I'm not really sure the addition of AI changes all that much here. It sounds like the bypass the author used would have been possible using conventional methods

I'm not really sure the addition of AI changes all that much here. It sounds like the bypass the author used would have been possible using conventional methods. But if AI draws attention to the horrendous practice of biometric authentication, I'm all for it and I hope that more reporters start asking similar questions about bank security. This article focuses specifically on UK security, and I'm not sure what the situation is over there, but in the US digital security around banks is pretty awful. I looked around a while back trying to find an online consumer bank with good reviews that offered 2-factor authentication (real 2-factor authentication, not just SMS). I couldn't find a single one[0]. At best, a couple of banks mentioned that they had their own proprietary authentication apps that I could install. None of them had basic OTP support for something like AndOTP. I had to fight with my bank for multiple days before I got them to allow me to set up a passcode that they would use to identify me when I called, rather than just relying on basic information that was all made public in the Equifax leak. To their credit, they do actually ask me, but I still wonder if someone tried to impersonate me, would they actually block access or would they bend as soon as the person made a fuss about not knowing the code? That the response to this from the banks involved is immediately "well, it's just an extra layer, we're getting better and better" -- it's infuriating to read. It's an industry that is not just behind on security, it's actively hostile to people pointing out that it's behind on security. I guess it should make me feel better that apparently it's not just a US-specific problem? I'm not sure it does though. ---- [0]: Sidenote, if anyone has any good suggestions here, I'd be all ears. I get regularly annoyed at how bad my bank is with notifications around payments, card usage, etc... and how it seems to be both antagonistic to actual security measures like 2FA and in love with security theater like blocking VPN access.