3 ms·
Because some banks (Consorsbank for example), take this to an extreme and ask you to 2FA all the time for every login. I used to refresh several bank accounts
by WA 7y ago
Because some banks (Consorsbank for example), take this to an extreme and ask you to 2FA all the time for every login.
I used to refresh several bank accounts several times per day through a third party app (MoneyMoney) on the Mac. This worked pretty flawlessly until September.
Now, I have to take out my phone and 2FA all the things in three different apps.
Of course, partially, Consorsbank is to blame here, because they fucked this up. Other banks have more customer-friendly interpretations on how often you have to 2FA (like once per month).
Only thing I noticed: I used to automatically fetch transactions through a HBCI interface with the open source software AqBanking on a VPS. This doesn't work anymore, because you need to register this software somewhere. So not sure how this is connected to PSD2 exactly. I assume the requirements for HBCI got tightened.
- supermatt 7y agoDefinitely a problem with your bank(s). SCA is only required for high risk activities, such as payments (and even then, only if amount is over €30 or if you have transacted over €100 since last SCA). Balances and recent transactions are considered low-risk, so you shouldnt need to enter 2FA for "refreshing" your account balances, etc. The directive also states that a balance must be made between security and user experience. It seems your bank(s) ignored that part.
- campl3r 7y agoBut which bank doesn't? I have N26, DKB, 1822direkt and they all have gotten much worse. If I could, I would opt out.
- carstenhag 7y agoI have also used N26, ING and DKB, which are mostly the best/most modern banking experiences in Germany and can only confirm what you said.
- lxgr 7y agoNo, SCA also applies for account access. Banks are allowed (but not required!) to only require SCA once every 90 days. This is something where the technical regulation falls short, though. They (i.e. the EBA, which I believe specified the technical part of PSD2) could have specified some minimum usability requirements for delegated account access APIs. Having to do SMS-based 2FA every single time when using a third party client compared to being able to use Face ID for the bank's native app is probably not really the intended outcome, but the reality for my two main bank accounts.
- supermatt 7y agoYes, I am aware that you need to re-authenticate every 90 days. My comment was specifically in response to GP being requested for SCA multiple times per day to refresh their accounts.