My previous rant about Nationwide wasn't the only thing they've cocked up recently.
Nationwide have decided to introduce card readers, to make internet banking "more secure". At the time, I rashly assumed that before I'd need such a card reader, I'd get sent one. No! On the 12th of May, I tried to move some money to one of my other accounts (with a different bank), and was asked to frob a card-reader. Unimpressed, I lodged a complaint. I got a reply on the 16th or so, saying:
Indeed, a card reader arrived on the 20th, along with a note saying "here is your replacment card reader. If you require another replacement, we may start charging you for them". I sent another complaint:
I now have another message from them. In amongst a load of meaningless twaddle about how they love to give us a really efficient service etc, etc, there are the following gems:
This is just so fucked-up on so many levels:
Indeed, the card reader they have now provided is useless. Their system must know I'm still using the old card. Fuck only knows if they've posted out new cards and associated readers, and if so, where they are! I'm monumentally pissed off with this.
Nationwide have decided to introduce card readers, to make internet banking "more secure". At the time, I rashly assumed that before I'd need such a card reader, I'd get sent one. No! On the 12th of May, I tried to move some money to one of my other accounts (with a different bank), and was asked to frob a card-reader. Unimpressed, I lodged a complaint. I got a reply on the 16th or so, saying:
Thank you for your enquiry.
I'm sorry to learn you have not yet received your Card Reader. This would have been sent to your registered address around 2 to 3 weeks prior to you being asked to use it on the Internet Bank.
I have arranged for a replacement Card Reader to be sent to your home address, this should arrive within the next 5 to 7 working days.
Indeed, a card reader arrived on the 20th, along with a note saying "here is your replacment card reader. If you require another replacement, we may start charging you for them". I sent another complaint:
Thank you for your response (and for the one card-reader that arrived this morning). I'm afraid it is not entirely satisfactory.
Firstly, let me reiterate: we never received card readers from you. If you sent us a pair, they never arrived, and I suggest you take that up with the Royal Mail. I resent the implication in your message (and even more strongly in the letter that accompanied the card reader that arrived this morning) that this card reader is in some sense a "replacement". It's the first card reader we've ever received from you, not a replacement!
Secondly, I note that you have sent us only one card reader. Given that there are two account-holders for this account, that is unsatisfactory.
I now have another message from them. In amongst a load of meaningless twaddle about how they love to give us a really efficient service etc, etc, there are the following gems:
I think the problem with the Card Reader not arriving is because we have the address below for your address associated with the FlexAccount card: [Old Address]
We have another address below that is registered for the general mailing address: [Current Address]
The Card Reader should have been sent to the mailing address.
In the meantime to request a change of address you will need to complete a 'Change of Address' form which can be accessed once you have signed onto the internet bank [...continues into instructions on how to fill out said form and post it back to them]
In terms of the secondary card holder as your FlexAccount debit card was issued before November 2007 replacement cards are being sent out randomly between now and the end of May 2008 for added security we are adding for our members with access to the Internet Bank. This maybe why your partner did not receive a Card Reader or a new card. That or is could be because of the address issue above. The cards you should be both using with the card reader end [0-9]4 and [0-9]4.
This is just so fucked-up on so many levels:
- They've managed to not change our address properly, despite my having filled in a change-of-address form, and phoned their change-of-address team
- We have working mail forwarding, so things sent to old-address should be getting forwarded (indeed, many things have been).
- They seem unable to convincingly claim whether they've actually sent anything out to us, and if so, when
- Between now and the end of May 2008 isn't really very much time now, is it?
- This is the first I've heard of being sent a new card too. Neither of our debit cards ends with the 4-digit sequences they mention.
- Indeed, I've just checked, and internet banking wants me to put a card I don't possess into the card reader I do now have
Indeed, the card reader they have now provided is useless. Their system must know I'm still using the old card. Fuck only knows if they've posted out new cards and associated readers, and if so, where they are! I'm monumentally pissed off with this.
(no subject)
(no subject)
I really think at this stage you should change banks, and make it very clear to Nationwide why you have done so. I again recommend Smile, who are both very ethical and pleasingly efficient.
(And they don't use card readers. Ftw. :-) )
(no subject)
I'm slightly confused, however, as The EU seems to think this should be illegal within the EU.
(no subject)
Exploding bridgewire detonator
eBaum's World
(http://en.wikipedia.org/wiki/EBW)
evil beyond words?
Do you know what is wrong with their pdf?
(no subject)
I'm not sure. Preview.app just says "I can't open this", xpdf says "this is a v1.6 PDF, I only know 1.5, lets try anyway", and then "argh, it's horribly corrupted".
(no subject)
(no subject)
They're ethical and the do instant transfers within smile/the co-op which is shiny!
(no subject)
(no subject)
(no subject)
(no subject)
Did you keep a copy of the change of address form?
I'd write another complaint. They're being particularly useless.
(no subject)
(no subject)
(no subject)
(no subject)
(no subject)
(no subject)
It's amazing how people in certain jobs like to make you feel guilty and stupid for things they have done wrong. We very much felt this with our wedding process. It didn't matter we had phoned them in advance several times, it didn't matter we did exactly what they told us, it was still our fault and they were doing us a big favour by overlooking some aspects of it. Argh!
Big hugs to you both.
(no subject)
I thoroughly recommend Natwest, who have been great for me; although they do have card readers and I've had mine for over a year now, I've only had to use it once when setting up a new account payee.
(no subject)
Depressingly, I'm really really amazed they actually read your email to the extent of being able to reply at all.
BTW, I wonder if card readers actually provide any security? I just assumed it was useless fluff, but apparently it produces a (one-off?) 'hash', so conceivably it might, but I don't know if it _does_.
(no subject)
Prior to the card readers, an attacker just needed to steal your web login details to steal money from your account. This can be done e.g. with a trojan on your computer that runs long enough to pick up the full details where you only enter partial information on each login.
With card readers, then an attacker *also* needs some way to construct the correct response to the issued challenge. If it's possible to clone the chip on a C&P card, then an attacker could do this, e.g. with a trojaned C&P machine in a shop. But the vector for doing that and the vector for stealing your login details are very different, so it'll be much harder - probably you'd need to operate a big database, grab people's details opportunistically, and hope that a few of them would match up. If it's not possible to clone the chip, then the only attack is to steal the card.
So I think they're worthwhile, and I think (Nationwide's adminstrative incompetence aside) that they've implemented it in basically the best way they could.
(no subject)
We use a similar mechanism for secure VPN onto some customer networks at work.
(no subject)
Well, OK, every card reader everywhere could have the same seed, but that would be very silly!
(no subject)
(no subject)
http://www.barclays.co.uk/pinsentry/questions.html
(no subject)
We're still waiting for ours from Barclays.
That's very interesting. In that case I'd guess that something is sent initially from the reader to the bank that identifies the account and then the bank sends something else back to the reader that identifies which seed to use. But that is less secure; once you've identified the link between seed identifier and seed the thing is cracked and that link is on the bit of hardware that everyone has. Also if one could intercept the account identifier and the returned seed identifier that would reveal which seed was associated with a particular account.
(no subject)
(no subject)
(no subject)
(no subject)
I won't be throwing away the cheque book just yet.
(no subject)
My experience (as I may or may not have mentioned before) is that Nationwide are incapable of changing addresses on accounts without fuss. The only method that seems to work IME is to go into a branch and get them to do it on the computer there and then. I had a lot of fuss and got cross with them when I moved to Sheffield.
(no subject)
Barclays have been by and large OK for day-to-day banking for us. We've nearly switched away out of irritation with how they messed up our mortgage application. We've opened the new account (with the Co-op: no card reader!) but stalled due to lack of tuits...