On 24/10/2022 15:48, Andrew wrote:
> On 24/10/2022 15:29, Martin Brown wrote:
>> On 24/10/2022 14:44, Andrew wrote:
>
>>> Android phones allow you to hide sensitive notifications. You must
>>> unlock the phone to see them.
>>
>> Allow you to but the out of the box default is to flash up all
>> incoming msgs.
>>
>
> = user error. RTFM.

Most people don't though and modern mobile phones do not come with any
physical manual at all (recognising that people never read them).

There might be a quick start guide if you are lucky...
>
> The moment I noticed that I was getting visible notifications from
> Barclays that I had paid £xx.xx from my personal account on my locked
> phone, I realised that this was a security issue so I read the Online
> help and worked out how to suppress them.
>
> Now I just get a bland message from Barclays saying "unlock to read".

I agree but many people have been scammed by theft of mobile and cards
at the same time and the banks have been less than helpful (at least
they were until R4 You & Yours started beating them about the head).

--
Regards,
Martin Brown

On 24/10/2022 14:22, Andrew wrote:

> YES, you do. I am referring to the Barclays App for Android
> or iPhones which has its own software PinSentry and you can
> also create words or phrases which will confirm the identity
> of an unknown caller who claims to be from Barclays.
>
> If the OP had this on his SmartPhone (if he has one) then
> the scammer would have fallen at the first fence.
>
> The physical PinSentry is being deprecated, certainly by
> Barclays. They only like to supply the extra large ones
> to people with poor eyesight, everyone else is steered
> towards the Smartphone App

That's no good if you want to use the website on a laptop.

--
Max Demian

On 24/10/2022 15:39, Pamela wrote:
> On 09:25 24 Oct 2022, Brian Gaff said:
>>
>> Well, the question is, who initiated the discussion. I would never
>> give anyone the details if they started it, even if it was from an
>> apparently genuine email.
>
> My friend received an SMS with a fake "From" number. The SMS claimed to
> be her bank and asked her to ring their number.
>
> When she rang, she was asked to verifty herself by giving the the
> "magic number" from her Pinsentry device .. and then they transferred
> money from her account.

Some time ago the genuine Barclays bank sent me an SMS asking me to ring
the number they put in the text. Naturally I checked that the number was
genuine, so there was no point in them giving it. The person I rang
didn't see that there was a security risk in doing it this way.

--
Max Demian

Pamela wrote:

> My friend fell for exactly that and she's very cautious.
>
> The scammer then signed onto her account and transferred money out of
> it, whilst she was still speaking to him on the phone.
>
> The bit I don't understand is why the scammer chose to transfer several
> thousand pounds to an existing account (which happened to be held by a
> close friend of my scammed friend).

They do that because you need an extra pinSentry step to create a new payee, but
not to send money to an exiting payee.

> Of course the close friend returned the money when everyone ralised
> what had happened. BUT ... how would the scammer have planned to get
> hold of that transferred money?

Maybe the scammers have built a "social graph" of victims and their next move
would be to call/email the friend and ask for the accidental money to be
returned, except to a different account?

Max Demian wrote:

> Andrew wrote:
>
>> The physical PinSentry is being deprecated, certainly by
>> Barclays.
>
> That's no good if you want to use the website on a laptop.

From their PoV, they assume most people have a smartphone.

On Mon, 24 Oct 2022 02:02:30 +0100, John Rumm
<see.my.signature@nowhere.null> wrote:

>
>Pay by bonk.

School report: Caroline is a bright girl. When she leaves school, she
wants to go into bonking.

--
Chris

On 24/10/2022 16:27, Andy Burns wrote:
> Max Demian wrote:
>
>> Andrew wrote:
>>
>>> The physical PinSentry is being deprecated, certainly by
>>> Barclays.
>>
>> That's no good if you want to use the website on a laptop.
>
> From their PoV, they assume most people have a smartphone.
>
One of the reasons I ditched them as far as I could.

--
"Strange as it seems, no amount of learning can cure stupidity, and
higher education positively fortifies it."

- Stephen Vizinczey

On 24/10/2022 16:27, Andy Burns wrote:
> Max Demian wrote:
>
>> Andrew wrote:
>>
>>> The physical PinSentry is being deprecated, certainly by
>>> Barclays.
>>
>> That's no good if you want to use the website on a laptop.
>
> From their PoV, they assume most people have a smartphone.
>

I have both, but I only do online banking on my PC. Just
because I also have the Barclays App on a Smartphone does
not prevent me from doing do. In fact, the App software
PinSentry is a lot clearer than the nasty little hardware
device with its Amstrad PPC640 display (no backlight) :-(
and I don't have to fish out my debit card every time either.

On 24/10/2022 16:00, Martin Brown wrote:
> On 24/10/2022 15:48, Andrew wrote:
>> On 24/10/2022 15:29, Martin Brown wrote:
>>> On 24/10/2022 14:44, Andrew wrote:
>>
>>>> Android phones allow you to hide sensitive notifications. You must
>>>> unlock the phone to see them.
>>>
>>> Allow you to but the out of the box default is to flash up all
>>> incoming msgs.
>>>
>>
>> = user error. RTFM.
>
> Most people don't though and modern mobile phones do not come with any
> physical manual at all (recognising that people never read them).
>
> There might be a quick start guide if you are lucky...

My MotoG31 has quite a good online manual, certainly far more
detailed than a quick start guide.

>>
>> The moment I noticed that I was getting visible notifications from
>> Barclays that I had paid £xx.xx from my personal account on my locked
>> phone, I realised that this was a security issue so I read the Online
>> help and worked out how to suppress them.
>>
>> Now I just get a bland message from Barclays saying "unlock to read".
>
> I agree but many people have been scammed by theft of mobile and cards
> at the same time and the banks have been less than helpful (at least
> they were until R4 You & Yours started beating them about the head).
>

Still user error though. Why on earth should banks be responsible
for careless customers ?.

On 24/10/2022 13:50, Martin Brown wrote:
> On 24/10/2022 10:51, John Rumm wrote:
>> On 24/10/2022 10:29, Theo wrote:
>>>
>>> So we shouldn't be complacent that we won't be taken in, because
>>> eventually
>>> we will.  The thing to think about is what defences we might use to
>>> prevent
>>> the hook turning into actual damage.
>
> I am fairly sure that it is only a matter of time before I get caught
> out by a parcel non-delivery scam at least to the point of clicking on
> it. Likely to happen when I am in a hurry, expecting a parcel from that
> courier and see the non delivery message appear at about the right time.
>
> Sometimes it does happen although the regular guys know where to put
> stuff if I'm not in (increasingly rare in the Covid and post-Covid era).
>
>> Indeed, one of the things I try to get across when training people on
>> this stuff, is that the moment you think "I am too smart to get caught
>> out like this" you are more rather than less vulnerable. It only takes
>> the right circumstances to come together, and you can get fooled. As
>> you say it is the defence in depth that then matters.
>
> All cold calls are presumed hostile is a very workable heuristic.
> I don't know why it isn't more widely advertised as a fix.
>
> I guess if everybody did it then the cold calling sales model would
> break down and with it the income of telcos and cold calling centres.

Or more likely they would adapt, and find new ways to counter that
approach.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 15:26, Pamela wrote:
> On 14:32 23 Oct 2022, Martin Brown said:
>> On 23/10/2022 13:49, Chris Hogg wrote:
>>>
>>>
>>> I got scammed at the end of last week. All sorted and no harm done,
>>> but the scammer told me that the normal security checks such as
>>> mother's maiden name etc was no longer being used, and everything
>>> was being done via the Pinsentry system. After resistance from me I
>>> eventually went along with it and gave him all he asked for! :-(
>>
>> So you mean he tricked you into entering your card number and doing
>> the ID me by PIN and passing him that information (possibly allowing
>> access to your bank account). I suggest you contact R4 You & Yours
>> they will love this as a story of the latest scam - I can see lots of
>> people falling for it if the spiel on the other end of the line is
>> done well.
>
> My friend fell for exactly that and she's very cautious.
>
> The scammer then signed onto her account and transferred money out of
> it, whilst she was still speaking to him on the phone.
>
> The bit I don't understand is why the scammer chose to transfer several
> thousand pounds to an existing account (which happened to be held by a
> close friend of my scammed friend).

Because setting up a payment to a new destination needs additional
pinsentry authorised steps - steps that would require not just using the
card and pin, but also the user inputting the value of the transaction.
So it would be *much* harder to social engineer the owner of the account
to carry out those steps.

> Of course the close friend returned the money when everyone ralised
> what had happened. BUT ... how would the scammer have planned to get
> hold of that transferred money?
>
> Any ideas?

A social engineering attack on the friend could be one option: e.g.

Text to them:

"Hi xxxx, I need your help urgently, as I have messed up. I just found
out from my bank that I need to pay off an unauthorised overdraft RIGHT
NOW, or they are going to charge me hundreds in fees and interest. So I
went to make a payment online to the bank, but in my panic I clicked the
wrong thing and transferred the money to you instead! Can you do me a
BIG favour and make the payment into my account for me? The account
details are Name, SC, acct# etc."

The account details provided will be one the scammer has opened in the
name of the victim at another bank.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 15:39, Pamela wrote:
> On 09:25 24 Oct 2022, Brian Gaff said:
>>
>> Well, the question is, who initiated the discussion. I would never
>> give anyone the details if they started it, even if it was from an
>> apparently genuine email.
>
> My friend received an SMS with a fake "From" number. The SMS claimed to
> be her bank and asked her to ring their number.
>
> When she rang, she was asked to verifty herself by giving the the
> "magic number" from her Pinsentry device .. and then they transferred
> money from her account.

I expect there is more to that storey that conveyed here...
They might be able to login to the account, but that alone would not
allow new payments to be setup.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On Mon, 24 Oct 2022 20:51:01 +1100, The Natural Philosopher
<tnp@invalid.invalid> wrote:

> On 23/10/2022 22:54, Bob Eager wrote:
>> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>>
>>> Out of interest, what online banking can you do with a phone app that
>>> you can't do with a computer at home? More to the point, why would you
>>> need to do it then rather than wait until you got home?
>> Pay in a cheque.
>>
> cant do that with a phone either. You have to physically get it to a
> bank.

Nope, banks have been doing that for years now.

On Mon, 24 Oct 2022 20:55:23 +1100, Tim Streater
<timstreater@greenbee.net> wrote:

> On 24 Oct 2022 at 10:17:43 BST, John Rumm <see.my.signature@nowhere.null>
> wrote:
>
>> On 24/10/2022 07:55, Chris Green wrote:
>>> John Rumm <see.my.signature@nowhere.null> wrote:
>>>> On 23/10/2022 16:39, Chris Green wrote:
>>>>> Chris Hogg <me@privacy.net> wrote:
>>>>>> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
>>>>>> <'''newspam'''@nonad.co.uk> wrote:
>>>>>>
>>>>>>> and doing the
>>>>>>> ID me by PIN and passing him that information
>>>>>>
>>>>>> No, I didn't give him my pin, at least not directly, unless he is
>>>>>> able
>>>>>> to deduce it from my pinsentry response. Could that happen, and if
>>>>>> so,
>>>>>> what's the point of pinsentry? Not a sentry at all.
>>>>>>
>>>>> I don't really understand this. You should never tell anyone the
>>>>> 'magic number' the card reader gives you. The only thing you should
>>>>> ever do with it (as far as I am aware) is to enter it in the right
>>>>> field when logging in to your bank or when confirming payments and
>>>>> such.
>>>>
>>>> Barclays also use it in branch - say when making a cash withdrawal
>>>> over the counter.
>>>>
>>> You mean your card in the reader and enter your PIN? I think I'd
>>> run a mile!
>>
>> No, they have their own card readers. They enter the transaction details
>> into it and hand it to you to enter your pin. When you do that it
>> generates a OTP that the staff can use to finish the transaction.
>>
>> So the bank staff don't learn your pin, and you are giving away no more
>> information than would be required to get the money from a cash machine.
>
> ISTM that a pinSentry device or similar is reasonably secure as it is not
> communicating over any network, just reading your card and interacting
> with
> you. And it comes with any software already built-in.
>
> An app on a phone, would be a lot less secure as it could be buggy, and
> you
> could anyway have been fooled into downloading a fake version. The
> supposed
> extra benefits of using an app don't appear to amount to a hill of beans.

Fraid so, most obviously because it can use touch ID or facial recognition.

On 24/10/2022 14:04, Andrew wrote:
> On 24/10/2022 08:56, Andy Burns wrote:
>> Chris Green wrote:
>>
>>> John Rumm wrote:
>>>
>>>> Barclays also use it in branch - say when making  a cash withdrawal
>>>> over the counter.
>>
>> For paying in batches of cheques I take them to the counter (the app
>> only allows a small number per week and a low value per cheque) the
>> auto cheque scanners in branch are comically inaccurate.
>>
>>> You mean your card in the reader and enter your PIN?  I think I'd
>>> run a mile!
>>
>> Paying-in slips no longer seem to exist (nor pens on dangly chains)
>> after you explain why you refuse to use the cheque scanners, they
>> harrumph and ask you for your debit card hand it back within their
>> pinsentry for you to enter pin, then swipe the cheques through the
>> MICR slot on their keyboard.
>>
>
> On the rare occasion that I have to pay a cheque into my account,
> they just swipe my debit card on their keyboard and auto-scan
> the cheque. Never been asked for my pin number and the receipt
> is just stapled into the paying in book.

You still have a paying in book. How very quaint!

--
Regards,
Martin Brown

On 24/10/2022 13:56, Andrew wrote:
> On 24/10/2022 11:38, The Natural Philosopher wrote:
>> On 24/10/2022 11:04, Chris Hogg wrote:
>>> On Mon, 24 Oct 2022 10:55:20 +0100, The Natural Philosopher
>>> <tnp@invalid.invalid> wrote:
>>>
>>>> On 24/10/2022 08:41, Chris Hogg wrote:
>>>>> I made sure that
>>>>> Barclays had also blocked any on-line banking and telephone banking -
>>>>> I don't use them, have never used them and don't need them
>>>> then why do you have a pin sentry?
>>>
>>> Because two years ago I got the impression it would be essential, so I
>>> went into the bank and asked for one. Was given it, no questions
>>> asked,
>>>
>> Blimey.
>>
>
> They are not tied to any account. You can even use another banks
> pinsenty device with a Barclay debit card and vice-versa

Actually no you can't at least not across some pairs of banks. I have
two have separate ones for my own account and the village halls.

If I put a card into the wrong one it says "wrong card". I suspect any
card from the same banking group would be OK but I have never really
experimented with which ones work and which do not.

> This is why Barclays are trying to cajole people into using
> the PinSentry that is part of their SmartPhone App (as opposed
> to using a PC to login to Barclays online banking).
>
> The former allows you to set up extra secret words to confirm
> the identity of a genuine call from the bank.

--
Regards,
Martin Brown

On 24/10/2022 17:50, Andrew wrote:
> On 24/10/2022 16:00, Martin Brown wrote:
>> On 24/10/2022 15:48, Andrew wrote:
>>> On 24/10/2022 15:29, Martin Brown wrote:
>>>> On 24/10/2022 14:44, Andrew wrote:
>>>
>>>>> Android phones allow you to hide sensitive notifications. You must
>>>>> unlock the phone to see them.
>>>>
>>>> Allow you to but the out of the box default is to flash up all
>>>> incoming msgs.
>>>>
>>>
>>> = user error. RTFM.
>>
>> Most people don't though and modern mobile phones do not come with any
>> physical manual at all (recognising that people never read them).
>>
>> There might be a quick start guide if you are lucky...
>
> My MotoG31 has quite a good online manual, certainly far more
> detailed than a quick start guide.

I meant as physical paper included with the device.

>>> The moment I noticed that I was getting visible notifications from
>>> Barclays that I had paid £xx.xx from my personal account on my locked
>>> phone, I realised that this was a security issue so I read the Online
>>> help and worked out how to suppress them.
>>>
>>> Now I just get a bland message from Barclays saying "unlock to read".
>>
>> I agree but many people have been scammed by theft of mobile and cards
>> at the same time and the banks have been less than helpful (at least
>> they were until R4 You & Yours started beating them about the head).
>>
>
> Still user error though. Why on earth should banks be responsible
> for careless customers ?.

The manufacturers should be sending them out in a more secure state by
default. Most of their customers are not tech savvy and many are tech
Luddites and will probably never even visit "settings" in the lifetime
of their phone. They might get someone else to fix things for them.

--
Regards,
Martin Brown

On 24/10/2022 18:59, John Rumm wrote:
> On 24/10/2022 15:39, Pamela wrote:
>> On 09:25  24 Oct 2022, Brian Gaff said:
>>>
>>> Well, the question is, who initiated the discussion. I would never
>>> give anyone the details if they started it, even if it was from an
>>> apparently genuine email.
>>
>> My friend received an SMS with a fake "From" number. The SMS claimed to
>> be her bank and asked her to ring their number.

They always do :( CLID can be far too easily faked.

>> When she rang, she was asked to verifty herself by giving the the
>> "magic number" from her Pinsentry device .. and then they transferred
>> money from her account.
>
> I expect there is more to that storey that conveyed here...
> They might be able to login to the account, but that alone would not
> allow new payments to be setup.

I suspect the next step of the fraud is the panic txtmsg to the friend
who received the spurious payment saying words to the effect of:

"I intended to pay this big bill with <dodgy scammer> and if I don't
make the payment today I'll be stung with a big interest hit - please
can you transfer that entire amount to <dodgy scammers account> ASAP".

It will inevitably push for "do it now" which is one of the other
hallmarks of a scam. Always stop and think before taking any hasty
action no matter how insistent the guy on the phone may be.

How plausible is the writing style to be your friends? Can you contact
them directly by mobile (even if they tell you they've lost their mobile
this is worth a try since the scammer might have it but will not sound
like them).

Unfortunately the banks online warnings don't wake people from their
reverie as the social engineering scripts are so well crafted now :(

--
Regards,
Martin Brown

On Mon, 24 Oct 2022 21:44:23 +1100, The Natural Philosopher
<tnp@invalid.invalid> wrote:

> On 24/10/2022 11:17, charles wrote:
>> In article <tj5n65$1kueu$11@dont-email.me>,
>> The Natural Philosopher <tnp@invalid.invalid> wrote:
>>> On 23/10/2022 22:54, Bob Eager wrote:
>>>> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>>>>
>>>>> Out of interest, what online banking can you do with a phone app that
>>>>> you can't do with a computer at home? More to the point, why would
>>>>> you
>>>>> need to do it then rather than wait until you got home?
>>>>
>>>> Pay in a cheque.
>>>>
>>>>
>>>>
>>> cant do that with a phone either. You have to physically get it to a
>>> bank.
>> My bank will allow me to send a photo of a cheque in conjunction with a
>> phone app.
>>
> And not require the actual cheque?

Correct.

> That is asking for forgery.

No, because a forgery will never clear.

On Mon, 24 Oct 2022 21:42:38 +1100, The Natural Philosopher
<tnp@invalid.invalid> wrote:

> On 24/10/2022 10:55, Tim Streater wrote:
>> ISTM that a pinSentry device or similar is reasonably secure as it is
>> not
>> communicating over any network, just reading your card and interacting
>> with
>> you. And it comes with any software already built-in.
>> An app on a phone, would be a lot less secure as it could be buggy,
>> and you
>> could anyway have been fooled into downloading a fake version. The
>> supposed
>> extra benefits of using an app don't appear to amount to a hill of
>> beans.
>
> Yes. I can see that for millennials who do everything on a StupidPhone
> including paying for their worthless purchases in shops designed to gull
> them from their unearned cash, they have some advantages.

And for non dinosaurs too.

> But for security, the best place to do banking is at home, on a desktop
> machine.

That's wrong too. The smartphone can use touch ID or facial recognition
to check who is using it for the banking transaction. The desktop machine
can't.

> Otherwise a credit or debit card will allow you to pay in cheques,

Paying them in by taking a photo with your smartphone is far more
convenient.

> pay for goods in a shop,

Far more secure to use apple pay or google pay on your smartphone.

> withdraw cash

Far more secure to use apple pay or google pay on your smartphone.

> and all the other stuff you cant actually do from home.

Far better done with a smartphone.

On Mon, 24 Oct 2022 21:40:07 +1100, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

> On 24/10/2022 11:29, Jeff Layman wrote:
>> On 24/10/2022 10:41, The Natural Philosopher wrote:
>>> On 23/10/2022 19:20, Andy Burns wrote:
>>>> The Natural Philosopher wrote:
>>>>
>>>>> I dont use a phone app.
>>>>> I use a PIN sentry
>>>>> It wants my membership number, my credit card number and a pin sentry
>>>>> generated code
>>>>
>>>> the phone app incorporates the functionality of a PINsentry, without
>>>> having to carry around a bit of blue plastic.
>>>
>>> But it isn't a PIN sentry. It's an app. Insecure as ***k
>> I doubt it's insecure if coded well, but it *isn't* private.
>> Everything done with it on an Android phone will be viewable by Google.
>
> Some bank apps contain your bank card PIN in the clear - which I do not
> consider a safe or sensible practice. That's why I won't have one.

Makes more sense to not use a bank that is that stupid and use a better
bank
and get the convenience of being able to do almost anything anywhere.

On 24/10/2022 15:42, Martin Brown wrote:
> On 24/10/2022 13:59, Andrew wrote:
>> On 24/10/2022 10:46, Martin Brown wrote:
>>> On 24/10/2022 07:51, Chris Green wrote:
>>>> Andy Burns <usenet@andyburns.uk> wrote:
>>>>>
>>>>> Chris Green wrote:
>>>>>
>>>>>> You should never tell anyone the 'magic number' the card reader
>>>>>> gives you.
>>>>>> The only thing you should ever do with it (as far as I am aware)
>>>>>> is to enter
>>>>>> it in the right field when logging in to your bank or when confirming
>>>>>> payments and such.
>>>>>
>>>>> The counter staff sometimes ask you to put your PIN into their
>>>>> PINsentry to
>>>>> verify your ID in branches
>>>>
>>>> I don't think I have been to my personal banking bank for decades! :-)
>>>
>>> I have never been inside my bank branch (which for peculiar reasons
>>> of takeovers and mergers was not my nearest branch with bank name on
>>> it).
>>>>
>>>> The above wouldn't work for HSBC anyway as their equivalent of
>>>> pinsentry is personalised and doesn't require your bank card.
>>>
>>> HSBC and several others have recently closed their branches. The High
>>> Street now quite literally has several "holes in the wall" where bank
>>> machines used to reside. Last men standing are Barclays and Santander.
>>
>> You can't be living that far out in the sticks then if you still
>> have 2 physical banks. I have to drive 10 miles to the nearest
>> large towns in Sussex to visit a Barclays branch.
>
> That is in the nearest decent sized market town - 10 miles away. I could
> choose other smaller sized towns nearby with just 1 bank remaining. In
> my village the single main street through it doesn't even *have* a name.
>
> One of the more annoying bank security questions I have been asked is
> name a street that connects to the street with your house on. I have now
> found a "correct" answer to that Q but it required consulting Victorian
> era OS maps. They didn't like A19 as an answer.

When I first tried set up internet banking on our joint account, I had
to prove my ID over the phone, by answering some questions about recent
purchases. However, it was with Lloyds-TSB and as the account (under my
wife's name only) had formerly been with the TSB and not with Lloyds,
they could not separate out her payments from mine, so they kept asking
things like "You recently made a purchase at Tesco. Approximately how
much was it for?" which I could not answer as my wife had made most of
the purchases and she was at work, so I couldn't ask her!

On 24/10/2022 20:07, Martin Brown wrote:
> On 24/10/2022 14:04, Andrew wrote:
>> On 24/10/2022 08:56, Andy Burns wrote:
>>> Chris Green wrote:
>>>
>>>> John Rumm wrote:
>>>>
>>>>> Barclays also use it in branch - say when making  a cash withdrawal
>>>>> over the counter.
>>>
>>> For paying in batches of cheques I take them to the counter (the app
>>> only allows a small number per week and a low value per cheque) the
>>> auto cheque scanners in branch are comically inaccurate.
>>>
>>>> You mean your card in the reader and enter your PIN?  I think I'd
>>>> run a mile!
>>>
>>> Paying-in slips no longer seem to exist (nor pens on dangly chains)
>>> after you explain why you refuse to use the cheque scanners, they
>>> harrumph and ask you for your debit card hand it back within their
>>> pinsentry for you to enter pin, then swipe the cheques through the
>>> MICR slot on their keyboard.
>>>
>>
>> On the rare occasion that I have to pay a cheque into my account,
>> they just swipe my debit card on their keyboard and auto-scan
>> the cheque. Never been asked for my pin number and the receipt
>> is just stapled into the paying in book.
>
> You still have a paying in book. How very quaint!

When I have done it, they have asked me to put my card in their card
reader and type my PIN in, as if I was making a purchase, they can then
scan a cheque, pay in cash or take out cash, without any paperwork or
signatures.

On Mon, 24 Oct 2022 23:50:12 +1100, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

> On 24/10/2022 10:51, John Rumm wrote:
>> On 24/10/2022 10:29, Theo wrote:
>>>
>>> So we shouldn't be complacent that we won't be taken in, because
>>> eventually
>>> we will. The thing to think about is what defences we might use to
>>> prevent
>>> the hook turning into actual damage.
>
> I am fairly sure that it is only a matter of time before I get caught
> out by a parcel non-delivery scam at least to the point of clicking on
> it. Likely to happen when I am in a hurry, expecting a parcel from that
> courier and see the non delivery message appear at about the right time.
>
> Sometimes it does happen although the regular guys know where to put
> stuff if I'm not in (increasingly rare in the Covid and post-Covid era).
>
>> Indeed, one of the things I try to get across when training people on
>> this stuff, is that the moment you think "I am too smart to get caught
>> out like this" you are more rather than less vulnerable. It only takes
>> the right circumstances to come together, and you can get fooled. As
>> you say it is the defence in depth that then matters.
>
> All cold calls are presumed hostile is a very workable heuristic.
> I don't know why it isn't more widely advertised as a fix.

> I guess if everybody did it

That's never going to happen.

> then the cold calling sales model would break down and with it the
> income of telcos and cold calling centres.

And neither is that.

On Mon, 24 Oct 2022 23:50:34 +1100, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

> On 24/10/2022 11:33, Andy Burns wrote:
>> Martin Brown wrote:
>>
>>> Some banks now allow you to pay cheques in by photographing the
>>> original from their app. The same functionality is not present in web
>>> banking.
>> Handy for the occasional refund cheque, but not especially useful due
>> to limited numbers and values of cheques that can be paid in by phone.
>
> I get paid by cheque about twice a year so it is entirely academic now.
> There are still a few Luddites who still insist on using them.

> I use about the same number of cheques per year too.

I haven't paid by cheque for decades now.

I did keep a single cheque in my wallet for years and
when I needed to buy new pads for my swanp cooler
the dinosaur seller would only take cash or a cheque.
The cheque was rather battered by then and the seller
was rather dubious about taking it, but it worked fine.

Can't do that anymore, dont have any accounts with a cheque book anymore.

> To pay Luddites that are afraid to give me their bank details and be
> paid online.

We have a system where you can be paid to any mobile number
or email address so that should keep those luddites happy.