# Magic login links, insecure? **URL:** \ **Category:** Feedback & Ideas\ **Created:** [27 July 2018 12:32 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490 "2018-07-27T12:32:02Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:32 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/1 "2018-07-27T12:32:03Z")
So theoretically speaking a banking company should be secure by nature. Say my email gets hacked, or social engineered, etc etc. It would take 10 seconds to search for “Monzo” in my email app and deduce that I do in fact use Monzo. Now they would only need to download the app, and enter my email address, generate a magic link and they have full access to my bank account. What was wrong with passwords, or 2FA, or even passwords and then Magic links to verify. Magic links are not secure on their own and incredibly dangerous. ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:34 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/2 "2018-07-27T12:34:38Z")
How does your email get hacked if you have 2FA on it? ---
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:36 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/3 "2018-07-27T12:36:04Z")
Not mine, but I know plenty who don’t use 2FA. A banking company should not assume that everyone uses 2FA on their email, but should definitely enforce it on their banking app. ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:36 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/4 "2018-07-27T12:36:31Z")
I couldn’t agree less ---
**Author:** ![Vladislav](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/vladislav/32/23530_2.png) [@Vladislav](https://community.monzo.com/u/Vladislav)\ **Post date:** [27 July 2018 12:36 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/5 "2018-07-27T12:36:34Z")
Agree with @DaveTMG. No point having 2FA on every service if I can simply have it on my email, which stores all my accounts. This whole “memorable word” and “2FA” for banks is just a security theatre. If someone has a capability to hack you, these won’t save you. ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:38 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/6 "2018-07-27T12:38:29Z")
I want my banking app to learn how I use it then query me for further verification if it doesn’t seem like it’s me. I don’t want any security theatre. ---
**Author:** ![vitaminj](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/vitaminj/32/8864_2.png) [@vitaminj](https://community.monzo.com/u/vitaminj)\ **Post date:** [27 July 2018 12:42 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/7 "2018-07-27T12:42:21Z")
Note that they would also need your PIN if they want to do anything with your money. Edit: Not to excuse that they might be able to get in there and see what you’ve been spending on, what other services you use (although that would probably be already clear from email), or glean more info to break/engineer into other services. ---
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:43 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/8 "2018-07-27T12:43:20Z")
I just want options, clearly y some of you are in favour of magic links, and some aren’t. Give me the option to secure my data and finances as I sit fit. ---
**Author:** ![anon13257399](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anon13257399](https://community.monzo.com/u/anon13257399)\ **Post date:** [27 July 2018 12:44 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/9 "2018-07-27T12:44:05Z")
Whilst I don’t feel that the login links are “incredibly insecure” I do agree that an email link alone should not verify a login to your bank. Sure, I also have MFA on my email, however, there are going to be a large number of people out there who do not, especially with percentage of market share that Monzo are aiming for. I feel they should offer various forms of MFA for your account. e.g text message/one time password/other etc. ---
**Author:** ![harryjms](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/harryjms/32/12875_2.png) [@harryjms](https://community.monzo.com/u/harryjms)\ **Post date:** [27 July 2018 12:44 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/10 "2018-07-27T12:44:19Z")
Magic links are incredibly convenient and I dont feel its the method that is insecure, rather the destination that could be insecure. At the end of the day, it is the user’s responsibility to keep their accounts safe and secure. However, perhaps this is where Monzo could step in from a social aspect and educate new customers about online security, email 2FA etc. Your point is a valid one, but I feel that moving forward companies should work to educate users rather than design around naivety. Barclays is an example of this. They have run many campaigns on TV and billboards around Online Security and keeping your information safe 👏🏼 ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:46 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/11 "2018-07-27T12:46:00Z")
Perhaps Monzo could tell us how many accounts have been hacked through magic links? I doubt it is many. ---
**Author:** ![jwhiterz](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jwhiterz](https://community.monzo.com/u/jwhiterz)\ **Post date:** [27 July 2018 12:47 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/12 "2018-07-27T12:47:18Z")
I think it’s probably more important for Monzo to teach users about 2FA on their email accounts. Ultimately email companies should be enforcing it as standard. If someone gets into your email they can get into a lot of things! It’s surprisingly easy to reset a Lloyds online banking password with details that aren’t that difficult to get. ---
**Author:** ![jwhiterz](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jwhiterz](https://community.monzo.com/u/jwhiterz)\ **Post date:** [27 July 2018 12:48 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/13 "2018-07-27T12:48:59Z")
To add it’s also important to remeber the worst they can do is view your feed etc. No money can leave your account without Touch ID or your pin being entered. ---
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:49 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/14 "2018-07-27T12:49:09Z")
I assume most have email on their phones, if your phone is taken in a street mugging whilst you had it unlocked (not uncommon in London)… I’m pretty sure that you wouldn’t need any extra authentication to get into your mail app. Either way, it’s not he security I want on my finances. ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:50 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/16 "2018-07-27T12:50:33Z")
The obvious response is to use another bank that gives you what you want? FD have incredibly stupid amounts of security on theirs. ---
**Author:** ![Rat\_au\_van](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/rat_au_van/32/49103_2.png) [@Rat\_au\_van](https://community.monzo.com/u/Rat_au_van)\ **Post date:** [27 July 2018 12:51 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/18 "2018-07-27T12:51:26Z")
I never use my phone in the street when I’m in a city. Too risky ---
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:51 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/19 "2018-07-27T12:51:49Z")
I have to admit your replies are incredibly blunt and standoffish. I’m asking for options to cater to the different people who want to use Monzo. You seem to have a one size fits all approach, which I really don’t agree with. ---
**Author:** ![harryjms](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/harryjms/32/12875_2.png) [@harryjms](https://community.monzo.com/u/harryjms)\ **Post date:** [27 July 2018 12:53 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/20 "2018-07-27T12:53:16Z")
I understand why its currently not the default. Having worked at a fruit stand tech support, I have seen many people enable 2FA and then get locked out because they didnt understand what it meant and what they were doing. Emails are vital to a lot of people, as its the main form of account recovery for most online services and accounts. If you lock yourself out of your email, you are in for a tough time! ---
**Author:** ![DaveTMG](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/davetmg/32/53594_2.png) [@DaveTMG](https://community.monzo.com/u/DaveTMG)\ **Post date:** [27 July 2018 12:54 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/21 "2018-07-27T12:54:19Z")
But you are asking for something based on no evidence whatsoever. That’s security theatre and I don’t need that kind of friction in my life. You have stated ‘Magic login links are incredibly insecure’ - they are only as insecure as the person using them. I don’t want every provider to be legislating for stupidity. ---
**Author:** ![anon50455419](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@anon50455419](https://community.monzo.com/u/anon50455419)\ **Post date:** [27 July 2018 12:55 UTC](https://community.monzo.com/t/magic-login-links-insecure/43490/22 "2018-07-27T12:55:37Z")
What evidence do you want? Banks should have a proactive rather than reactive response. I’m pretty bored of this now. [Next page](https://community.monzo.com/t/magic-login-links-insecure/43490.md?page=2)