0

Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online banking portal.

My concern is what happens when phone is lost.

I understand the security concerns using an email associated with the account profile to send OTP. However, if one uses a secondary email, and this secondary email is only used for OTP/2fa, does this alleviate security risk?

1 Answer 1

0

There's no benefit to that, because there are already processes in place to resolve the scenario you described.

First, if you lose your phone, you can report it as lost to your carrier and they'll deactivate the SIM to prevent it from being used. At that point, the phone cannot receive new texts to your number. Your carrier will then issue you a new SIM card for your number, which you can use on a new phone. It's the same number, so 2FA is not affected.

If you bought the phone on contract, or you report the phone as stolen, the carrier can also mark the phone's unique identifier (IMEI) as barred, which prevents it from registering to any carrier's cell towers. This has no real bearing on 2FA but it does help limit the impact of a stolen device, especially if you have a passcode on it.

If the 2FA was not via SMS, but through Google Authenticator or a similar app instead, then there should be recovery codes that let you log into your account without the 2FA token, so you can reset your authentication details and recover the account. These recovery codes are shown to you when you set up the 2FA. You should back these recovery codes up somewhere safe, separate to your phone.

If the 2FA solution doesn't have backup codes (e.g. it's done through your bank's mobile app) or you simply lost the backup codes, there's still a recovery process. This varies depending on the organisation or service, but for banks it's almost always as simple as phoning them up and going through alternative security checks to prove that you're the account holder. At that point they can reset your account and let you re-register with a new password and new 2FA.

2
  • Then best to have copies of IMEI if phone purchased unlocked as well as SIM if using prepaid. Did not think of keeping same number thru deactivation.
    – paulj
    Sep 16, 2021 at 19:09
  • Prepaid SIMs can still be blocked by calling the carrier that the SIM is registered with. The phone's carrier lock status is largely irrelevant here since it's the SIM, not the phone, that decides the carrier - the carrier lock is just a question of compatibility.
    – Polynomial
    Sep 16, 2021 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.