Banking - Physical vs Digital Token

[keenklee]

Hi All,
Are there pros/cons using physical vs digital ?
If going overseas, any issues ?

TIA.

 

[reddevil0728]

One is on your phone one is an additional piece of equipment?

No if you are talking about using.

 

[keenklee]

One is on your phone one is an additional piece of equipment?

No if you are talking about using.

Yes, one is the phone and the other is standalone piece.
That's good to know.

Maybe I am paranoid which is why I prefer separate devices rather than all-in-one !

Like my SMS and bank apps are on different phones. The SMS phone is like the standalone piece.

 

[reddevil0728]

Yes, one is the phone and the other is standalone piece.
That's good to know.

Maybe I am paranoid which is why I prefer separate devices rather than all-in-one !

Like my SMS and bank apps are on different phones. The SMS phone is like the standalone piece.

if that floats your boat lor

 

[silverbomb]

It's good to have phone token than physical token if you're going to be stationed overseas. It's a pain to get the token to be delivered to an overseas address if it is loss or batt died. Anyway most banks has moved onto phone token, latest being HSBC.

Posted from PCWX using SM-G965F

 

[Shiny Things]

Hi All,
Are there pros/cons using physical vs digital ?
If going overseas, any issues ?

TIA.

I would do unspeakable things for a bank that lets me use a Yubikey.

Anyway. Here's your options:

• Top of the list is Yubikeys. Super-secure, easy to use, and they fit on your keyring, but not widely supported, sadly.
• Phone-based authentication is a good tradeoff of convenience and security. The standard here is Google Authenticator on your phone—or a similar phone-based push token, like DBS's system or IBKR's IB Key.
• Physical tokens, like the old DBS one that looks like a little calculator, are quite secure, but also they're annoyingly complicated, and they're yet another thing to lose. I think these are not a great idea.
• SMS one-time codes are the bottom of the barrel: better than nothing, but they're extremely easy for a motivated attacker to hijack.

 

[bright_84]

When tokens don't work your life stops. When apps don't work you can always call in.

 

[keenklee]

Thank you all for the inputs.

It is true that using the physical token (POSBank) at times, is really a PITA !

I guess I have to balance the convenience of using the digital token with trusting the security of the mobile device.

 

[reddevil0728]

Thank you all for the inputs.

It is true that using the physical token (POSBank) at times, is really a PITA !

I guess I have to balance the convenience of using the digital token with trusting the security of the mobile device.

If it’s not secure, bank wouldn’t dare to use it also.

They will be responsible for any breaches anyway

 

[keenklee]

If it’s not secure, bank wouldn’t dare to use it also.

They will be responsible for any breaches anyway

The human is the weakest link.
With the digital token and mobile device, under duress, one could add new transfer account, raise transfer limit and perform a transfer !

Probably I think too much !

 

[reddevil0728]

The human is the weakest link.
With the digital token and mobile device, under duress, one could add new transfer account, raise transfer limit and perform a transfer !

Probably I think too much !

I think so... probably not enough also.

 

[chiokcc]

https://www.straitstimes.com/busine...ens-reversing-plan-to-phase-them-out-by-april

 

[keenklee]

https://www.straitstimes.com/singap...east-85m-to-phishing-scam-involving-ocbc-bank
Exerpt

SINGAPORE - Since the start of December, at least 469 people have fallen prey to phishing scams involving OCBC Bank, with reported losses totalling at least $8.5 million.

IMHO.
That is 1 bank in 1+ month.

P.S. I will be more "unsafe" when my telco stop my multi-sim and I move towards digital token.

 

[fr33d0m]

The perpetrators must have found some loopholes in OCBC online banking. Transactions are quite limited through internet banking without extra 2FAs to transfer money out of customer accounts. Or the victims entered multiple 2FAs during the process…

 

[keenklee]

IMHO.
We still have 1 or 2 gen of people who are digital immigrants.
These age group likely will have a fair bit of money saved.
Seems similar concept as to why we have TraceTogether have tokens parallel with the app.

 

[cscs3]

IMHO.
We still have 1 or 2 gen of people who are digital immigrants.
These age group likely will have a fair bit of money saved.
Seems similar concept as to why we have TraceTogether have tokens parallel with the app.

One thing to take note between the 2 is...
TT case, using token to check in is always faster and it does not depend on yoir mobile signal coverage.
Banks digital token case, need to take note login and token is on the same device. You need to make sure your device (phone) is very secure. Lossing it means you can get impact heavy. Never never assumed no one can break into your phone even you has password to lock it.

 

[chiokcc]

I always opined that there should be choices of physical or digital token..... who pays for it will be another matter .....

 

[chiokcc]

I always opined that there should be choices of physical or digital token..... who pays for it will be another matter .....

For example, instead of dis-incentive to stay with physical token, should also try incentive for using digital token .... should not penalise old folks who stay with physical tokens ....

 

[keenklee]

One thing to take note between the 2 is...
TT case, using token to check in is always faster and it does not depend on yoir mobile signal coverage.
Banks digital token case, need to take note login and token is on the same device. You need to make sure your device (phone) is very secure. Lossing it means you can get impact heavy. Never never assumed no one can break into your phone even you has password to lock it.

IMHO.
Also, will a person be forcefully coerced into logging into the bank app to perform a big transaction.
Banking apps would have evolved by now so not sure if it was like last time e.g. without the physical token, quite a few transaction cannot be done.

 

[fr33d0m]

One thing to take note between the 2 is...
TT case, using token to check in is always faster and it does not depend on yoir mobile signal coverage.
Banks digital token case, need to take note login and token is on the same device. You need to make sure your device (phone) is very secure. Lossing it means you can get impact heavy. Never never assumed no one can break into your phone even you has password to lock it.

To most people, it is more likely they lose their tokens than their phones.