Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list?

Why is this more secure than using a username, password and a card reader or a mobile app to enter a one time password? Simply using a username with 2 passwords doesn't feel as secure, but I have no proof that it is less secure than using a combination of something you know and something you have.

It seems disappointing there's an obvious way to significantly and relatively easily improve security, but it's not been adopted.


  • It is really silly yes. You've mentioned Halifax, I've also had the same experience with Barclays, Santander. M&S (HSBC) uses HOTP (or pretends to, at least), but not as second factor. All of those in the UK. It also doesn't help that security questions are pretty much universally used for account recovery. There might be a simple answer "because they can", but I too am hoping for actual reasons.
    – domen
    Feb 27, 2018 at 8:32
  • Most banks in the UK Do use 2FA. Change your bank.
    – Chenmunka
    Feb 27, 2018 at 9:23

3 Answers 3


In some cases, they do use 2FA, but only for "high risk" transactions. For example, when I set up a new standing order or make a payment to an account I've not paid before, my bank requires that I use a 2FA code generated by a mini card reader, even though they don't require a code for me to log in and view data, nor to make a payment to an account I've paid before.

This is probably an attempt to balance usability and security - making "common" actions relatively frictionless, while making it hard to divert funds to an attacker (unless you've already paid the attacker legitimately). It could certainly be used to inconvenience people (an attacker who got into my account could send all the funds there to, for example, my electricity supplier, since I've previously made payments to them, which would be a pain to unravel, but it would be tricky for them to directly benefit.

It's not a universal situation though - some let you log in with a generated code, others require 2FA for all transactions, others don't support it at all.


For convenience.

There are plenty of people actually incapable to use the this system. Even more experiences ones initially had big trouble.

User and password is way more easy for everyone. It takes 2/3 things: user, pass (and sometimes check).

The 2FA most banks use acts like this: You have an ID which you use to log in with (1). As password, you generate it via token (2) or phone by using your known PIN (3). The you use what you generated to login (4). At transaction time, you get a transaction code (5), then with that used in your token (6) you generate a new pass-code (7) which you input on the transaction sheet (8).

For people that never used this before and don't have general experience on this matter it's nearly impossible to be used and does take some time to get used to.

Personally, I'll take passwords anytime, because I design them well.


Barclays require a code from a Card reader to login, and a different code for payments to new customers, so there are banks with better security.

IIRC TSB does phone verification for payments to new destinations.

The drop-down second password is to defeat simple keyboard loggers, which might otherwise record username and password (and possibly the URL to trigger capture). More effective loggers also record screenshots. By asking for only 2 characters they also prevent a single recording from getting all the answers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .