-3

For environmental and financial reasons I have always used second hand or grey market mobile telephones. For work purposes I have general purpose computer kept as secure as possible, purchased new and running only trusted open source software, including GPG for secure communications. I maintain my security by partitioning my use, the mobile phone is only used for tasks where security is not required, and my computer for tasks where it is. This has served me well for the last 25 years, but recently my bank has been relying more and more on my telephone as a secure from of communication. I am concerned that in the case of a security breach caused by my phone being compromised I could be considered at fault and so lose money.

One thing I could do would be to inform my bank of the risk as I see it in a provable way (email, recorded delivery letter), and perhaps advise that secure information can be sent by PGP encrypted email. I have no expectation that they will change their behaviour, but I would hope that in the case of a breach I did what I could to inform the bank, so am less responsible and so have more chance of getting any lost money returned to me. However it is conceivable that it would have the opposite effect, of proving that I knew of the risk and so am more responsible and have less chance of return of the money.

In such a situation what is the best course of action? Are there any past events that could guide the decision? Is there an accepted solution to modern banking without a secure mobile telephone?

Improve this question
5
  • 3
    You may be able to get better responses on security.stackexchange.com [not sure if this is precisely on-topic there]. Your plan of warning the bank in advance doesn't sound likely to offer you any protection.
    – Grade 'Eh' Bacon
    Commented Jan 20, 2022 at 13:38
  • When you say "my bank has been relying more and more on my telephone as a secure from of communication" do you mean sending verification codes by text, or something else?
    – DJClayworth
    Commented Jan 20, 2022 at 14:14
  • @DJClayworth Those verification codes are a vulnerability, the other obvious one is robo calls about unexpected transactions.
    – User65535
    Commented Jan 20, 2022 at 14:22
  • Do the bank's term not state that you have to keep your phone recent?
    – Bernhard Döbler
    Commented Jan 20, 2022 at 21:23
  • @BernhardDöbler No, that is not something that UK banks require in their terms. Of course, they may enforce such a constraint indirectly by designing their apps to only run on sufficiently new hardware/software.
    – Jivan Pal
    Commented May 30, 2022 at 15:12

2 Answers 2

Reset to default
4

Every bank I have dealt with has allowed me to choose the way they communicate with me, especially for things like verification codes and fraudulent transaction warnings. Usually I am offered the choice of email, text message or phone call.

If you believe that one of these methods is going to be insecure, then do not choose it. Use one of the others instead.

The phone call option is the one least susceptible to hacking. Phone numbers can be redirected to another phone, but doing so doesn't depend on having access to the phone - meaning it works just as well for a brand new secure phone as an old 'grey-market' phone, so you are not at any disadvantage compared to other users. Doing so usually requires a SIM clone or a SIM change.

Since you have the choice of communication methods, warning the bank that you have chosen an insecure one will make no difference. It's your responsibility to chose one with adequate security.

Improve this answer
9
  • 1
    I have asked back when security checks on questionable transactions were done by a human, and they insisted that email was not secure enough and contact by telephone was the only option. I guess the solution may be to change banks.
    – User65535
    Commented Jan 20, 2022 at 14:49
  • 2
    Actually phone number hijacking is a real problem. The OPs concern is not unwarranted (albeit IMHO quite extreme). us.norton.com/…
    – littleadv
    Commented Jan 20, 2022 at 16:38
  • @littleadv I agree, and I say so in the answer.
    – DJClayworth
    Commented Jan 20, 2022 at 17:10
  • 3
    @User65535 with banks increasingly using 2 factor authentication for large transactions, you are unlikely to find any UK bank that doesn't require it. You can remove contact details that you consider unsafe, but if you remove too many, and your bank can't contact you, then they will block whatever transaction you are trying to make.
    – Simon B
    Commented Jan 20, 2022 at 19:33
  • 1
    @JivanPal What I meant was "just because you install GPG that doesn't make received messages more secure. It needs the sender to encrypt their messages.
    – DJClayworth
    Commented May 30, 2022 at 15:41
0

Just use the same security model you are already using. Second device.

(remember, "trying to have only one device" is what got Hillary Clinton in trouble.)

How to avoid the cost of 2 cell phone plans? Tablet.

Get a secure TABLET with a popular phone OS, that supports cellular data. Don't screw with it or jailbreak it. The beauty of tablets (unlike phones) is low-tier "pay as you go" cellular data plans are dirt cheap. I used to pay $25 per 3 months, now I pay $10 per 5 months).

Why do you need a cellular data plan? Why not just a WiFi-only tablet and either cafe-hop or tether it to your phone? Because, bank apps look to the device for certain data that is only available from a cellular data modem which is active - such as assisted GPS.

Here's another option for you to consider: Flip it. Have your phone be the platform you do not tamper with, and your tablet be the hack platform. Or a second phone that you do not buy a plan for and just tether.

Improve this answer
2
  • 1
    I tried to make the question clear, I am trying to avoid the responsibility for the environmental harm caused by the large amount of mobile devices created these days by using second hand devices (as well as the expense of always having one). This precludes having a secure tablet. I need a secure general purpose computer for work.
    – User65535
    Commented Jan 24, 2022 at 12:20
  • @User65535 I don't see a problem there, given the deranged tempo of phone replacement that is enculturated into society. You can't make 2 billion people behave sensibly, but you can catch one 1-2 year old discarded phone or tablet and save it from a landfill. And when they're that new, they still support 4G, which will be supported for awhile. There will always be more usable devices than people.
    – Harper - Reinstate Monica
    Commented Jan 24, 2022 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .