13 ms·

We should really add 2FA to cards. E.g. if I withdraw a large sum or make an unusual transaction prompt for a 2FA code. For small transactions it makes no sens

We should really add 2FA to cards. E.g. if I withdraw a large sum or make an unusual transaction prompt for a 2FA code. For small transactions it makes no sense, but for anything above a user defined limit we should have this option. e.g. I only withdraw more than £50 in unusual circumstances.

kowdermeister 8y ago
In my bank you can set a daily withdraw limit and if you need more, simply increase it online for a temporary time frame.
mehrdadn 8y ago
I imagine ordinary 2FA probably wouldn't work... the timeout would have to be too long. But I don't see why 2-factor pre-authentication shouldn't work? Before purchasing, just authorize a larger charge on your card than a limit you or your bank previously set. If it works, then great. Worst case is it doesn't work (app breaks, phone out of juice, whatever), in which case you're back to the current situation.
- peteretep 8y ago
  > I imagine ordinary 2FA probably wouldn't work. I don't know what you mean by "ordinary" 2FA, but it's pretty common in Thailand when making online payments to have an SMS sent to you, and in the UK my Amex card has been known to require SMS/email codes for online purchases.
chupasaurus 8y ago
My bank has a user-defined limit after which transactions must be authorized either by phone call or in web or mobile app (or by visting a bank office in person), all the ways are equal. The thing is that the lower bound for that feature is ≈$300.
CPLX 8y ago
Cards are 2FA already. You’re advocating for a third factor.
- fabricexpert 8y ago
  No they're not - the card is the identity, the PIN is the first factor.
  - peteretep 8y ago
    This is untrue of cards with chips.
    - fabricexpert 8y ago
      Sort of - for chip readers that don't have a magnetic swipe on them, yes. However all cards have enough info in the magnetic strip to validate transactions, so if your card ever goes in card reader with a magnetic swipe reader that is compromised it's not a proper factor.
      - close04 8y ago
        If the "something you have" part of 2FA can be replicated then it's not 2FA. So you need a "something you know" (password, PIN, etc.) and a "something you have" (a phone app authorization, a card that cannot be replicated, etc.). This excludes anything with a magnetic strip from being any part of the 2FA scheme.
gambiting 8y ago
In EU all banks have to implement 3D Card Secure - when making an online payment over a certain amount, or of an unusual type the vendors website redirects you to your bank's website where you have to authenticate the payment(usually provide an SMS code or answer some security questions).
- thesimon 8y ago
  >or answer some security questions Will be phased out soon due to regulation (PSD2) as it doesn't meet the requirement for 2 factors. Some banks also allow you to confirm the transaction inside their mobile app, which is pretty convenient.
- anewhnaccount2 8y ago
  In Finland you get a tiny card filled with single use pin codes. It's pretty secure. Unfortunately, if your card is skimmed, the scammers will just -- for example -- associate it with an Uber account and sell the account. Because non-EU companies don't use 3D-secure there's nothing stopping them. I have tried asking for non 3D-secure transactions to be blocked, (I believe when a vendor doesn't offer it I can always find an alternative) but no such luck. (Obviously you can get the money back, but I'd like to avoid the inconvenience and the fact the scammers get money for nothing.)
  - Mediterraneo10 8y ago
    > In Finland you get a tiny card filled with single use pin codes. It's pretty secure. Nordea Bank Finland ceased providing code cards earlier this year. Logging on to online banking even warns that the code card you already have may stop working soon. Everything has moved to the mobile app or, available as a special order for the elderly and luddites, an electronic keypad.
- rootusrootus 8y ago
  SMS, yuck. Something else we need to get past, and banks are so slow in embracing new security technologies.
deleted 8y ago
[deleted]
cascom 8y ago
Are you liable for unauthorized withdrawals? Here in the US the bank is usually liable - so while it can be an administrative headache - from a customer perspective 2FA seems like a pain

kowdermeister 8y ago

In my bank you can set a daily withdraw limit and if you need more, simply increase it online for a temporary time frame.

mehrdadn 8y ago

I imagine ordinary 2FA probably wouldn't work... the timeout would have to be too long. But I don't see why 2-factor pre-authentication shouldn't work? Before purchasing, just authorize a larger charge on your card than a limit you or your bank previously set. If it works, then great. Worst case is it doesn't work (app breaks, phone out of juice, whatever), in which case you're back to the current situation.

peteretep 8y ago
> I imagine ordinary 2FA probably wouldn't work. I don't know what you mean by "ordinary" 2FA, but it's pretty common in Thailand when making online payments to have an SMS sent to you, and in the UK my Amex card has been known to require SMS/email codes for online purchases.

chupasaurus 8y ago

My bank has a user-defined limit after which transactions must be authorized either by phone call or in web or mobile app (or by visting a bank office in person), all the ways are equal. The thing is that the lower bound for that feature is ≈$300.

CPLX 8y ago

Cards are 2FA already. You’re advocating for a third factor.

fabricexpert 8y ago
No they're not - the card is the identity, the PIN is the first factor.
- peteretep 8y ago
  This is untrue of cards with chips.
  - fabricexpert 8y ago
    Sort of - for chip readers that don't have a magnetic swipe on them, yes. However all cards have enough info in the magnetic strip to validate transactions, so if your card ever goes in card reader with a magnetic swipe reader that is compromised it's not a proper factor.
    - close04 8y ago
      If the "something you have" part of 2FA can be replicated then it's not 2FA. So you need a "something you know" (password, PIN, etc.) and a "something you have" (a phone app authorization, a card that cannot be replicated, etc.). This excludes anything with a magnetic strip from being any part of the 2FA scheme.

gambiting 8y ago

In EU all banks have to implement 3D Card Secure - when making an online payment over a certain amount, or of an unusual type the vendors website redirects you to your bank's website where you have to authenticate the payment(usually provide an SMS code or answer some security questions).

thesimon 8y ago
>or answer some security questions Will be phased out soon due to regulation (PSD2) as it doesn't meet the requirement for 2 factors. Some banks also allow you to confirm the transaction inside their mobile app, which is pretty convenient.
anewhnaccount2 8y ago
In Finland you get a tiny card filled with single use pin codes. It's pretty secure. Unfortunately, if your card is skimmed, the scammers will just -- for example -- associate it with an Uber account and sell the account. Because non-EU companies don't use 3D-secure there's nothing stopping them. I have tried asking for non 3D-secure transactions to be blocked, (I believe when a vendor doesn't offer it I can always find an alternative) but no such luck. (Obviously you can get the money back, but I'd like to avoid the inconvenience and the fact the scammers get money for nothing.)
- Mediterraneo10 8y ago
  > In Finland you get a tiny card filled with single use pin codes. It's pretty secure. Nordea Bank Finland ceased providing code cards earlier this year. Logging on to online banking even warns that the code card you already have may stop working soon. Everything has moved to the mobile app or, available as a special order for the elderly and luddites, an electronic keypad.
rootusrootus 8y ago
SMS, yuck. Something else we need to get past, and banks are so slow in embracing new security technologies.

deleted 8y ago

[deleted]

cascom 8y ago

Are you liable for unauthorized withdrawals? Here in the US the bank is usually liable - so while it can be an administrative headache - from a customer perspective 2FA seems like a pain