Suggestions for adding security. Eg forced funds transfer or compromised account

johannes

Sander But that's the thing: They also block your card if you write them an email, even if it's not sent from yours! Because they must do that. It's not just the app and nothing else.

And I don't want a hotline for anything else, just for blocking a card.. an automatic hotline asking you for your linked number or card number + your birth date should be enough.... And it's just blocking your card, no other access.

Sander

Johannes 🇦🇺 But that's the thing: They also block your card if you write them an email, even if it's not sent from yours! Because they must do that. It's not just the app and nothing else.

I've never heard of that happening, and honestly, when that actually is how they work now, I think it's really really bad. There should be some minimal checks to see whether it's actually that user.

Johannes 🇦🇺 your birth date should be enough.

Basically anyone I know knows that info as well, it doesn't prove anything about my identity.

Dennis Of course I don't keep unreasonable large amounts on the accounts I use for my day to day stuff

This is exactly what I mean. I keep most of my money outside bunq, but my spending money is in there, divided over several IBANs, to change which IBAN to spend from you need to login into the app, which is sufficiently difficult even when having access to my phone. My cards are not linked to accounts with buffers or anything. So that way my loss would be negligible.

A hotline might be useful, maybe for deactivation only (not sure whether you are referring to actual blocking or deactivation now, I suppose the latter). but personally I wouldn't want someone to be able to deactivate my cards in such an easy way. But I guess we simply disagree on that part, so I will not continue discussing about that. 😜🙂

johannes

Dennis The hotline could be an automatic one, with no staff. Just call the Revolut or Curve hotline, they are the same. Just used for blocking cards with no extra staff.

LH-Black-Wolf

Sam 🇳🇱🇬🇧 No it is not a major security risk when programmed properly, and not any more risk than for example a phone running sideloaded apps or using an old Android version with vulnerabilities to do your Bunq business. If anything, a web portal can sometimes be way more secure than an app; both have pros and cons. Please don’t spread fear-mongering FUD about online banking safety. :)

Your replies are offering work-arounds and call it “common sense”, whilst in reality the common sense actually is there must be an easy way to block your cards if you get robbed. ;) “Separate them”, good luck with that if someone tells you to give your wallet and phone whilst waiving a knife or worse in front of your nose. Calling them out on common sense then that they should only really steal one of the two would likely make you end up with at least a broken nose if not worse and your wallet and phone still missing :P

I very much like the idea of a phone number that has an automated system. You could for example let it ask for a few things:
- accountnumber of main account
- day of birth
- social security number/TaxID/BSN
- Card expiration date
- A security code you can set in the app
If at least 3 of the 5 points match: block all cards.

Maybe there’s easier ways than the above info, but just to give an idea. This would only cost Bunq the one-time programming costs for a automated phone system and then it’s done.
But a web-portal would be nice as well. (In fact I’d like a complete online banking environment for Bunq.)

BigBoss

LvH I very much like the idea of a phone number that has an automated system. You could for example let it ask for a two things:

the last 6 digits of the card you can set in the app
A security code 8 digit you can set in the app

To temporarily block your cards and application.

This gives you time to contact bunq and reactivate your account with the hand scan or security phrase.

johannes

Sander Well, no need to have the same opinion.. bunq could give you an opt in / opt out option for this number :) if you are opt out your card can't get blocked with the number :)

Paul-Grey-Unicorn-386063522

I do think that my earlier mentioned idea with “trusted bunqers” and a shared secret or so also would work and fits within the philosophy of bunq. If I pre-assign max 4 trusted bunqers that can do the temporary blocking actions for me within a short timeframe, than after that I have time to get a new phone etc.

LH-Black-Wolf

PaulP 🇳🇱🇬🇧🇩🇪🇪🇺 That’s also a good idea! Not a shared secret perse, but a security code you set and then if you’re in trouble: you can call your trusted Bunq-er (can even be a free account), give them the code to enter in the app et voila!

That would perhaps be even better and more cost-effective than a phone number.

Paul-Grey-Unicorn-386063522

LvH Good idea. Just use a security code, no need for a shared secret indeed.

Robert-Silver-Turtle-4265395482

How often does one forget a security or pass code?

Robert-Silver-Turtle-4265395482

And if my phone is stolen then how am I going to call any one let alone remember a number to call when it’s all saved in my stolen phone?

Paul-Grey-Unicorn-386063522

Mr. Underwood good challenge. I personally as Apple user, can access my contact data via iCloud and a web browser. Phones are available in restaurants, hotels etc. Indeed a code needs to be remembered, but there are other secure options possible without using a code. E.g you need 2 different trusted bunqers to take the temporary block action instead (if you do not know the code anymore). What is your proposed solution for this problem, that some, not all, want a solution for?

LH-Black-Wolf

Mr. Underwood With billions of phones around the world, I’m sure you can find one :P Hotel/campsite, police station, borrow from a helpful person; whatever.

Well this phone number would of course be published on the Bunq website... No need to remember it. And in case of a function to assign this ability to other Bunq’ers: you just need to remember their phone # or emailaddress and a security code. I know the phone numbers of my best friends and direct family.

I think the ability to assign other Bunq’ers the ability to do it with a passcode you have to give them when there is a problem is easiest for Bunq to implement and very secure. (Bunq should probably ensure the code cannot be the same as your login code though.)

Robert-Silver-Turtle-4265395482

PaulP 🇳🇱🇬🇧🇩🇪🇪🇺 Two devices. I personally always have two and one is on me at all times. And I mean ALL times when I’m out and about. The other one is in my back pack. So should I loose my cards and one phone I can immediately permanently block the cards using my other phone.

JohnDo

It is a valid situation... although I think the chance that this ever happens is slim especially since you can take some precautionary measures yourself. I for once aways keep my phone close to me. And I don't put my wallet in the back pocket of my jeans. Just small things that can help.

If it does happen....
You can email bunq for instance.... with the Internet in the lobby of the hotel...
You can use the phone of your travel companion...

If the above isn't an option... well then you do have a problem. But how big is that problem really? What is the chance you card 💳 will actual be misused? And if it is misused, they would also have to have your pin code to be able to create some real impact.

And... lets say the manage to use your card for the total of €1000... I could argue that bunq can be held liable for that :)..

A phone number can be an idea 💡... I wonder if such solution won't cost bunq far more then the financial risk. Identification of a person on the phone is one of the most risky forms of identification. So I can imagine bunq doesn't wanna go down that road. On the other hand... bunq could accept the risk of not being able to be 99% sure... because a blocking service doesn't have financial transactions.

Paul-Grey-Unicorn-386063522

I think that if you walk with 2000 euro in your pocket in a risky part of Rio de Janeiro, and you are robbed, than people will say “that is not smart”. But if you walk there with your phone giving access to all your accounts (and accounts where you top-up from) and under force you have to give access to these funds...What will people say? I do expect from bunq to think about these use-cases and take measures to mitigate these type of risks. Remember in the past where we had the topic in the NL called “spookopnamen”. Money was taken off accounts using a card and a pincode. Banks in NL, for years took the position that it was the fault of the customers who were not carefull with their card and pincode. So they did not refund the damage. At the same time they must have known that magnetic strips can be skimmed. After many years they admitted that magnetic strips can be skimmed and started to refund, because their system offered to the customers was not secure by design. So let us not be naive and think upfront of use cases with a risk and demand bunq to think about mitigating measures.

Sander

PaulP 🇳🇱🇬🇧🇩🇪🇪🇺 But if you walk there with your phone giving access to all your accounts (and accounts where you top-up from) and under force you have to give access to these funds...What will people say?

This is the same for all banks, whether you have an account at bunq, ABN, Rabobank, or whatever. When they're forcing you to login/wire money then it's already too late. This is about when they steal your cards and being able to block them easily. What measures do you expect from a bank to mitigate this? How is bunq supposed to avoid that you can get a knife / gun used against you?

Paul-Grey-Unicorn-386063522

Sander E.g give me that ability to set timers delaying payments, or have a code that is a hidden emergency code and although will show a transfer is made in the app, in the background it is not made, lots of options are there. I would like to, by choice, sacrifice speed vs security. We are moving into a new situation where by force you can get access to a high amount of funds. So instead robbing from cash, go for the robbing via banking apps. So give choice for sacrificing a bit of user experience and raise security would be my plea. Similar to, when going out in Rio, do take limited cash and no golden watches with you. Same for my banking app. Raise security level when going out in Rio, when back home make it more user friendly but raising risk again. Give choice!!

Dennis

PaulP 🇳🇱🇬🇧🇩🇪🇪🇺 Bank of the free doesn't believe in choices. They believe in one way for everyone, regardless how tech savvy you are, or what your preferences are.

Paul-Grey-Unicorn-386063522

Dennis Aha, that must be related with bunq’s slogan “Freedom of choice”. :-)