[philip42h]

I'm looking for an alternative to "Strong Customer Authentication" and the changes being imposed on Tesco Bank customers.

Specifically, my mother is 95, doesn't own a smartphone so the "App" is no use at all.

Because there is next to no mobile single where she lives, an OTP sent via SMS is unlikely to arrive and even if it does it is a wholly unnecessary 'faff' for her to try to manage her small legacy mobile 'phone and rekey the tiny digits.

She lives alone and manages fine using online shopping and Tesco deliveries but this imposition is a threat to her independence. So, what is the alternative?

[KellyT]

Hi @philip42h, as an alternative we can send the one time passcode to a landline number registered on the account.

[philip42h]

Thanks Kelly ... that's the same answer I got from @Tesco-Bank - you'll send an OTP via an automaton to a landline number.

It is puzzling that neither the email "how you approve online purchases is changing" nor the "Find out more" section on the website seem to mention this alternative (though I had previously seen mention of such on the FCA website). Is it possible that Tesco Bank realise that while such a mechanism may fulfil their FCA obligations it fails utterly in terms of customer service?

Picture this: little old lady trying to make an online purchase; the 'phone rings; she has to get up from her PC, gather her walking sticks and make her way to the telephone to answer the call before the answerphone cuts-in; she then has to memorise or write down a code and make her way back to her PC before the transaction times out; all without falling ...

Is this really the best Tesco Bank can do?

[RossM]

@philip42h Keen to hear your suggestion on what would improve things in this scenario?

[philip42h]

Ross, are you seriously asking a customer / member of the public, on an open forum, how to design a financial services security solution? 😉

The FCA guidance to the industry includes the statements:

We expect firms to develop SCA solutions that work for all groups of consumers. 
This means that you may need to provide several different methods of authentication for your customers. This includes methods that don’t rely on mobile phones, to cater for consumers who don’t have, or don’t want to use, a mobile phone.

You, and your IT teams have had ample opportunity to satisfy those requirements and have seemingly failed to do so ...

... but I'll take the bait even though I haven't had sight of the detailed requirements your teams have been working to:

Start with a USB connected, contactless card reader - the technology exists and allows you to be confident that the card is present at the time of the transaction. Provide the reader with it's own unique identity - that way you can be sure that the device being used is the one supplied to the customer / registered on their account. In the authentication pop-up that follows a web based transaction you can request that the customer enters an online transaction PIN - that way you can be sure that something known to the cardholder is used. You now provide the device with a transaction code - generated by the bank and unique to the specific transaction - together with the PIN. This information is combined with the device id and card details, encrypted and returned as an authorisation code to the bank. You now have three factors of authentication (which rather beats use of an OTP via SMS).

Such a device could be common across banks, would cost only £10s to produce, and you could even charge your customers the price of having one.

Well, you did ask ... 😀

[RossM]

Originally Posted by philip42h

Ross, are you seriously asking a customer / member of the public, on an open forum, how to design a financial services security solution? 😉

I'm asking your opinion on what you think will improve things for yourself and our customers, this public forum exists so Tesco Bank customers can provide their thoughts, feedback etc and we do listen. Everything said here is logged, discussed and helps us make business decisions.

We are a digital bank so will always focus on the digital solution first. We also have a high install base of the app. With the focus on app account management and with products launching that require the app ( like Clubcard Pay + ) I can't see us going back to a card reader for the small number of customers that would use that service (We previously had these). Especially as we have the options for confirmation within the app, via text message or the landline authorisation which will cover the majority of Tesco Bank customers. Card readers seems a bit like a backwards step in my own personal opinion but as I mentioned will certainly be logged and considered.

[philip42h]

Originally Posted by RossM

... We are a digital bank so will always focus on the digital solution first. We also have a high install base of the app. With the focus on app account management and with products launching that require the app ( like Clubcard Pay + ) I can't see us going back to a card reader for the small number of customers that would use that service (We previously had these). Especially as we have the options for confirmation within the app, via text message or the landline authorisation which will cover the majority of Tesco Bank customers. Card readers seems a bit like a backwards step in my own personal opinion but as I mentioned will certainly be logged and considered.

That is rather the impression that I had formed. Tesco are a digital bank and wish to serve 'digital' customers, and would prefer the inconvenient 'small' number of non-digital customers to 'just go somewhere else'. Your opinion is noted ...