I recently changed banks and the new bank's mobile-banking service has made me ask some questions.

The phone is authenticated/registered with the bank who must be keeping something like an <IMEI, username> tuple. At this point, all other authentication is done on the phone. So if I need a code to set up a payee, it gets sent via SMS. For other functionality, the app itself generates a code (for example, to log into online banking via desktop browser).

Obviously, in the event of device compromise, multi-factor over 1 channel is not good enough to prevent an attacker from accessing my money!

My previous bank used a cumbersome card reader, so initially the idea of not having to carry that around was appealing, but there is an inherent security improvement there.

How do other banks do this better, in your experience? Or am I blowing the likelihood of such a scenario up to be much more than it actually is?

1 Answer 1


Using the same device, as you have described, doesn't entirely negate the security benefits of multi-factor authentication but it definitely does greatly reduce them. In general, multi-factor authentication for banking is pretty effective. Having previously used them, HSBC give you a separate, small device that doesn't connect to the internet but generates new secure keys which are needed for logging in and setting up new payees; it is also rather small and so it's easy to carry around if needed. However, I would recommend just doing online banking whilst at home to avoid other security risks relating to public networks etc. anyway.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .