Is it normal/safe/justifiable that a bank asks me for my full login details (account id and PIN) when calling via mobile phone?

Question

I am calling my bank via mobile phone (in Germany) and the electronic voice asks me to

• type in my account access id (via the number pad), and like-wise,
• type in my account PIN, all the numbers, not only the first and third, but all six of them!

If I do not do all of this, the call will be cancelled, even if my inquiry is not account specific.

Given that every bank always tells you to never ever give away your account login information (especially the PIN, with phrases like "we will never ask you for your PIN"), and a usual phone call is not heavily encrypted (I believe), this appeared very troublesome to me!

Is this normal? How can this be justified? Is there any good reason not to worry about this? How are they ensuring that this not leaks my account login details.

Answer 1

I will give a two-part answer here.

1. Is is normal that the bank asks for personnal and private informations?

   Yes it is. The bank system is the professional part or the transaction, so they are responsable for securely identify you. Best practices (and European Community rules as you spoke of Germany) require that they ask for two different and unrelated things. Ideally it should be a valid 2FA system, said differently based on something you know and something that is under your exclusive control. For that reason they often send you a one time token (8 digits) via mail or SMS and require that it is given back on a different and authenticated session. But that is easy on a computer or smartphone on a HTTP site, probably much harder on a phone system...

2. Is it normal that a bank asks for the PIN code of your credit (or debit) card?

   Definitely NO. Ideally nobody in the bank should know your PIN code, and it should not be persisted on their information system. The point of using a smartcard is that the PIN code can be known to the owner only. The card itself should only have a hash of it, and neither the clear text PIN nor even its hash should be persisted in any database or file.

What follows is only my opinion.

Unfortunately, banks often have a peculiar point of view on information security. They actually own the card and do not trust their customers to correctly manage secrets more complex than 6 to 8 digits, and they often keep a copy of the PIN code when they should not need it. Because of that, they think they can safely use it for remote authentication when it should be dedicated to local authentication.

Answer 2

This is normal. I had an account with a major U.S. bank, and they would routinely have their automated system ask you for your debit card number and PIN. The concept is that you have specifically called a trusted number, usually written on your debit or credit card or account statement, and therefore this is usually as trustworthy as your phone network is.

As to whether mobile phone networks are securely encrypted, the answer is usually that they are not. Typically the algorithms used in them have not stood up well to cryptanalysis, mostly because the standards bodies have decided to invent their own algorithms rather than use well-known algorithms and modes. As a result, and additionally due to the requirements for lawful interception of phone calls in virtually every country, you should assume that your phone calls are not private to a dedicated party, but are generally not trivially interceptable to arbitrary busybodies.

However, if you have concerns about communicating private data like this over a phone line, then you should not use the phone for private data. My assumption has been that the bank is legally liable for fraud and acting on unauthorized instructions (which, in the U.S., it is for consumers), and thus they have borne the entire consequence of this insecurity. In addition, it is practically difficult to solve many problems requiring the use of private information without the use of a phone line, so until the telephone companies come into the 2020s, we're just going to have to live with it. It will likely take either expensive litigation or regulation to get there, though.

You may wish to use your bank's live chat service via their website, which typically uses TLS 1.2 or 1.3 and is going to be securely encrypted. That's mostly due to various browser vendors who have been pushing for robust encryption.