Martin Brown wrote:

>> You can even use another banks
>> pinsenty device with a Barclay debit card and vice-versa
>
> Actually no you can't at least not across some pairs of banks. I have two have
> separate ones for my own account and the village halls.
>
> If I put a card into the wrong one it says "wrong card". I suspect any card from
> the same banking group would be OK but I have never really experimented with
> which ones work and which do not.

You can certainly use barclays and natwest pinsentry and cards interchangeably.

On Tue, 25 Oct 2022 01:26:50 +1100, Pamela
<pamela.private.mailbox@gmail.com> wrote:

> On 14:32 23 Oct 2022, Martin Brown said:
>> On 23/10/2022 13:49, Chris Hogg wrote:
>>>
>>>
>>> I got scammed at the end of last week. All sorted and no harm done,
>>> but the scammer told me that the normal security checks such as
>>> mother's maiden name etc was no longer being used, and everything
>>> was being done via the Pinsentry system. After resistance from me I
>>> eventually went along with it and gave him all he asked for! :-(
>>
>> So you mean he tricked you into entering your card number and doing
>> the ID me by PIN and passing him that information (possibly allowing
>> access to your bank account). I suggest you contact R4 You & Yours
>> they will love this as a story of the latest scam - I can see lots of
>> people falling for it if the spiel on the other end of the line is
>> done well.
>
> My friend fell for exactly that and she's very cautious.
>
> The scammer then signed onto her account and transferred money out of
> it, whilst she was still speaking to him on the phone.
>
> The bit I don't understand is why the scammer chose to transfer several
> thousand pounds to an existing account (which happened to be held by a
> close friend of my scammed friend).
>
> Of course the close friend returned the money when everyone ralised
> what had happened. BUT ... how would the scammer have planned to get
> hold of that transferred money?
>
> Any ideas?

By telling the friend that they had sent them the money by mistake
when entering the bank account number and getting them to send
the money 'back' but in reality to the spammer's account.

On Mon, 24 Oct 2022 11:17:07 +0100, Martin Brown wrote:

> On 24/10/2022 10:51, The Natural Philosopher wrote:
>> On 23/10/2022 22:54, Bob Eager wrote:
>>> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>>>
>>>> Out of interest, what online banking can you do with a phone app that
>>>> you can't do with a computer at home? More to the point, why would
>>>> you need to do it then rather than wait until you got home?
>>>
>>> Pay in a cheque.
>>>
>> cant do that with a phone either. You have to physically get it to a
>> bank.
>
> Some banks now allow you to pay cheques in by photographing the original
> from their app. The same functionality is not present in web banking.

Why am I not surprised that TNP is ignorant of this?

--
My posts are my copyright and if @diy_forums or Home Owners' Hub
wish to copy them they can pay me £1 a message.
Use the BIG mirror service in the UK: http://www.mirrorservice.org
*lightning surge protection* - a w_tom conductor

Martin Brown <'''newspam'''@nonad.co.uk> wrote:
> All cold calls are presumed hostile is a very workable heuristic.
> I don't know why it isn't more widely advertised as a fix.
>
> I guess if everybody did it then the cold calling sales model would
> break down and with it the income of telcos and cold calling centres.

I like to think that Facebook ads are the modern equivalent of cold calling.
The desirability and quality of the product and level of trustworthiness of
the purveyor seem to be vaguely aligned with that of the cold callers.

Of course Facebook ads are better targeted, which is why they get a better
return on investment than autodialling.

Theo

On 24/10/2022 21:29, Andy Burns wrote:
> Martin Brown wrote:
>
>>> You can even use another banks
>>> pinsenty device with a Barclay debit card and vice-versa
>>
>> Actually no you can't at least not across some pairs of banks. I have
>> two have separate ones for my own account and the village halls.
>>
>> If I put a card into the wrong one it says "wrong card". I suspect any
>> card from the same banking group would be OK but I have never really
>> experimented with which ones work and which do not.
>
> You can certainly use barclays and natwest pinsentry and cards
> interchangeably.

Many are rebadged Gemalto devices:

https://www.thalesgroup.com/en/markets/digital-identity-and-security/banking-payment/digital-banking/authentication-server

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 20:59, SteveW wrote:
> On 24/10/2022 15:42, Martin Brown wrote:
>> On 24/10/2022 13:59, Andrew wrote:
>>> On 24/10/2022 10:46, Martin Brown wrote:
>>>> On 24/10/2022 07:51, Chris Green wrote:
>>>>> Andy Burns <usenet@andyburns.uk> wrote:
>>>>>>
>>>>>> Chris Green wrote:
>>>>>>
>>>>>>> You should never tell anyone the 'magic number' the card reader
>>>>>>> gives you.
>>>>>>> The only thing you should ever do with it (as far as I am aware)
>>>>>>> is to enter
>>>>>>> it in the right field when logging in to your bank or when
>>>>>>> confirming
>>>>>>> payments and such.
>>>>>>
>>>>>> The counter staff sometimes ask you to put your PIN into their
>>>>>> PINsentry to
>>>>>> verify your ID in branches
>>>>>
>>>>> I don't think I have been to my personal banking bank for decades! :-)
>>>>
>>>> I have never been inside my bank branch (which for peculiar reasons
>>>> of takeovers and mergers was not my nearest branch with bank name on
>>>> it).
>>>>>
>>>>> The above wouldn't work for HSBC anyway as their equivalent of
>>>>> pinsentry is personalised and doesn't require your bank card.
>>>>
>>>> HSBC and several others have recently closed their branches. The
>>>> High Street now quite literally has several "holes in the wall"
>>>> where bank machines used to reside. Last men standing are Barclays
>>>> and Santander.
>>>
>>> You can't be living that far out in the sticks then if you still
>>> have 2 physical banks. I have to drive 10 miles to the nearest
>>> large towns in Sussex to visit a Barclays branch.
>>
>> That is in the nearest decent sized market town - 10 miles away. I
>> could choose other smaller sized towns nearby with just 1 bank
>> remaining. In my village the single main street through it doesn't
>> even *have* a name.
>>
>> One of the more annoying bank security questions I have been asked is
>> name a street that connects to the street with your house on. I have
>> now found a "correct" answer to that Q but it required consulting
>> Victorian era OS maps. They didn't like A19 as an answer.
>
> When I first tried set up internet banking on our joint account, I had
> to prove my ID over the phone, by answering some questions about recent
> purchases. However, it was with Lloyds-TSB and as the account (under my
> wife's name only) had formerly been with the TSB and not with Lloyds,
> they could not separate out her payments from mine, so they kept asking
> things like "You recently made a purchase at Tesco. Approximately how
> much was it for?" which I could not answer as my wife had made most of
> the purchases and she was at work, so I couldn't ask her!

The worst ever security question we were ever asked (for the final
pre-install payment on a fitted kitchen at the card holders address) was:

Q: "What hotel did you stay at in Chester last November?"
A: "None - we haven't been to Chester for more than a decade"

They didn't like that answer so we spent best part of 2 hours with the
poor sales guy on the phone to them asking us more and more detailed
security questions about the account. Eventually we won!

Afterwards we went back the the November statement (~6 months old) and
found the official "Correct" answer - which was the works Xmas do at
"Lumley Castle, Chester [le Street, County Durham]"

Unfortunate field length truncation there. Nowhere near Cheshire.

The second worst security question was what rented house number did you
live at for just 6 months over 2 decades ago in location?
Experian asked me that after they had leaked my personal data to hackers :(

Of course I didn't know the number...

--
Regards,
Martin Brown

On 24/10/2022 22:41, John Rumm wrote:
> On 24/10/2022 21:29, Andy Burns wrote:
>> Martin Brown wrote:
>>
>>>> You can even use another banks
>>>> pinsenty device with a Barclay debit card and vice-versa
>>>
>>> Actually no you can't at least not across some pairs of banks. I have
>>> two have separate ones for my own account and the village halls.
>>>
>>> If I put a card into the wrong one it says "wrong card". I suspect
>>> any card from the same banking group would be OK but I have never
>>> really experimented with which ones work and which do not.
>>
>> You can certainly use barclays and natwest pinsentry and cards
>> interchangeably.
>
> Many are rebadged Gemalto devices:
>
> https://www.thalesgroup.com/en/markets/digital-identity-and-security/banking-payment/digital-banking/authentication-server

One pair I know for sure don't like each other is Nationwide pin sentry
unit and Santander bank cards. I will try a few others in a round robin
next time I have access to a few different devices.

--
Regards,
Martin Brown

On 24/10/2022 21:28, Rod Speed wrote:
> On Mon, 24 Oct 2022 23:50:34 +1100, Martin Brown
> <'''newspam'''@nonad.co.uk> wrote:
>
>> To pay Luddites that are afraid to give me their bank details and be
>> paid online.
>
> We have a system where you can be paid to any mobile number
> or email address so that should keep those luddites happy.

Techno Luddites don't have smart phones or internet at home so I doubt
that they would be at all happy with either of those "solutions". They
are the sort of people who still have Building Society passbooks that
have to be updated in branch by antediluvian machines that are forever
breaking down and have savings accounts that pay <0.1% interest rates.

There are a couple like that in my village.

--
Regards,
Martin Brown

Martin Brown wrote:

> One pair I know for sure don't like each other is Nationwide pin sentry unit and
> Santander bank cards.

I've never had (or been offered) a pinsentry for my santander debit card, maybe
their cards don't support it? They just seem to send SMS for everything.

Martin Brown <'''newspam'''@nonad.co.uk> wrote
> Rod Speed wrote
>> Martin Brown <'''newspam'''@nonad.co.uk> wrote

>>> To pay Luddites that are afraid to give me their bank details and be
>>> paid online.

>> We have a system where you can be paid to any mobile number
>> or email address so that should keep those luddites happy.

> Techno Luddites don't have smart phones

It doesnt need to be a smartphone, just a bank account and mobile number.

> or internet at home

Don't need that either. Its just an assignment of a mobile number
or email address to a bank account for receiving money transfers
by someone else. And its instant so they know if they have got the
money if they have some way of checking their balance or have
the bank account notify them of transactions.

> so I doubt that they would be at all happy with either of those
> "solutions".

But they don't get any choice if you tell them that you can't write
cheques anymore.

> They are the sort of people who still have Building Society passbooks
> that have to be updated in branch by antediluvian machines that are
> forever breaking down and have savings accounts that pay <0.1% interest
> rates.

> There are a couple like that in my village.

They can still have their mobile number or email address as a recipient of
cash.

On 24/10/2022 21:55, Bob Eager wrote:
> On Mon, 24 Oct 2022 11:17:07 +0100, Martin Brown wrote:
>
>> On 24/10/2022 10:51, The Natural Philosopher wrote:
>>> On 23/10/2022 22:54, Bob Eager wrote:
>>>> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>>>>
>>>>> Out of interest, what online banking can you do with a phone app that
>>>>> you can't do with a computer at home? More to the point, why would
>>>>> you need to do it then rather than wait until you got home?
>>>>
>>>> Pay in a cheque.
>>>>
>>> cant do that with a phone either. You have to physically get it to a
>>> bank.
>>
>> Some banks now allow you to pay cheques in by photographing the original
>> from their app. The same functionality is not present in web banking.
>
> Why am I not surprised that TNP is ignorant of this?
>
>
>
Because I haven't received a cheque in over 2 years? And when I did I
used to send them to my bank or pay them in at the local post office.
The last one went stray under lockdown, so I took it my bank. I am not
generally aware of what side a Tena pant fastens either, having no need
of such. Yet.

--
Gun Control: The law that ensures that only criminals have guns.

On 24/10/2022 11:57, The Natural Philosopher wrote:
> Every time I give an email to a new online entity "your details will be
> held securely and not shared with third parties" I get up to 50 spam
> emails selling me everything from sex to a an invitation to collect my
> lottery winnings.

Maybe they think you are 'special'. I don't get them.

> I have other passwords in a password manager, the pass key  to which is
> again engraved in my brain and is utterly unguessable.

Likewise.

>
> I have never been hacked, not suffered any banking fraud scam being
> successful.

Nor have I, but there have been concerted but failed attempts logged.

> I run 100% linux at all times.

I have always run Windows.

On 25/10/2022 09:20, Andy Burns wrote:
> Martin Brown wrote:
>
>> One pair I know for sure don't like each other is Nationwide pin
>> sentry unit and Santander bank cards.
>
> I've never had (or been offered) a pinsentry for my santander debit
> card, maybe their cards don't support it?  They just seem to send SMS
> for everything.

They don't, but I wanted to check the PIN on a Santander bank card
without taking it off to a bank machine. However, it wouldn't play.

I had expected that all PIN sentry machines for chip & PIN could read
all bank cards but that seems not to be the case. I haven't experimented
to see what combinations will work. Just observed this specific failure.

--
Regards,
Martin Brown

Martin Brown <'''newspam'''@nonad.co.uk> wrote:
> On 25/10/2022 09:20, Andy Burns wrote:
> > Martin Brown wrote:
> >
> >> One pair I know for sure don't like each other is Nationwide pin
> >> sentry unit and Santander bank cards.
> >
> > I've never had (or been offered) a pinsentry for my santander debit
> > card, maybe their cards don't support it?  They just seem to send SMS
> > for everything.
>
> They don't, but I wanted to check the PIN on a Santander bank card
> without taking it off to a bank machine. However, it wouldn't play.
>
> I had expected that all PIN sentry machines for chip & PIN could read
> all bank cards but that seems not to be the case. I haven't experimented
> to see what combinations will work. Just observed this specific failure.

That's because Santander don't use card readers, so their cards don't have
the EMV CAP 'app' loaded onto them. When the card reader tries to select
the 'app', the request is refused. This is why it says 'wrong card'.

In particular, by not doing so it prevents unnecessary PIN-extortion attacks
(hit somebody with a $5 wrench* until they reveal the correct PIN, which is
easier to do behind closed doors with a card reader than when standing at an
ATM)

Theo

* https://xkcd.com/538/

On 25/10/2022 11:36, Harry Bloomfield Esq wrote:
> On 24/10/2022 11:57, The Natural Philosopher wrote:
>> Every time I give an email to a new online entity "your details will
>> be held securely and not shared with third parties" I get up to 50
>> spam emails selling me everything from sex to a an invitation to
>> collect my lottery winnings.
>
> Maybe they think you are 'special'. I don't get them.
>
>> I have other passwords in a password manager, the pass key  to which
>> is again engraved in my brain and is utterly unguessable.
>
> Likewise.
>
>>
>> I have never been hacked, not suffered any banking fraud scam being
>> successful.
>
> Nor have I, but there have been concerted but failed attempts logged.
>
>> I run 100% linux at all times.
>
> I have always run Windows.
>
Well thats a good indicator that is more how you behave than what
technology you use that counts. I did catch a couple of viruses on
Windows 98, which was the last real windows I used in anger outside of a VM
--
It’s easier to fool people than to convince them that they have been fooled.
Mark Twain

On 24 Oct 2022 at 22:41:25 BST, John Rumm <see.my.signature@nowhere.null>
wrote:

> On 24/10/2022 21:29, Andy Burns wrote:
>> Martin Brown wrote:
>>
>>>> You can even use another banks
>>>> pinsenty device with a Barclay debit card and vice-versa
>>>
>>> Actually no you can't at least not across some pairs of banks. I have
>>> two have separate ones for my own account and the village halls.
>>>
>>> If I put a card into the wrong one it says "wrong card". I suspect any
>>> card from the same banking group would be OK but I have never really
>>> experimented with which ones work and which do not.
>>
>> You can certainly use barclays and natwest pinsentry and cards
>> interchangeably.
>
> Many are rebadged Gemalto devices:
>
> https://www.thalesgroup.com/en/markets/digital-identity-and-security/banking-payment/digital-banking/authentication-server

See also here:

https://en.wikipedia.org/wiki/Chip_Authentication_Program

a picture of the Barclays device, inter alia.

--
There is nothing a fleet of dispatchable nuclear power plants cannot do that cannot be done worse and more expensively and with higher carbon emissions and more adverse environmental impact by adding intermittent renewable energy.

On 24/10/2022 21:01, SteveW wrote:
> On 24/10/2022 20:07, Martin Brown wrote:
>> On 24/10/2022 14:04, Andrew wrote:
>>>
>>> On the rare occasion that I have to pay a cheque into my account,
>>> they just swipe my debit card on their keyboard and auto-scan
>>> the cheque. Never been asked for my pin number and the receipt
>>> is just stapled into the paying in book.
>>
>> You still have a paying in book. How very quaint!
>
> When I have done it, they have asked me to put my card in their card
> reader and type my PIN in, as if I was making a purchase, they can then
> scan a cheque, pay in cash or take out cash, without any paperwork or
> signatures.

Likewise with my bank you use a chip & PIN to ID at the counter and that
allows them to do it paperless or you can have a receipt as well and/or
you can use the bank machine to pay in smaller (under £1k?) cheques.

--
Regards,
Martin Brown

On 23/10/2022 21:10, Martin Brown wrote:
> Social engineering attacks always are. The only defence is attack.
> Tell them to FOAD more or less politely - they have cold called you.
> You have no evidence that they are who they claim to be (end story).

When I'm sure it's a scammer I just say "Hang on a minute" and put the
phone on the table.

I wish to maximise their wasted time.

Andy

In article <tj6jq5$1nrdk$3@dont-email.me>,
John Rumm <see.my.signature@nowhere.null> wrote:
> On 24/10/2022 15:39, Pamela wrote:
> > On 09:25 24 Oct 2022, Brian Gaff said:
> >>
> >> Well, the question is, who initiated the discussion. I would never
> >> give anyone the details if they started it, even if it was from an
> >> apparently genuine email.
> >
> > My friend received an SMS with a fake "From" number. The SMS claimed to
> > be her bank and asked her to ring their number.
> >
> > When she rang, she was asked to verifty herself by giving the the
> > "magic number" from her Pinsentry device .. and then they transferred
> > money from her account.

> I expect there is more to that storey that conveyed here...
> They might be able to login to the account, but that alone would not
> allow new payments to be setup.

Quite. There are two stages of authentication when setting up a new
payment with Pinsentry. And that's after you've logged into your account.

--
*ATHEISM IS A NON-PROPHET ORGANIZATION.

Dave Plowman dave@davenoise.co.uk London SW
To e-mail, change noise into sound.

In article <tj3fo6$1bla$2@gioia.aioe.org>,
Martin Brown <'''newspam'''@nonad.co.uk> wrote:
> > When I refused to give details to someone who claimed to be from my
> > bank, they said 'well call the number on your card'

> That isn't good enough either if you do it on the same phone line.

> A well equipped bad actor can play dial tone to you and hold the line
> open and them pretend to answer as your bank after you have dialed the
> right number on your bank card. I think telco's have shortened the delay
> before the line drops to mitigate against this trick.

I don't think this is the case anymore. It was one of the original scams
which BT sorted. The incoming subscriber can no longer hold the line open,
for more than a few seconds.

--
*If work is so terrific, how come they have to pay you to do it?

Dave Plowman dave@davenoise.co.uk London SW
To e-mail, change noise into sound.

In article <01jalhpvjhp49dqnn6rpm05a4qch2uednb@4ax.com>,
Chris Hogg <me@privacy.net> wrote:
> On Sun, 23 Oct 2022 14:32:49 +0100, Andrew
> <Andrew97d-junk@mybtinternet.com> wrote:

> >>
> >> Different banks may have different names for the system. It's
> >> basically a card reader that can confirm a person's identity. It's a
> >> pity the banks don't have a similar system for confirming who they
> >> are, so that the private individual can check they're not talking to a
> >> scammer.
> >>
> >
> >Barclays does have just that system. You set up a word or phrase
> >on your Barclays PinSentry app that only the genuine bank will
> >know about.

> Don't know how to do that. I don't do on-line banking, internet
> banking, telephone banking or whatever, and I don't have the banking
> app. I regard all of them as just more to worry about and additional
> ways a scammer can get access to my account. Fat lot of good it did
> me! I get wiser and more paranoid every day. As I said, I managed to
> get everything blocked before any damage was done, and a new card is
> on its way.

I'd say, today, a cheque would be pretty easy to forge.

Rule one with any call of any sort wanting personal data. Ignore it. If
concerned, contact your bank in your usual way.

It can be quite fun with some of those scammers. Ask them to identify
themselves by giving simple details about you that they would have on
file. They always mumble about data protection or whatever.

--
*I used to have an open mind but my brains kept falling out *

Dave Plowman dave@davenoise.co.uk London SW
To e-mail, change noise into sound.

In article <7rialhl6ssp0ltn505t4fb22v7ljifpp57@4ax.com>,
Chris Hogg <me@privacy.net> wrote:
> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
> <'''newspam'''@nonad.co.uk> wrote:

> >On 23/10/2022 13:49, Chris Hogg wrote:
> >> I got scammed at the end of last week. All sorted and no harm done,
> >> but the scammer told me that the normal security checks such as
> >> mother's maiden name etc was no longer being used, and everything was
> >> being done via the Pinsentry system. After resistance from me I
> >> eventually went along with it and gave him all he asked for! :-(
> >
> >So you mean he tricked you into entering your card number

> Yes, that.

> >and doing the
> >ID me by PIN and passing him that information

> No, I didn't give him my pin, at least not directly, unless he is able
> to deduce it from my pinsentry response. Could that happen, and if so,
> what's the point of pinsentry? Not a sentry at all.

But to get anything from a Pinsentry,you have to insert your card and PIN.

--
*A fool and his money can throw one hell of a party.

Dave Plowman dave@davenoise.co.uk London SW
To e-mail, change noise into sound.

On 26/10/2022 16:06, Dave Plowman (News) wrote:
> In article <tj3fo6$1bla$2@gioia.aioe.org>,
> Martin Brown <'''newspam'''@nonad.co.uk> wrote:
>>> When I refused to give details to someone who claimed to be from my
>>> bank, they said 'well call the number on your card'
>
>
>> That isn't good enough either if you do it on the same phone line.
>
>> A well equipped bad actor can play dial tone to you and hold the line
>> open and them pretend to answer as your bank after you have dialed the
>> right number on your bank card. I think telco's have shortened the delay
>> before the line drops to mitigate against this trick.
>
> I don't think this is the case anymore. It was one of the original scams
> which BT sorted. The incoming subscriber can no longer hold the line open,
> for more than a few seconds.

Which would be a pain for someone, especially elderly or disabled and
slow moving, who takes a call in one room and needs to move to another
room to sit down or get more information. Not dropping the line for a
while was a very useful feature.

On 26/10/2022 15:03, Vir Campestris wrote:
> On 23/10/2022 21:10, Martin Brown wrote:
>> Social engineering attacks always are. The only defence is attack.
>> Tell them to FOAD more or less politely - they have cold called you.
>> You have no evidence that they are who they claim to be (end story).
>
> When I'm sure it's a scammer I just say "Hang on a minute" and put the
> phone on the table.
>
> I wish to maximise their wasted time.

I do that to the "we are Microsoft scammers your computer is messing up
the internet". I promise to go and get Fred who knows about computers
and leave the phone on the desk with the line open.

I figure that is a service to people who might be taken in.

--
Regards,
Martin Brown

In article <tjbnvt$2gjlo$3@dont-email.me>,
SteveW <steve@walker-family.me.uk> wrote:
> Which would be a pain for someone, especially elderly or disabled and
> slow moving, who takes a call in one room and needs to move to another
> room to sit down or get more information. Not dropping the line for a
> while was a very useful feature.

Then you know what to get them for Xmas. A DECT phone.

Wonder how many still have wired extensions - and only wired phones? Tiny
number, I'd say.

--
*There are 3 kinds of people: those who can count & those who can't.

Dave Plowman dave@davenoise.co.uk London SW
To e-mail, change noise into sound.