2

I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards is something that I think would be interesting for an audience of security professionals, and I wonder if it is not good enough.

Here is the instructions that accompany the card sent via postal mail:

How to activate your card

  1. When you receive your digipass [electronic OTP code generator] and digipass PIN, log onto your internet banking

  2. To retrieve your six digit access code click on 'Account Management' and then the 'Cards' tab

  3. Using your mobile number you provided in your application, text '{BANKNAME} PINACT' followed by your access code, followed by the last four digits of your card number (e.g. {BANKNAME} PINACT 123456 7890) to {SMS number}

  4. You'll be sent your debit card PIN via text

  5. You're ready to use your card (remember to sign the back). The first time you use it you will need to enter your PIN - at an ATM or within a store

I went through the instructions, and received this SMS:

Your card is active and the PIN for your {bankname} Bank Debit Card ending with XXXX is YYYY. Please delete this message after reading.

I take the view that security is a balance between convenience versus the attractiveness of a target. In this case, the target is a supply of PIN codes for payment cards, for presumably tens of thousands of customers, sent in an unencrypted channel over the public telephony system. I note also there are no encouragements that PINs should be changed when they are received.

Moreover, it seem strange that one obtains a one-time security code from an internet banking site (secure and encrypted) in order to obtain a permanent PIN code via SMS (interceptable). Should that not have been the other way around?

In the UK it is common practice for customers to be told not to reveal their payment card PINs to "anyone, not even the police". And yet this bank has provided PIN codes for all of their customer's payment cards over a plaintext comms channel (and thus, by extension, the police, who have realtime access to all unencrypted comms in the UK).

There are three mitigating reasons the bank may have:

  1. PINs are useless without a physical card, and they are not used for "cardholder not present" transactions
  2. Most card providers support PIN changing at ATMs
  3. Tens or hundreds of thousands of UK customers have been served their PINs in this fashion, and none of them have been defrauded as a result of SMS interception

However, I am still not certain good practices have been followed here. Am I right in believing this security could be improved, and would my suggestion of using SMS for one-time codes and the (HTTPS) banking web app to show PINs, offer better overall security?


I don't actually know this, I am just guessing what the bank might claim.

0

Am I right in believing this security could be improved, and would my suggestion of >using SMS for one-time codes and the (HTTPS) banking web app to show PINs, offer better >overall security?

Yes, I believe you're right on. A better schema would be to send a one-time-code via SMS and to reveal the PIN via HTTPS (or even better, not reveal the PIN at all once it has been set). As well, the bank should recommend that users change their PIN upon receipt.

| improve this answer | |
  • Thanks for your answer. We are in agreement; however, to play Devil's Advocate for a bit, isn't security about achieving tangible results? In other words, if tens/hundreds of thousands of customers have not experienced a financial breach as a result of this data leakage, there isn't a problem? Or might they say that the only people who have blanket access to SMS messages via surveillance protocols are not the kind of people who engage in financial fraud? – halfer Apr 18 at 16:56
  • Yep, we agree. In general, just because something bad hasn't happened yet doesn't mean that there isn't a problem. As well, it is important to consider whether stealing a PIN via SMS is really the lowest barrier of entry. – ghrs Apr 18 at 17:05
  • "Or might they say that the only people who have blanket access to SMS messages via surveillance protocols are not the kind of people who engage in financial fraud?" Beware of blindly trusting "people". – ghrs Apr 18 at 17:09
  • Oh yes, one would not be wearing a security hat if one thought the various institutions of power within the establishment did not need security mitigation! – halfer Apr 18 at 17:42
0

I agree that showing the PIN on https (when logged in to the bank site) would be preferable. Actually that's what Amex was doing in my (non-UK) country a few years ago. It was a strange Javascript widget where you could unmask only one digit at a time on screen.

Sending a PIN by SMS does not strike me as a safe or good practice.

The only valid reason I can see here is spreading the risk. Someone who has your banking credentials + Digipass + your bank card (stolen from the mailbox) cannot get the PIN without access to your mobile phone.

Unless they carry out a SIM swap attack (obtaining a new SIM card in your name with your number).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.