A lot of banks I have dealt with require the customer to enter their customer number, internet banking password (or phone password) and date of birth all via the phone keypad, prior to being connected to a staff member. Each of these individual details are followed by the # symbol.

After entering these details, the customer can perform most actions (e.g. transfer money or change personal details) without any further verification procedures. Depending on which phone you use, these numbers remain on the screen for the remainder of the phone call.

Additionally, when transferring money via this method, the bank no longer requires 2-step authentication, unlike when transferring money via the banking app or website. This is the same regardless of whether you call from the number linked to the account, or an entirely different number.

This seems a lot less secure than using the bank app or website. But how much of a security threat does this present?

In the context of a smartphone - How easy would it be for malware/spyware/keyloggers to extract the numbers separated by the #, and therefore gain access to the associated bank account via phone banking?

2 Answers 2


Key loggers on smartphones do not carry the same risk as key loggers on PCs because of app sandboxing. That's not to say that it's not possible either by rooting the device, persuading the user to install a custom (malicious) keyboard or perhaps even side channel attacks.

You are highly unlikely to have this happen just by visiting a malicious website compared to visiting the same site on a less than perfectly patched PC.

Maybe your banks are less secure than mine, but in my experience you can only transfer money to people you have already set up as recipients via the keypad. Adding a new recipient requires a more extended authentication process.





If you are suspicious of your smartphones keypad then you could use a tone dialer. But if you don't trust your smartphones keypad you shouldn't trust its microphone either, or the software between any inputs and the signal out.

  • That's just like, your opinion, man Commented May 12, 2021 at 18:29

You must log in to answer this question.