Path: ...!feeder1.cambriumusenet.nl!feed.tweak.nl!217.73.144.44.MISMATCH!feeder.ecngs.de!ecngs!feeder2.ecngs.de!168.119.53.7.MISMATCH!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Richmond <dnomhcir@gmx.com>
Newsgroups: comp.mobile.android
Subject: Re: Codes sent by text message
Date: Wed, 13 Mar 2024 15:07:34 +0000
Organization: Frantic
Message-ID: <8634sumaq1.fsf@example.com>
References: <ush35k$2791b$1@dont-email.me> <usid1f$2fqif$1@dont-email.me>
	<su6vbkx86o.ln2@Telcontar.valinor> <usj60d$2odtf$1@dont-email.me>
	<eaovbkx207.ln2@Telcontar.valinor> <uskdq1$30533$1@dont-email.me>
	<ehs1ckx25o.ln2@Telcontar.valinor> <uslrfo$3d85i$1@dont-email.me>
	<slrnuuufkq.2dnu.trepidation@vps.jonz.net>
	<uso5sl$3t2g9$1@dont-email.me> <usogor$2qg7$1@dont-email.me>
	<uspj7v$9u60$1@dont-email.me> <dh16ckxstg.ln2@Telcontar.valinor>
	<usrndh$rpu8$1@dont-email.me> <86r0gemqum.fsf@example.com>
	<uss3b6$ub45$1@dont-email.me> <86edcemcoc.fsf@example.com>
	<klq8ckxnct.ln2@Telcontar.valinor>
MIME-Version: 1.0
Content-Type: text/plain
Injection-Info: solani.org;
	logging-data="1395477"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
Cancel-Lock: sha1:jSyV9/d0qTLej0KGmmQbF7v6jmM= sha1:OAElzLoY8LQ0E7jAtufACdKOsBY=
X-User-ID: eJwNwokRwDAIA7CZQjCQccy3/wjtSbh2rFwNptjf+DARhBBs5vSDRR+/5n25L6tCUlZy2foBODsSUg==
Bytes: 3651
Lines: 47

"Carlos E.R." <robin_listas@es.invalid> writes:

> On 2024-03-13 15:25, Richmond wrote:
>> "Newyana2" <Newyana2@invalid.nospam> writes:
>> 
>>> "Richmond" <dnomhcir@gmx.com> wrote
>
>
>>>
>>>    I avoid any online banking. I can still walk and drive. Social
>>> security is auto-deposited. I just don't need online banking, so
>>> there's no sense risking it. I've also locked my credit. In the US
>>> one can contact 3 credit reporting agencies, establish a lock, and
>>> from then on no credit cards can be issued. If you need a new credit
>>> card, you unlock it temporarily. That method also provides a great
>>> excuse for pushy store clerks who want me to sign up for their store
>>> card. "Oh, I'd love to, but I have my credit locked. Haven't you
>>> done that yourself?"  >> It isn't just the card unfortunately. If
>>> you install an app rather >> than >> just receive an SMS, that app
>>> can do other things like make payments, >> and tell you the PIN
>>> number of your card. What happens if someone else >> finds the PIN
>>> number from your phone? well, the Bank would like to say >> it is
>>> your fault.
>
> He has to know the password to open the phone, and the password to
> open the bank application. And possibly, a third password before the
> app allows you to do an operation such as retrieve the pin of a credit
> card.

Malware doesn't need to do all these things. It just waits for you to do
them.

In the case of the article it doesn't explain how the phone was unlocked
but I think it likely the phone was not locked, or it had a trivial
PIN. Maybe the banking app was open too.

>
>> https://www.ftadviser.com/your-industry/2022/09/06/santander-agrees-to-reimburse-customer-after-gym-theft/
>> 
>
> I don't know what that pin in app feature is, and I am a santander
> client, just not in the UK.

It may have been removed now, the article is from 2022 and it says
"Morgan has called on Virgin Active UK to review its security as a
result of the incident and on Santander to remove its PIN-in-app feature
from its mobile banking app, or to at least make it an optional feature
for customers "