>> such as mother's maiden name etc was no longer being used, and
>> everything was being done via the Pinsentry system. After
>> resistance from me I eventually went along with it and gave him
>> all he asked for! :-(
>
> The rules here are:
>
> 1) Ignore any texts purporting to be from an organisation such as
> a bank or delivery cpy, where the text has a link for you to
> follow.
>
> 2) Examine carefully any emails similar to the texts of (1),
> above. (When I created my email client, I added code such that
> hovering over a purported link in the email puts up a tip showing
> the actual web address you'd be going to).

I think I assumed that all dedicated email clients did this as
standard practice -- Thunderbird certainly does, as well as the
Android clients I've used on my phone. (I settled on "TypeApp",
which has served me well for a few years now.)

Is this something that web-based email systems don't do? (I
experimented briefly with web-based providers like gmail many moons
ago, but quickly gave up on them. I can't believe that anyone in
their right mind would consciously opt to use a clunky website
interface instead of a dedicated client.)
>
> 3) Banks make it quite clear they'll never call you asking for
> password etc details. Any sales calls or supposed calls from
> banks, just hang up the phone. One can of course do that at any
> time with any phone call.

An additional rule applying to emails is to ignore any email that
doesn't address you by name. I've seen a number of otherwise fairly-
credible scam emails that either omit the salutation entirely or are
addressed to "Dear Customer". Sort of waves a bright red flag in
your face.

> How we operate any bank accounts we might or might not have, I
> won't be sharing with you chaps, sorry.

--
Cheers,
Harvey

On 14:32 23 Oct 2022, Martin Brown said:
> On 23/10/2022 13:49, Chris Hogg wrote:
>>
>>
>> I got scammed at the end of last week. All sorted and no harm done,
>> but the scammer told me that the normal security checks such as
>> mother's maiden name etc was no longer being used, and everything
>> was being done via the Pinsentry system. After resistance from me I
>> eventually went along with it and gave him all he asked for! :-(
>
> So you mean he tricked you into entering your card number and doing
> the ID me by PIN and passing him that information (possibly allowing
> access to your bank account). I suggest you contact R4 You & Yours
> they will love this as a story of the latest scam - I can see lots of
> people falling for it if the spiel on the other end of the line is
> done well.

My friend fell for exactly that and she's very cautious.

The scammer then signed onto her account and transferred money out of
it, whilst she was still speaking to him on the phone.

The bit I don't understand is why the scammer chose to transfer several
thousand pounds to an existing account (which happened to be held by a
close friend of my scammed friend).

Of course the close friend returned the money when everyone ralised
what had happened. BUT ... how would the scammer have planned to get
hold of that transferred money?

Any ideas?

On 16:39 23 Oct 2022, Chris Green said:

> Chris Hogg <me@privacy.net> wrote:
>> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
>> <'''newspam'''@nonad.co.uk> wrote:
>>
>> >and doing the
>> >ID me by PIN and passing him that information
>>
>> No, I didn't give him my pin, at least not directly, unless he is able
>> to deduce it from my pinsentry response. Could that happen, and if so,
>> what's the point of pinsentry? Not a sentry at all.
>>
> I don't really understand this. You should never tell anyone the
> 'magic number' the card reader gives you. The only thing you should
> ever do with it (as far as I am aware) is to enter it in the right
> field when logging in to your bank or when confirming payments and
> such.
>
> Someone asking you what the number is screams 'scam' at me.

The con is worked to make you feel it is you who has to prove yourself to
the scamming party. You are asked for the 'magic number' you have
generated, allegedly to let the other party know you're the genuine
account holder.

On 24/10/2022 15:02, HVS wrote:
> On 24 Oct 2022, Tim Streater wrote
>
>> On 23 Oct 2022 at 13:49:48 BST, Chris Hogg <me@privacy.net> wrote:
>>
>>> I got scammed at the end of last week. All sorted and no harm
>>> done, but the scammer told me that the normal security checks
>>> such as mother's maiden name etc was no longer being used, and
>>> everything was being done via the Pinsentry system. After
>>> resistance from me I eventually went along with it and gave him
>>> all he asked for! :-(
>>
>> The rules here are:
>>
>> 1) Ignore any texts purporting to be from an organisation such as
>> a bank or delivery cpy, where the text has a link for you to
>> follow.
>>
>> 2) Examine carefully any emails similar to the texts of (1),
>> above. (When I created my email client, I added code such that
>> hovering over a purported link in the email puts up a tip showing
>> the actual web address you'd be going to).
>
> I think I assumed that all dedicated email clients did this as
> standard practice -- Thunderbird certainly does, as well as the
> Android clients I've used on my phone. (I settled on "TypeApp",
> which has served me well for a few years now.)
>
> Is this something that web-based email systems don't do? (I
> experimented briefly with web-based providers like gmail many moons
> ago, but quickly gave up on them. I can't believe that anyone in
> their right mind would consciously opt to use a clunky website
> interface instead of a dedicated client.)

I use Thunderbird on my home machines, Outlook on the company ones,
RoundCube as a web based email system for remote reading directly from
my home-server and K9 on my phone (which is now tied up with Thuderbird
and likely to become more like it). All except K9 show the destination
when hovering over a link, K9 shows it when you press and hold a link.

On 24/10/2022 14:44, Andrew wrote:
> On 23/10/2022 17:59, Martin Brown wrote:
>> On 23/10/2022 16:13, Rod Speed wrote:
>>> On Mon, 24 Oct 2022 01:49:13 +1100, Martin Brown
>>> <'''newspam'''@nonad.co.uk> wrote:
>>>
>>>> I won't touch phone banking apps though. Anything daft enough to
>>>> have my PIN available in plaintext isn't going to have me as a user.
>>>
>>> But the best phone apps use touch ID or facial recognition on the
>>> phone, no PIN involved.
>>
>> AT least in the UK the banking phone app contains the bank card PIN
>> and there has been a spate of recent thefts from gyms where the mobile
>> phone and bank card(s) were stolen and account emptied before the
>> individuals affected even knew they were missing. It hinged on the
>> flash up display of a TFA OTP code sent to the real users mobile phone
>> which could be read momentarily by any Tom, Dick or Harry.
>>
>> Bank then says "Your problem you must have disclosed your PIN".
>> BBC discovered otherwise after a bit of experimentation. BBC R4 5/9/22
>>
>> https://www.bbc.co.uk/programmes/m001brf0
>>
>> The scam is still in play right now.
>>
>> Most UK banks have now adjusted their TFA txt preamble so that the OTP
>> is no longer visible in the preview flash up msg on a locked phone.
>
> Android phones allow you to hide sensitive notifications. You must
> unlock the phone to see them.

Allow you to but the out of the box default is to flash up all incoming
msgs.

--
Regards,
Martin Brown

On 09:25 24 Oct 2022, Brian Gaff said:
>
> Well, the question is, who initiated the discussion. I would never
> give anyone the details if they started it, even if it was from an
> apparently genuine email.

My friend received an SMS with a fake "From" number. The SMS claimed to
be her bank and asked her to ring their number.

When she rang, she was asked to verifty herself by giving the the
"magic number" from her Pinsentry device .. and then they transferred
money from her account.

On 24/10/2022 13:59, Andrew wrote:
> On 24/10/2022 10:46, Martin Brown wrote:
>> On 24/10/2022 07:51, Chris Green wrote:
>>> Andy Burns <usenet@andyburns.uk> wrote:
>>>>
>>>> Chris Green wrote:
>>>>
>>>>> You should never tell anyone the 'magic number' the card reader
>>>>> gives you.
>>>>> The only thing you should ever do with it (as far as I am aware) is
>>>>> to enter
>>>>> it in the right field when logging in to your bank or when confirming
>>>>> payments and such.
>>>>
>>>> The counter staff sometimes ask you to put your PIN into their
>>>> PINsentry to
>>>> verify your ID in branches
>>>
>>> I don't think I have been to my personal banking bank for decades! :-)
>>
>> I have never been inside my bank branch (which for peculiar reasons of
>> takeovers and mergers was not my nearest branch with bank name on it).
>>>
>>> The above wouldn't work for HSBC anyway as their equivalent of
>>> pinsentry is personalised and doesn't require your bank card.
>>
>> HSBC and several others have recently closed their branches. The High
>> Street now quite literally has several "holes in the wall" where bank
>> machines used to reside. Last men standing are Barclays and Santander.
>
> You can't be living that far out in the sticks then if you still
> have 2 physical banks. I have to drive 10 miles to the nearest
> large towns in Sussex to visit a Barclays branch.

That is in the nearest decent sized market town - 10 miles away. I could
choose other smaller sized towns nearby with just 1 bank remaining. In
my village the single main street through it doesn't even *have* a name.

One of the more annoying bank security questions I have been asked is
name a street that connects to the street with your house on. I have now
found a "correct" answer to that Q but it required consulting Victorian
era OS maps. They didn't like A19 as an answer.

--
Regards,
Martin Brown

On 24/10/2022 15:29, Martin Brown wrote:
> On 24/10/2022 14:44, Andrew wrote:

>> Android phones allow you to hide sensitive notifications. You must
>> unlock the phone to see them.
>
> Allow you to but the out of the box default is to flash up all incoming
> msgs.
>

= user error. RTFM.

The moment I noticed that I was getting visible notifications from
Barclays that I had paid £xx.xx from my personal account on my locked
phone, I realised that this was a security issue so I read the Online
help and worked out how to suppress them.

Now I just get a bland message from Barclays saying "unlock to read".

On 24/10/2022 15:39, Pamela wrote:
> On 09:25 24 Oct 2022, Brian Gaff said:
>>
>> Well, the question is, who initiated the discussion. I would never
>> give anyone the details if they started it, even if it was from an
>> apparently genuine email.
>
> My friend received an SMS with a fake "From" number. The SMS claimed to
> be her bank and asked her to ring their number.
>
> When she rang, she was asked to verifty herself by giving the the
> "magic number" from her Pinsentry device
Despite *ALL* the warnings to never disclose any OTP codes to
anyone.

On 24/10/2022 13:46, Andrew wrote:
> On 24/10/2022 08:41, Chris Hogg wrote:
>
>> I hope that's the end of it.
>>
>
> Err, no. Now you should download the Barclays App onto
> your SmartPhone and setup the key words that only a
> Genuine person calling from Barclays would know about.

Not if he doesn't want to use it. No point and means the phone has to be
secured.

--
Max Demian