Banking - Physical vs Digital Token

[mikelee7900]

Nothing beats token on 2 physical devices.

I believe so too, so if we are using smartphone to access online banking, then it makes sense that the token should not be using our smartphone, and I prefer a separate hardware token to provide OTP etc rather than receiving on my smartphone because as consumers we are not security experts and we will never know whether our phones have been hacked, been planted with spyware/malware/etc.

 

[mikelee7900]

An individual's own diligence is their last line of defence, so people have to be responsible for themselves and can't be overly reliant on others.

No amount of own diligence will beat sloopy backend servers where hackers can get hack and get in and then their money lost. So banks and telcos do have a lot of responsibilities to ensure that their systems are really secure.

 

[reddevil0728]

No amount of own diligence will beat sloopy backend servers where hackers can get hack and get in and then their money lost. So banks and telcos do have a lot of responsibilities to ensure that their systems are really secure.

that's for sure. it's about risk-based approach.

in the past is paper based then in local drive, then in cloud.

just be prepared for changes

 

[chiokcc]

Just bring back physical token ....

 

[reddevil0728]

Just bring back physical token ....

that can be a wish. but just be mentally prepared it will be gone for good. even if it isn't now.

 

[fr33d0m]

Just bring back physical token ....

It is not a big ask as long as the consumers are willing to bear the cost to issue tokens. Whatever tokens the backend of the banks does not care. What matters to the banks are cost to issue them.

 

[reddevil0728]

It is not a big ask as long as the consumers are willing to bear the cost to issue tokens. Whatever tokens the backend of the banks does not care. What matters to the banks are cost to issue them.

Yep. It will likely make it onerous for people to own the physical token.

 

[cscs3]

I believe so too, so if we are using smartphone to access online banking, then it makes sense that the token should not be using our smartphone, and I prefer a separate hardware token to provide OTP etc rather than receiving on my smartphone because as consumers we are not security experts and we will never know whether our phones have been hacked, been planted with spyware/malware/etc.

Alternatively like UOB, some functions required you to enter ATM pin as a second verification.

 

[CrashWire]

No amount of own diligence will beat sloopy backend servers where hackers can get hack and get in and then their money lost. So banks and telcos do have a lot of responsibilities to ensure that their systems are really secure.

Ledgers can be rolled back, and customers will never lose money in this case because MAS will always want to ensure that there's confidence in our banking systems.

 

[yuzu28]

Alternatively like UOB, some functions required you to enter ATM pin as a second verification.

But doesn't this subject your ATM pin to 3rd party? I think backend somehow there's a system that can detect multiple entries of certain password, meaning these pins are collected somewhere.

Ocbc has the most stupid system cos their internet banking and atm pin are the same. Dbs internet banking also using pin.

 

[reddevil0728]

But doesn't this subject your ATM pin to 3rd party? I think backend somehow there's a system that can detect multiple entries of certain password, meaning these pins are collected somewhere.

Ocbc has the most stupid system cos their internet banking and atm pin are the same. Dbs internet banking also using pin.

Can change the pin what

 

[qsgsgs]

Digital tokens are 1.5FA . The same device should not be used to get the OTP/approval. Physical tokens which uses FIDO2 like Yubikey are the best but banks here are so slow to implement it.

 

[yuzu28]

Can change the pin what

U want to change pin everytime u use to reduce the possibility that it floats in the internet?

 

[reddevil0728]

U want to change pin everytime u use to reduce the possibility that it floats in the internet?

Huh?
ATM and ibanking can be different right?

 

[yuzu28]

Huh?
ATM and ibanking can be different right?

Ocbc is same. The one i quoted said 2nd verification for uob i atm pin.

 

[reddevil0728]

Ocbc is same. The one i quoted said 2nd verification for uob i atm pin.

Ocbc atm and ibanking pin must be the same? Really?

 

[cscs3]

Ocbc is same. The one i quoted said 2nd verification for uob i atm pin.

Yes UOB one certain function they will 2nd verification which is ATM pin. So never set ATM pin same as your internet banking password.

OCBC system before this scam is xompletely screw. Found out aometime SEP 2020 they wrote to some customer to change login ID from short simple to complex one. However, seem some lack in this area. You can continue to login mobile app with the old short ID! This is to say your account probably has 2 iDs. This was confirm by their call center. They put it as convenient for customer to login.

 

[cscs3]

But doesn't this subject your ATM pin to 3rd party? I think backend somehow there's a system that can detect multiple entries of certain password, meaning these pins are collected somewhere.

Ocbc has the most stupid system cos their internet banking and atm pin are the same. Dbs internet banking also using pin.

The last part not sure if true, but I happen to have same pin for both internet banking and ATM.
In any case, the safer way to move out till MAS step in to monitor their operation. Their call center is a key issue to these scam. The long delay really gives these scammer has lots of time to get more money out from your account.

By the way, confirmed by someone. They only compensate those who click the ams scam. FaceBook scam will not be compensated.

 

[cscs3]

U want to change pin everytime u use to reduce the possibility that it floats in the internet?

Dont think is pin issue alone. Bank system to prevent multiple transfer to same accout should be detected just like other banks.
Usually this is set to more verification is required if similar transaction is 3 or more.

 

[wira]

The last part not sure if true, but I happen to have same pin for both internet banking and ATM.
In any case, the safer way to move out till MAS step in to monitor their operation. Their call center is a key issue to these scam. The long delay really gives these scammer has lots of time to get more money out from your account.

By the way, confirmed by someone. They only compensate those who click the ams scam. FaceBook scam will not be compensated.

pretty sure can set internet banking pin to be different from atm pin .
in fact that should be a hygiene to set different pins.

i suspect most of the ocbc scam victimes internet banking pin and atm pin is the same , thats why fraudster only need to phish user id + pin + sms otp to setup the digital token since atm pin is same pin