emperor: (Default)
Add MemoryShare This Entry
posted by [personal profile] emperor at 04:36pm on 29/05/2008 under , ,
My previous rant about Nationwide wasn't the only thing they've cocked up recently.

Nationwide have decided to introduce card readers, to make internet banking "more secure". At the time, I rashly assumed that before I'd need such a card reader, I'd get sent one. No! On the 12th of May, I tried to move some money to one of my other accounts (with a different bank), and was asked to frob a card-reader. Unimpressed, I lodged a complaint. I got a reply on the 16th or so, saying:

Thank you for your enquiry.

I'm sorry to learn you have not yet received your Card Reader. This would have been sent to your registered address around 2 to 3 weeks prior to you being asked to use it on the Internet Bank.

I have arranged for a replacement Card Reader to be sent to your home address, this should arrive within the next 5 to 7 working days.


Indeed, a card reader arrived on the 20th, along with a note saying "here is your replacment card reader. If you require another replacement, we may start charging you for them". I sent another complaint:

Thank you for your response (and for the one card-reader that arrived this morning). I'm afraid it is not entirely satisfactory.

Firstly, let me reiterate: we never received card readers from you. If you sent us a pair, they never arrived, and I suggest you take that up with the Royal Mail. I resent the implication in your message (and even more strongly in the letter that accompanied the card reader that arrived this morning) that this card reader is in some sense a "replacement". It's the first card reader we've ever received from you, not a replacement!

Secondly, I note that you have sent us only one card reader. Given that there are two account-holders for this account, that is unsatisfactory.


I now have another message from them. In amongst a load of meaningless twaddle about how they love to give us a really efficient service etc, etc, there are the following gems:

I think the problem with the Card Reader not arriving is because we have the address below for your address associated with the FlexAccount card: [Old Address]

We have another address below that is registered for the general mailing address: [Current Address]

The Card Reader should have been sent to the mailing address.

In the meantime to request a change of address you will need to complete a 'Change of Address' form which can be accessed once you have signed onto the internet bank [...continues into instructions on how to fill out said form and post it back to them]

In terms of the secondary card holder as your FlexAccount debit card was issued before November 2007 replacement cards are being sent out randomly between now and the end of May 2008 for added security we are adding for our members with access to the Internet Bank. This maybe why your partner did not receive a Card Reader or a new card. That or is could be because of the address issue above. The cards you should be both using with the card reader end [0-9]4 and [0-9]4.


This is just so fucked-up on so many levels:
  1. They've managed to not change our address properly, despite my having filled in a change-of-address form, and phoned their change-of-address team

  2. We have working mail forwarding, so things sent to old-address should be getting forwarded (indeed, many things have been).

  3. They seem unable to convincingly claim whether they've actually sent anything out to us, and if so, when

  4. Between now and the end of May 2008 isn't really very much time now, is it?

  5. This is the first I've heard of being sent a new card too. Neither of our debit cards ends with the 4-digit sequences they mention.

  6. Indeed, I've just checked, and internet banking wants me to put a card I don't possess into the card reader I do now have



Indeed, the card reader they have now provided is useless. Their system must know I'm still using the old card. Fuck only knows if they've posted out new cards and associated readers, and if so, where they are! I'm monumentally pissed off with this.
There are 31 comments on this entry. (Reply.)
 
posted by [identity profile] uisgebeatha.livejournal.com at 04:22pm on 29/05/2008
Ewww. RBS use card readers as well. It's not that they didn't send them out swiftly, it's just that you can trundle along not using it and forget where it is, then be told you can't make any transfers from your account without the random number it generates. Which has happened to us this week. ¬_¬
 
posted by [identity profile] mirabehn.livejournal.com at 04:23pm on 29/05/2008
Wow. That really is a spectacular stream of incompetence they're displaying there. It sucks. *many hugs*

I really think at this stage you should change banks, and make it very clear to Nationwide why you have done so. I again recommend Smile, who are both very ethical and pleasingly efficient.

(And they don't use card readers. Ftw. :-) )
Edited Date: 2008-05-29 04:23 pm (UTC)
emperor: (Default)
posted by [personal profile] emperor at 05:30pm on 29/05/2008
Smile lose lots of points for having a T&C's PDF my computer can't read(!!) Also, they charge you to use your card overseas, which is EBW.

I'm slightly confused, however, as The EU seems to think this should be illegal within the EU.
ext_3241: (Default)
posted by [identity profile] pizza.maircrosoft.com at 06:05pm on 29/05/2008
Electron beam welding
Exploding bridgewire detonator
eBaum's World
(http://en.wikipedia.org/wiki/EBW)

evil beyond words?

Do you know what is wrong with their pdf?
emperor: (Default)
posted by [personal profile] emperor at 06:11pm on 29/05/2008
Evil, Bad, and Wrong.

I'm not sure. Preview.app just says "I can't open this", xpdf says "this is a v1.6 PDF, I only know 1.5, lets try anyway", and then "argh, it's horribly corrupted".
 
posted by [identity profile] hoiho.livejournal.com at 06:59pm on 29/05/2008
They do? I've never noticed that...
 
posted by [identity profile] yrieithydd.livejournal.com at 07:31pm on 29/05/2008
I'm generally satisfied with them. I've only had one bad fight with them and that was because they didn't get PhD students, but as they've failed to notice that that was 18 months ago and was supposed to give me another year of the student account and I still have it, I'm not complaining!

They're ethical and the do instant transfers within smile/the co-op which is shiny!
ext_3241: (Default)
posted by [identity profile] pizza.maircrosoft.com at 10:41pm on 29/05/2008
heh, I just gave up on trying to get a student account.
sparrowsion: tree sparrow (tree sparrow)
posted by [personal profile] sparrowsion at 09:58am on 30/05/2008
Everyone charges you for using your card overseas. Except Nationwide. We paid for everything in Iceland by dumping our funds into [livejournal.com profile] 1ngi's Nationwide account before going and using her card exclusively.
 
posted by [identity profile] yrieithydd.livejournal.com at 10:33am on 30/05/2008
How often do you go abroad? Does paying for using cards when abroad beat having an incompetent bank?
 
posted by [identity profile] hilarityallen.livejournal.com at 04:24pm on 29/05/2008
Is it time to think about changing bank?

Did you keep a copy of the change of address form?

I'd write another complaint. They're being particularly useless.
taimatsu: (Default)
posted by [personal profile] taimatsu at 04:27pm on 29/05/2008
They suck. Natwest randomly sent me a new cad and then a card reader, and fortunately I did receive the bits I was supposed to receive around the right time. I haven't used the damn thing yet.
 
posted by [identity profile] the-lady-lily.livejournal.com at 05:24pm on 29/05/2008
You probably won't have to for a while either - I think I've only used mine once, and that was when setting up a new account payee.
pm215: (Default)
posted by [personal profile] pm215 at 04:29pm on 29/05/2008
Mail forwarding doesn't work for things sent by courier, of course; dunno whether that was the case here.
emperor: (Default)
posted by [personal profile] emperor at 04:33pm on 29/05/2008
The "replacement" card reader came by normal mail.
 
posted by [identity profile] geekette8.livejournal.com at 04:36pm on 29/05/2008
No, Nationwide send the card readers by standard first class post. They're not specific to the account or even to the bank - they're "industry standard", so it doesn't matter (other than the inconvenience of them going astray of course).

[livejournal.com profile] emperor: Back in March I submitted a whinge at their TalkBack session and I randomly noticed yesterday they have answered my question (search for Larmour in the page to find it). I am now in the process of composing a meta-whinge at them about all the problems I have had with them in the last 2 years; there have been six separate incidents, only two of which were in any way related (two completely separate hassles with our mortgage application), and of the three of those I wrote to them and whinged about at the time they occurred, none were actually resolved to my satisfaction. They suck.
 
posted by [identity profile] meglorien.livejournal.com at 04:49pm on 29/05/2008
Unless you have a really very strong reason to stay with them, I'd advise you to change bank.

It's amazing how people in certain jobs like to make you feel guilty and stupid for things they have done wrong. We very much felt this with our wedding process. It didn't matter we had phoned them in advance several times, it didn't matter we did exactly what they told us, it was still our fault and they were doing us a big favour by overlooking some aspects of it. Argh!

Big hugs to you both.
 
posted by [identity profile] the-lady-lily.livejournal.com at 05:24pm on 29/05/2008
I'm very much in the 'why are you still with Nationwide?' camp.

I thoroughly recommend Natwest, who have been great for me; although they do have card readers and I've had mine for over a year now, I've only had to use it once when setting up a new account payee.
 
posted by [identity profile] cartesiandaemon.livejournal.com at 05:36pm on 29/05/2008
"I think the problem with the Card Reader not arriving is because we have the address below for your address associated with the FlexAccount"

Depressingly, I'm really really amazed they actually read your email to the extent of being able to reply at all.

BTW, I wonder if card readers actually provide any security? I just assumed it was useless fluff, but apparently it produces a (one-off?) 'hash', so conceivably it might, but I don't know if it _does_.
 
posted by [identity profile] hsenag.livejournal.com at 08:11pm on 29/05/2008
The below is all semi-informed guesswork.

Prior to the card readers, an attacker just needed to steal your web login details to steal money from your account. This can be done e.g. with a trojan on your computer that runs long enough to pick up the full details where you only enter partial information on each login.

With card readers, then an attacker *also* needs some way to construct the correct response to the issued challenge. If it's possible to clone the chip on a C&P card, then an attacker could do this, e.g. with a trojaned C&P machine in a shop. But the vector for doing that and the vector for stealing your login details are very different, so it'll be much harder - probably you'd need to operate a big database, grab people's details opportunistically, and hope that a few of them would match up. If it's not possible to clone the chip, then the only attack is to steal the card.

So I think they're worthwhile, and I think (Nationwide's adminstrative incompetence aside) that they've implemented it in basically the best way they could.
ext_27570: Richard in tricorn hat (Default)
posted by [identity profile] sigisgrim.livejournal.com at 10:28pm on 29/05/2008
How they work is to produce an n digit hash that lasts for about 10 seconds on a pseudo random cycle. Each Card Reader has a different seed and that seed is known to the process on the other end, which means that it can predict the hash the Card Reader will generate at any point in time. Then the hash can be used to do whatever encryption or verification is required.

We use a similar mechanism for secure VPN onto some customer networks at work.
emperor: (Default)
posted by [personal profile] emperor at 10:07am on 30/05/2008
This can't be how they work, as card-readers are interchangable, even between banks.

Well, OK, every card reader everywhere could have the same seed, but that would be very silly!
Edited Date: 2008-05-30 10:08 am (UTC)
ext_27570: Richard in tricorn hat (Default)
posted by [identity profile] sigisgrim.livejournal.com at 12:26pm on 30/05/2008
My understanding is that the card reader is tied to the account (and thus to the card, or possibly cards). Or rather the seed in the card reader is tied to the account. All the card readers are essentially the same, but with a unique seed and when one is issued to a customer their account has the seed from the card reader recorded against it.
 
posted by [identity profile] dave holland at 12:31pm on 30/05/2008
Barclays say their card reader isn't account-specific and that you can use someone else's card reader. (Card-reader hijacking, anyone?)

http://www.barclays.co.uk/pinsentry/questions.html
ext_27570: Richard in tricorn hat (Default)
posted by [identity profile] sigisgrim.livejournal.com at 01:58pm on 30/05/2008
Barclays say their card reader

We're still waiting for ours from Barclays.


isn't account-specific

That's very interesting. In that case I'd guess that something is sent initially from the reader to the bank that identifies the account and then the bank sends something else back to the reader that identifies which seed to use. But that is less secure; once you've identified the link between seed identifier and seed the thing is cracked and that link is on the bit of hardware that everyone has. Also if one could intercept the account identifier and the returned seed identifier that would reveal which seed was associated with a particular account.
emperor: (Default)
posted by [personal profile] emperor at 12:33pm on 30/05/2008
Nationwide are quite clear that I can use any card reader I care to, including one from another bank.
 
posted by [identity profile] womble2.livejournal.com at 12:10am on 03/06/2008
I think that it's the chip in the card that is generating the hash.
ext_27570: Richard in tricorn hat (Default)
posted by [identity profile] sigisgrim.livejournal.com at 09:40am on 03/06/2008
Yes, that would make sense. Why didn't I think of that? Duh!
 
posted by [identity profile] emarkienna.livejournal.com at 12:11am on 30/05/2008
I haven't got my card reader either yet for Nationwide (I haven't checked to see if I need one yet, but thanks for the heads up). I have one for Barclay's as well, and they too decided to only tell me I needed one when I tried to make a payment.

I won't be throwing away the cheque book just yet.
 
posted by [identity profile] curig.livejournal.com at 01:40am on 30/05/2008
I've got a card-reader because I phoned them back in March or something when they sent out the "we're going to have card-readers: if you're not in the country you need to call us" letter. That said, online banking has not yet asked me to use it!

My experience (as I may or may not have mentioned before) is that Nationwide are incapable of changing addresses on accounts without fuss. The only method that seems to work IME is to go into a branch and get them to do it on the computer there and then. I had a lot of fuss and got cross with them when I moved to Sheffield.
 
posted by [identity profile] dave holland at 12:34pm on 30/05/2008
Time to change bank.

Barclays have been by and large OK for day-to-day banking for us. We've nearly switched away out of irritation with how they messed up our mortgage application. We've opened the new account (with the Co-op: no card reader!) but stalled due to lack of tuits...

October

SunMonTueWedThuFriSat
      1
 
2
 
3
 
4
 
5
 
6
 
7
 
8
 
9
 
10
 
11
 
12
 
13
 
14
 
15
 
16
 
17
 
18
 
19
 
20
 
21
 
22
 
23
 
24
 
25
26
 
27
 
28
 
29
 
30
 
31