Bank wants my Online-banking PIN through the telephone

Question

My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call 04106-...). I called said number, and I talked to a real person. So far, so good. The person wanted my Online-Banking PIN, through the phone, before doing anything.

Is this normal and safe operation, or was I correct to politely end the conversation?

What happens if my card is misused after tomorrow? I called their hotline to get it blocked, but they didn't want to do anything without my online banking PIN.

Answer 1

In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) bank's website to login to your account or on a physical banking terminal such as an ATM.

The entire purpose of a personal-identification-number (PIN) is to be a unique number that you and only you know, allowing you to authenticate yourself.

I would recommend finding a physical banking location where you can go in person and talk to a person about your experience and the issue you were having that lead to you making that phone call.

It is entirely possible the phone number was for the real banking institution and the phone operator was new or inexperienced and made a massive mistake, but there is no good reason for a person to give up a PIN to another person.

Hope it helps!

Answer 2

It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are indeed talking to an authorized user of the account.

They used to ask personal information - social security number, old addresses, security questions, etc. Those have begun to fall out of favor.

The 'telephone PIN' or user PIN, is not the same PIN as your debit or credit card nor online account password. It can also be used as a secondary verification method when logging in online or when retrieving or resetting the online password.

So, no, it is not a sign of phishing necessarily and it is good that you found it suspicious and ended the conversation instead of blindly giving someone your PIN.

Answer 3

As there has been some confusion here, I wanted to add another (and hopefully last) answer to consolidate all the information that is flying around.

---

First of all, what kind of PINs are there in today's banking world?

Cardholder PINs:

This is the PIN that belongs to your debit or credit card. Unsurprisingly, there's also an ISO norm on how to manage PINs like this. So this will be pretty routin to nearly all banks. There are a lot of instances whre you will have to give your cardholder PIN to a machine. That is when you are paying for something or withdrawing money.
No serious bank will ever ask you for that number, if somebody does, it's probably a scam.

PINs for phone banking:

Most banks (that I came across at least) have a separate PIN for phone banking. This is a PIN that you can authenticate yourself with over the phone towards an agent or an automated system (see similar questions here, here and especially here). Take a look at these, they will answer most of the surrounding questions you might have.

PINs for online banking:

This is the PIN that you use for all your online banking needs. To be frank, your PIN for online banking is pretty much a password for logging into your online banking account. Some banks do wonky stuff with your online banking PIN, but most banks don't. What they will do is pretty routine and exactly what you would expect from normal behavior around managing sensitive passwords. Most banks use this PIN only for online banking. BUT some banks do use this PIN for phone banking as well (it was news to me at first too).

What's the big difference here?

A cardholder PIN is used to directly access your funds (while in possession of your card). That makes it much more valuable than the other two. Why? Because with PINs for online and phone banking, you access a system to manage your funds. If these systems are well designed, you will need a second factor to authorize any changes that are made. Be it transferring money, establishing a banker's order or changing your address. So theoretically an adversary has taken a big step towards gaining control of your bank account, when he/she steals one of the latter PINs, but can't really do much, without also having control over whatever supplies your second factor.

---

So now what?

Different PINs typically authenticate you against different systems. If a bank uses the same PIN for two different systems, that might be not the best way to do it, but it is a way to do things. If you are uncomfortable with this, ask for another form of authentication. Find out, what the bank's typical form of authentication over the phone is. If there is no information on the interwebz, just call again, wait for another agent and see what kind of credentials he/she wants. If you dont trust a human agent, ask for authentication against an automated system.^{someone could be listening though}

Conclusion:

This is not the worst thing in the world. It is not best practice (from my experience). It is not very reassuring. But this does not mean, that all your funds are gone tomorrow.

If this does not fit your threat model, you can always threaten to leave the bank for another company, if they don't change their policy. Tell them why, maybe they'll do something about it. Leave if they don't. This is especially true if they don't have any form of 2FA within their systems.

Phone banking is always a tad insecure, because other humans are involved. And humans tend to make mistakes and in some case can be criminals.
There is a simple solution for that: stop using phone banking.

Important: Most of the solutions that were mentioned in the comments do not solve this problem. Automated systems can be hacked or be exploited, security questions can be recorded etc. If an agent working in a call center that handles phone banking wants to scam you, he/she probably can - if there are no security controls in place.
The good thing is, most banks do not let that happen, because a lot of smart people work there, that rack their brain about these things.

You know why? We're not the first guys and girls that worry about getting scammed.

Answer 4

I'm not sure about your specific situation. But my bank (in Czech Republic) have provided me with special 10 digit code. This code is called Telebanking PIN as is used a means of verification.

When I call the telebanking hotline the operator will request up to 6 positions of this secret code. The idea is, that only the rightfull owner of the account would have this access code.

This is NOT a pin for my card, it is a special code applicable only for telebanking.

Answer 5

I think a lot of people got to the heart of the issue here but I'll chime in. A lot of banks these days do ask for some sort of secondary authentication when doing business over the phone. This may be a phone PIN (separate from your debit card pin) or a word or phrase - such as the make and model of your first car (if you've shared this information with them).

The experience you had does not strike me as strange but I think it was smart of you to end the conversation if you were uncomfortable/unsure. What I would recommend is just reaching out to your banks customer service line and asking their methods for validating identity over the phone. If asking for a phone PIN is a part of it (or if not) that should answer your question right there.

I've also run into instances where I've setup a phone PIN or phrase and promptly forgot it so if you are unsure you can always ask if there is another way to validate your identity - it usually involves answering more questions but at least you wouldn't be giving your PIN up.

To drive one point home, if your bank does use a phone PIN, YOU need to make sure it's different from your debit card PIN. If you chose to re-use your PIN you're heightening the risk of compromise.

Answer 6

If they had called me, I would have adamantly refused to give up my PIN and broken off my relationship with the bank.

Let's look at what a PIN is (no, not a "PIN number"). It's a Personal Identification Number. That's so you and only you can use it for certain personal transactions. There's no reason for the bank to want it.

I would have wanted to talk to a supervisor on the phone. Maybe they wanted to establish your identity so they didn't get someone calling in a spurious card cancellation. If that's the case, however, there's a lot of other info available on your account that can be used. Either way, there's no reason to get your PIN.

What happens if the card is misused? It sounds like you're not in the US, so US laws would not apply. I'd suggest looking up your local laws about this - some jurisdictions make you less responsible for fraud than others.

Answer 7

This is indeed a normal procedure for many banks.

However it is to be noted that:

• You do should NOT disclose the pin to an operator
• Instead you dial the pin on your phone keyboard, NOT orally, usually BEFORE talking to an operator.
• This is your banking login PIN and not your credit/debit card PIN

Answer 8

It's very bank-specific, but for example in Finland that would be unheard of! The banks actually specifically warn that they will under NO CONDITIONS ask for your PIN code, and you should never hand it out or store it together with your card.

Verification happens via one-time-use numbers either from challenge number list you receive from the bank, or more commonly via a bank-provided mobile app with the same principle. And that app is tied to your phone number which you specifically personally authorize in your bank (online, or in person). Equally, you can revoke the number, which immediately prevents the app from being used, even if you know the app PIN code and stole the physical phone.

Answer 9

It sounds strange if you have to provide your PIN to a person, but it is of course possible they just wanted to identify you. Where I live (Finland), for phone banking I have to type my user code (8 numbers) and one-time code (4 numbers) or alternatively instead of the one-time code use my authentication app on my mobile phone. This is commonplace in Finland, and you don't tell the user code and the one-time code to anybody, you type them over the phone to an automatic computer system.

If you feel insecure in providing the PIN, you could of course visit the bank physically instead of using the services over the phone.

They also ask for my social security number very often over the phone. This I don't type, I tell it to the other person on the phone.

It is very unlikely that your phone conversation will be covertly listened. In theory, somebody could block the 3G frequencies with a jammer, forcing the phone to use 2G, and use an IMSI catcher and crack the encryption keys (which should be doable for the poor GSM ciphers in a reasonable amount of time). The chances of this happening are so low that I wouldn't worry about it.

Answer 10

Your online banking PIN is not the same PIN you use with your card in a machine nor is it the passcode you use to access your funds and do transfers. It is simply a code that identifies you as the authorized caller. There seems to be much confusion about this matter.

Your online banking PIN is used merely as a means to identify you, it cannot ever be used to access your account's funds or perform transfers.

If you just happen to be using the same PIN for both then you need to change it!