Chat verification security

[breaderz8 (Seven shrp)]

Hi Guys I have had 2 occasions where I have had to request a pin number for my card, I noticed when I contacted you the 2nd time the conversation for my first pin including my reply to the security questions was available to see so I could just copy and paste my answers when requesting a pin for the 2nd time(I DIDNT DELETE THE CONVERSATION) I think these conversations should automatically be deleted by Monzo to protect the user.

With no option for a built-in pin this could leave some users open for attack.E.G bag was stolen with Monzo card and Phone access(no-pin) I can simply look for ID such as drivers license and request a pin through Chat,or I could review any old posts in hope that a pin has previously been requested and I can copy the details as I did.The user would have difficulty in stopping their Monzo card if their phone had been taken.

I know the scenario maybe very rare but I Thought I would feedback as it may encourage users to use pins and other protection available on the app store.

[SC95]

Chat verification security

Had a bit of an interesting experience verifying my identity to a customer support team member over the app chat yesterday. It’s a great idea to do a verification process - after all someone could have stolen my phone and might be pretending to be me to steal some valuable information or whatever. To verify my identity I was asked my 9 digit card token (the person would also need to have stolen my wallet) and my date of birth (again, my wallet has that). May be a little easy there, but I think …

[jzw95]

This has been discussed before, so you may be interested to see what was said. My opinion: you should have a passcode on your phone, so no one will be able to get into it, but, yes, it does seem that security details should be deleted from chat conversations.

Chat verification security

Had a bit of an interesting experience verifying my identity to a customer support team member over the app chat yesterday. It’s a great idea to do a verification process - after all someone could have stolen my phone and might be pretending to be me to steal some valuable information or whatever. To verify my identity I was asked my 9 digit card token (the person would also need to have stolen my wallet) and my date of birth (again, my wallet has that). May be a little easy there, but I think …

[Yap]

Can we move most of these posts and answers into a wiki?

[nanos]

What’s the point? The whole thing can be summed up in a single question and answer:

Q: Should you use Monzo, if your security and privacy are more important to you than convenience?

A: Given that Monzo make it very difficult to revoke API access, don’t have pin protection for the app (on Android), show previous security questions and answers visible in the app (which is usually unprotected), and a number of other issues, it seems fair to conclude that Monzo generally prioritise usability and convenience over security and privacy. Thus, if you do not share this view you may consider alternative options instead.

[Yap]

Thanks for replying. Any alternatives suggestions would be welcome!
Just tired of not being able to budget well.
I could use iXpenseIt which is a nice budgeting app but figure something like Monzo might work better
as then you can’t forget to update the app.
As you can tell I worry about Fin tech, just want it to work! Fin Tech has a lot of potential!
Maybe I should check back in 1 year.

[anon23935806]

Have you looked at Starling? Annoying you with PINs, Touch ID’s and passwords every 30 seconds is their speciality so you should be fine

[rolanddeschain]

I have no problem not having a pin on the app. There is a pin when you make an outgoing transaction, that is enough for me.

I figure if I am ok with having my email on my phone without a pin I’m ok with having monzo without a pin. The main fingerprint protection on my phone is the level of security I need. If someone gets my phone and gets past that I have far larger problems from them having access to my email, so being able to reset any passwords I have, than to Monzo.

[Yap]

Not yet, Monzo was recommended. I figure you’d want a passcode on monzo as I look as it like a safe in your house, where you house is your phone. You still have other trusted people use your phone(house).

[anon23935806]

There’s already a passcode or Touch ID for actions that take money out of your account; but for read access personally I really don’t mind. When someone has access to my phone I’m already putting a lot of trust in them (they have my emails, photos, social accounts, etc) so the fact they can see how much I spent on pizza yesterday is the least of my worries.

[HughWells]

This is coming

(chat verification)

[Venomx (Terry Adams)]

On the topic of security, my iPhone SE uses fingerprint recognition, not only is this very secure, it also is so much quicker than typing in a pincode

[Jackcrwhitney (Jack)]

ooo, I want to know more about this are you any closer to moving away from intercom?

[anon23935806]

I know they once said they wanted to move away but recently I think someone said that the Intercom costs aren’t that big in the grand scheme of things so not sure if they still plan to move away.

In any case, they can implement custom verification on top of Intercom just like they did with the “is this urgent?” switch.

[Jackcrwhitney (Jack)]

@anon23935806

In any case, they can implement custom verification on top of Intercom just like they did with the “is this urgent?” switch.

Good point, I hadn’t thought of that

[DaveTMG]

So that’s what the funny button was for on my old iPhone!

My new one doesn’t have a button though, maybe I’m not secure any more?

[redshift]

I hope you don’t have to verify every time you start a chat. It would be nice if the COp could send a button in the chat that would request verification if it was needed. Or is it just going to require your pin/fingerprint/face?

[Venomx (Terry Adams)]

I sort of agree with the original post. Private info should be deleted once confirmed etc