5 ms·

I envy the OP. Unfortunately since September 2019 living without SIM card became (practically) illegal in EU. > most online payments above €30 to go through an

by chewz 7y ago

I envy the OP. Unfortunately since September 2019 living without SIM card became (practically) illegal in EU. > most online payments above €30 to go through an extra level of verification such as entering a code received via a text message. [2] Most banks unwisely chosen SMS as Strong Customer Authentication providing little choice to customers. https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] https://www.paypal.com/uk/webapps/mpp/psd2 https://www.paypal.com/uk/webapps/mpp/psd2

dangus 7y ago
Unless you summarize the law we don't know what you mean by "practically illegal." When you say "practically illegal" I can only assume you mean "not illegal."
- chewz 7y ago
  I have edited my answer. Most institutions I know have chosen SMS for Strong Customer Authentication which means sooner or later you in practical life will need your personal SIM card (banking, doctor visit, e-prescription, e-government etc.). Unless you chose to live off the grid for real.
  - dangus 7y ago
    But also, I think you have that situation understood the other way around. SMS was chosen because everyone has it already. So it's not a matter of being forced to have it, it's a matter of "all other alternatives are less widespread." I think there are actually more people globally with access to mobile phones than people who have access to basic sanitation, i.e. flushing toilets. I'm sure that many or most of those organizations have alternative, non-electronic means of interaction - such as phone, paper (writing checks), or in-person. That is the alternative to using a SIM card.
    - chewz 7y ago
      Yes but situation before September was that I could use my account without SIM card. Now access to my account requires having a SIM card and a phone. Now imagine taking all my six SIM cards on vacation to Thailand just because you may be in need to urgently use one of my multiple bank or brokerage accounts ;-)
      - ddalex 7y ago
        So you're complaining of having to use a SIM while you have 6 SIMs?
        chewz 7y ago
        I am not yet ready to become a hermit. But when I do I would rather live without a phone then without phone and a bank account. :-)
  - thefounder 7y ago
    sms is not PSD2 compliant which means it can't be used as SCA method https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...
    - fulafel 7y ago
      This article summarizes a document that's titled "opinion". As long as there is no definite legal outlawing of SMS, many banks will continue to use it.
      - thefounder 7y ago
        Well the document provided is an opinion on the implementation and further clarifies the specifications. It clears states that SMS is not PSD2 compliant. Banks found in breach will be forced to comply. I think is more a banking license issue than a "legality" issue. >> To fulfil its statutory objective of contributing to supervisory convergence in the EU/European Economic Area (EEA), and to do so in the specific context of the RTS, the EBA is issuing a further opinion with a view to responding to the large number of queries that the EBA and national competent authorities (CAs) have received from market participants on SCA and, in particular, on what procedure or combination of authentication elements may or may not constitute SCA
- matthewheath 7y ago
  They're referring to the Revised Directive on Payment Services ("PSD2") passed by the European Union which imposes a requirement to use "Strong Customer Authentication" for certain financial transactions (online or contactless) to reduce fraud, among other things. When you make a payment over a certain size, you're required to verify that it's you making the payment. It's 2FA for payments essentially, you enter the code sent by SMS or you tap the approval button in your banking app, or enter your PIN again for contactless transactions. It seems a lot of payment institutions have allegedly implemented SMS verification for these transactions. I bank with Monzo (https://monzo.com https://monzo.com) which offers an approval notification in their app. Unless you switch to a "challenger" bank like Monzo, you're going to be getting SMS to verify transactions (otherwise the transaction won't go through) and while I consider it hyperbole to mark this as "practically illegal", it does make things rather difficult for those with no phone or SIM card.
  - thefounder 7y ago
    SMS is not PSD2 compliant. https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...
    - superwayne 7y ago
      That is probably wrong in this generality because it is used by ING, at least.
thefounder 7y ago
Don't blame the EU just yet. 1. EU didn't force the banks to use SMS 2. EU is aware of the privacy/security issue of SMS and is planning to actually ban using SMS otp as a form of strong auth https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...
- chewz 7y ago
  I wasn't blaming EU (I am not in a habit of bashing EU) and I am not saying this is completely bad law. I am just observing the reality on the ground.
  - thefounder 7y ago
    My point was really that the banks will be forced (by EU)to drop sms as SCA anyway. Legislation for that to happen is already in place.
  - hsitz 7y ago
    As I understand your point it has absolutely nothing to do with it being illegal to not have a SIM card. Your point is simply that it is impractical not to have a SIM card because that makes it difficult to do bank transactions. Big difference, and using 'illegal' in this context is highly misleading.
    - derefr 7y ago
      I think the implication is that if you wanted to function without a SIM card, your only way to do that would involve eschewing all above-board fiscal infrastructure and working with the grey/black market instead. It's like being an outlaw, or a member of an untouchable caste: sure, you could just hide in a hole forever and wouldn't be breaking any laws, but in order to do anything you'd have to do it in a way that breaks a law.
      - ryanlol 7y ago
        But that’s just not true.
tracnar 7y ago
Most banks use their own card reader which you can use to authorize/sign a payment, I never had to use SMS for this.
- makruiten 7y ago
  And some banks (ING, bunq, but also others) don’t require anything else than just the mobile app, using either a pincode or biometric validation through your mobile OS. That’s way more practical, because you don’t need to have a reader in your pocket in order to do payments.
  - Freak_NL 7y ago
    Except that you are now required to get into an agreement with Apple or Google for use of their app-stores (banks don't offer alternatives to that route). Bunq is also a troubling development, because it is the first Dutch bank to require the use of their app, offering no alternative authentication methods (like the larger banks do). If they are allowed to do that, then what is stopping the other banks besides good customer service? ING is already notorious for having waited as long as possible before offering an alternative to their app to users of their former outdated numbered one-time code system.
detaro 7y ago
Where are you? Here in Germany, most banks do not require SMS (many have phased out SMS entirely).
- chewz 7y ago
  In Poland most banks I use (Citibank, Santander, Millenium and others) require confirming logging into account via SMS at least once in two weeks. Some require confirmation via mobile app. (That wasn't obligatory before) Its rather that banks have phased out other methods like tokens as too expensive and troublesome. https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-zmieniaja-sposob-logowania-od-14-wrzesnia-6423252403078785a.html https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-... https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku.html https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku...
  - detaro 7y ago
    Even according to these articles, most support an app-based solution that doesn't require a phone number?
    - chewz 7y ago
      This isn't so. Yes you can use banking app but this might be even worse for privacy. It depends a lot on implementation details of the app. For example Santander app won't even start without permission to manage you phone on Android.
Joeri 7y ago
Banks in the US and EU are required to have the identity on file for all bank accounts (ostensibly to combat terrorism), so sharing your phone number with them shouldn’t change the level of privacy. If it is cost people are worried about they can get a prepaid card and never use it except to receive sms. That’s effectively free. Combined with the push to get rid of anonymous accounts and phone numbers there has also been a push to get rid of cash. I expect to see a time in my lifetime where a country will fully do away with all anonymous forms of payment, effectively making it impossible to be anonymous.
- lotsofpulp 7y ago
  Since the inevitable conclusion is impossibility of being anonymous, I think we should push to ensure full transparency for all. Otherwise, it ends badly for those not in power.
  - jhallenworld 7y ago
    This was John Brunner's solution in Shockwave Rider. So does it work for preventing scammers and telemarketers? I guess it does since you would know who is calling you.
    - funnybeam 7y ago
      The problem with this is the asymmetry of power relationships - if everything is transparent it is very easy for a powerful group to use that against an individual but much harder the other way around
      - lotsofpulp 7y ago
        That’s happening anyway with non transparency. At least with transparency, it can be known, and perhaps acted on.
      - hilbert42 7y ago
        Exactly. QED.
fulafel 7y ago
Be careful what you wish for. Probably if banks are forbidden from using SMS they'll force you to use a mobile app on your Google mobile implant. (And the app will refuse to run if you have root on the phone, facilitated by strong DRM mechanisms)
Freak_NL 7y ago
All but one Dutch bank (newcomer Bunq) offer authentication methods that do not rely on owning a smartphone. Most often this takes the form of a complimentary card reader that uses your debit card as a hardware private key to generate OTP codes. Most banks do try very hard to push you to use their Android or IOS app though. I agree that it is becoming increasingly hard to exist without either an Android or IOS smartphone. The Dutch government is mandating the use of a stronger level of authentication to access your personal medical data. Currently, the only system that meets this standard is the government Android or IOS app. An alternative is being considered that allows people to use an NFC-reader on any modern computing platform with a suitable driver's licence or ID-card, but this won't be available to every citizen until 2029 due to the renewal cycle of these government issued cards. But even then I can't escape a certain sense of complacency with the government branch developing these techniques; they really seem to want everyone to either get an Android or IOS smartphone, or authorize a relative or friend to manage your digital affairs on your behalf. This latter option is of course geared towards the elderly and the digitally encumbered. It was possible to participate digitally as citizen in the age of the personal computer even if you didn't get Windows or Mac OS X, but in the smartphone era this freedom does not seem to exist for much longer.
- huseyinkeles 7y ago
  ABN Amro (and I think many others as well) send you an e-identifier device and allows you to make online iDeal payments with those devices.
  - Freak_NL 7y ago
    Well yes, all but one Dutch bank offer valid and secure alternatives, including ABN Amro. ABN also keeps nudging you about using their app instead at every turn (I'm a customer). Although our own government really takes the cake in terms of 'gently nudging' people to use their app for authentication: https://twitter.com/jdhoek/status/1214969536333651968 https://twitter.com/jdhoek/status/1214969536333651968 (in Dutch, but with screenshots illustrating the 'nudging')
    - 7y ago
zimbatm 7y ago
One thing I did is to use Twillio to get a mobile phone number (5.-/mo) and forward the SMS to email or whatever. It works pretty well and was easy to setup. One big advantage is that number-porting attacks are much harder to pull-off with them as they have better security than most phone companies. One downside is that the SMS must come from the same country. It's a weird limitation of their platform.
microtheo 7y ago
I live in Germany, and while I need a smartphone to get the code for my online banking access, it doesn’t require a SIM card or a phone number.
- kome 7y ago
  that's not much better tho.
t0astbread 7y ago
Most banks in Austria mandate their own proprietary push-TAN apps and don't support SMS as a second factor. Depending on your POV this could be better or worse.

by chewz 7y ago

dangus 7y ago

Unless you summarize the law we don't know what you mean by "practically illegal." When you say "practically illegal" I can only assume you mean "not illegal."

chewz 7y ago
I have edited my answer. Most institutions I know have chosen SMS for Strong Customer Authentication which means sooner or later you in practical life will need your personal SIM card (banking, doctor visit, e-prescription, e-government etc.). Unless you chose to live off the grid for real.
- dangus 7y ago
  But also, I think you have that situation understood the other way around. SMS was chosen because everyone has it already. So it's not a matter of being forced to have it, it's a matter of "all other alternatives are less widespread." I think there are actually more people globally with access to mobile phones than people who have access to basic sanitation, i.e. flushing toilets. I'm sure that many or most of those organizations have alternative, non-electronic means of interaction - such as phone, paper (writing checks), or in-person. That is the alternative to using a SIM card.
  - chewz 7y ago
    Yes but situation before September was that I could use my account without SIM card. Now access to my account requires having a SIM card and a phone. Now imagine taking all my six SIM cards on vacation to Thailand just because you may be in need to urgently use one of my multiple bank or brokerage accounts ;-)
    - ddalex 7y ago
      So you're complaining of having to use a SIM while you have 6 SIMs?
      - chewz 7y ago
        I am not yet ready to become a hermit. But when I do I would rather live without a phone then without phone and a bank account. :-)
- thefounder 7y ago
  sms is not PSD2 compliant which means it can't be used as SCA method https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...
  - fulafel 7y ago
    This article summarizes a document that's titled "opinion". As long as there is no definite legal outlawing of SMS, many banks will continue to use it.
    - thefounder 7y ago
      Well the document provided is an opinion on the implementation and further clarifies the specifications. It clears states that SMS is not PSD2 compliant. Banks found in breach will be forced to comply. I think is more a banking license issue than a "legality" issue. >> To fulfil its statutory objective of contributing to supervisory convergence in the EU/European Economic Area (EEA), and to do so in the specific context of the RTS, the EBA is issuing a further opinion with a view to responding to the large number of queries that the EBA and national competent authorities (CAs) have received from market participants on SCA and, in particular, on what procedure or combination of authentication elements may or may not constitute SCA
matthewheath 7y ago
They're referring to the Revised Directive on Payment Services ("PSD2") passed by the European Union which imposes a requirement to use "Strong Customer Authentication" for certain financial transactions (online or contactless) to reduce fraud, among other things. When you make a payment over a certain size, you're required to verify that it's you making the payment. It's 2FA for payments essentially, you enter the code sent by SMS or you tap the approval button in your banking app, or enter your PIN again for contactless transactions. It seems a lot of payment institutions have allegedly implemented SMS verification for these transactions. I bank with Monzo (https://monzo.com https://monzo.com) which offers an approval notification in their app. Unless you switch to a "challenger" bank like Monzo, you're going to be getting SMS to verify transactions (otherwise the transaction won't go through) and while I consider it hyperbole to mark this as "practically illegal", it does make things rather difficult for those with no phone or SIM card.
- thefounder 7y ago
  SMS is not PSD2 compliant. https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...
  - superwayne 7y ago
    That is probably wrong in this generality because it is used by ING, at least.

thefounder 7y ago

Don't blame the EU just yet. 1. EU didn't force the banks to use SMS 2. EU is aware of the privacy/security issue of SMS and is planning to actually ban using SMS otp as a form of strong auth https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/ https://www.zdnet.com/article/german-banks-are-moving-away-f...

chewz 7y ago
I wasn't blaming EU (I am not in a habit of bashing EU) and I am not saying this is completely bad law. I am just observing the reality on the ground.
- thefounder 7y ago
  My point was really that the banks will be forced (by EU)to drop sms as SCA anyway. Legislation for that to happen is already in place.
- hsitz 7y ago
  As I understand your point it has absolutely nothing to do with it being illegal to not have a SIM card. Your point is simply that it is impractical not to have a SIM card because that makes it difficult to do bank transactions. Big difference, and using 'illegal' in this context is highly misleading.
  - derefr 7y ago
    I think the implication is that if you wanted to function without a SIM card, your only way to do that would involve eschewing all above-board fiscal infrastructure and working with the grey/black market instead. It's like being an outlaw, or a member of an untouchable caste: sure, you could just hide in a hole forever and wouldn't be breaking any laws, but in order to do anything you'd have to do it in a way that breaks a law.
    - ryanlol 7y ago
      But that’s just not true.

tracnar 7y ago

Most banks use their own card reader which you can use to authorize/sign a payment, I never had to use SMS for this.

makruiten 7y ago
And some banks (ING, bunq, but also others) don’t require anything else than just the mobile app, using either a pincode or biometric validation through your mobile OS. That’s way more practical, because you don’t need to have a reader in your pocket in order to do payments.
- Freak_NL 7y ago
  Except that you are now required to get into an agreement with Apple or Google for use of their app-stores (banks don't offer alternatives to that route). Bunq is also a troubling development, because it is the first Dutch bank to require the use of their app, offering no alternative authentication methods (like the larger banks do). If they are allowed to do that, then what is stopping the other banks besides good customer service? ING is already notorious for having waited as long as possible before offering an alternative to their app to users of their former outdated numbered one-time code system.

detaro 7y ago

Where are you? Here in Germany, most banks do not require SMS (many have phased out SMS entirely).

chewz 7y ago
In Poland most banks I use (Citibank, Santander, Millenium and others) require confirming logging into account via SMS at least once in two weeks. Some require confirmation via mobile app. (That wasn't obligatory before) Its rather that banks have phased out other methods like tokens as too expensive and troublesome. https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-zmieniaja-sposob-logowania-od-14-wrzesnia-6423252403078785a.html https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-... https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku.html https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku...
- detaro 7y ago
  Even according to these articles, most support an app-based solution that doesn't require a phone number?
  - chewz 7y ago
    This isn't so. Yes you can use banking app but this might be even worse for privacy. It depends a lot on implementation details of the app. For example Santander app won't even start without permission to manage you phone on Android.

Joeri 7y ago

Banks in the US and EU are required to have the identity on file for all bank accounts (ostensibly to combat terrorism), so sharing your phone number with them shouldn’t change the level of privacy. If it is cost people are worried about they can get a prepaid card and never use it except to receive sms. That’s effectively free. Combined with the push to get rid of anonymous accounts and phone numbers there has also been a push to get rid of cash. I expect to see a time in my lifetime where a country will fully do away with all anonymous forms of payment, effectively making it impossible to be anonymous.

lotsofpulp 7y ago
Since the inevitable conclusion is impossibility of being anonymous, I think we should push to ensure full transparency for all. Otherwise, it ends badly for those not in power.
- jhallenworld 7y ago
  This was John Brunner's solution in Shockwave Rider. So does it work for preventing scammers and telemarketers? I guess it does since you would know who is calling you.
  - funnybeam 7y ago
    The problem with this is the asymmetry of power relationships - if everything is transparent it is very easy for a powerful group to use that against an individual but much harder the other way around
    - lotsofpulp 7y ago
      That’s happening anyway with non transparency. At least with transparency, it can be known, and perhaps acted on.
    - hilbert42 7y ago
      Exactly. QED.

fulafel 7y ago

Be careful what you wish for. Probably if banks are forbidden from using SMS they'll force you to use a mobile app on your Google mobile implant. (And the app will refuse to run if you have root on the phone, facilitated by strong DRM mechanisms)

Freak_NL 7y ago

All but one Dutch bank (newcomer Bunq) offer authentication methods that do not rely on owning a smartphone. Most often this takes the form of a complimentary card reader that uses your debit card as a hardware private key to generate OTP codes. Most banks do try very hard to push you to use their Android or IOS app though. I agree that it is becoming increasingly hard to exist without either an Android or IOS smartphone. The Dutch government is mandating the use of a stronger level of authentication to access your personal medical data. Currently, the only system that meets this standard is the government Android or IOS app. An alternative is being considered that allows people to use an NFC-reader on any modern computing platform with a suitable driver's licence or ID-card, but this won't be available to every citizen until 2029 due to the renewal cycle of these government issued cards. But even then I can't escape a certain sense of complacency with the government branch developing these techniques; they really seem to want everyone to either get an Android or IOS smartphone, or authorize a relative or friend to manage your digital affairs on your behalf. This latter option is of course geared towards the elderly and the digitally encumbered. It was possible to participate digitally as citizen in the age of the personal computer even if you didn't get Windows or Mac OS X, but in the smartphone era this freedom does not seem to exist for much longer.

huseyinkeles 7y ago
ABN Amro (and I think many others as well) send you an e-identifier device and allows you to make online iDeal payments with those devices.
- Freak_NL 7y ago
  Well yes, all but one Dutch bank offer valid and secure alternatives, including ABN Amro. ABN also keeps nudging you about using their app instead at every turn (I'm a customer). Although our own government really takes the cake in terms of 'gently nudging' people to use their app for authentication: https://twitter.com/jdhoek/status/1214969536333651968 https://twitter.com/jdhoek/status/1214969536333651968 (in Dutch, but with screenshots illustrating the 'nudging')
  - 7y ago

zimbatm 7y ago

One thing I did is to use Twillio to get a mobile phone number (5.-/mo) and forward the SMS to email or whatever. It works pretty well and was easy to setup. One big advantage is that number-porting attacks are much harder to pull-off with them as they have better security than most phone companies. One downside is that the SMS must come from the same country. It's a weird limitation of their platform.

microtheo 7y ago

I live in Germany, and while I need a smartphone to get the code for my online banking access, it doesn’t require a SIM card or a phone number.

kome 7y ago
that's not much better tho.

t0astbread 7y ago

Most banks in Austria mandate their own proprietary push-TAN apps and don't support SMS as a second factor. Depending on your POV this could be better or worse.