Banks' online security is failing customers, says Which?

The consumer group says five of the UK’s biggest banks and building societies consistently scored poorly in its security test, including Lloyds and Santander

The consumer group Which? has criticised some of Britain’s biggest banks for failing to invest in security systems that would better protect their customers from fraudsters.

Against a backdrop of booming bank fraud, Which? tested the UK’s 11 biggest banks and building societies and found that the security at five of them was still not good enough.

Which? said Halifax, its sister brand Bank of Scotland, Lloyds, Santander and TSB had “consistently scored poorly” over the four years it had been analysing their security measures, and continued to do so as none of them offered two-factor authentication at login, despite having the technology to do so.

In 2014-15, banking fraud losses soared by 64% to £133.5m for online banking, and by 28% to £323.3m for phone banking, the consumer group said. It added that too many customers were still being let down by their bank’s security.

Which? has called on the industry to make greater use of two-factor authentication at the login stage of online banking. This combines two identity checks – typically a password or pin plus a single-use pass code sent via a card reader or mobile phone.

In its most recent test, carried out in August, Which? found that only five of the 11 banks had adopted such security checks to protect customers.

In September, Which? used its super-complaint powers to call on the financial regulator to investigate whether banks could do more to protect people who are tricked into transferring money to a fraudster. Too often, fraud victims are not being refunded by banks and in some cases have lost in excess of £100,000Alex Neill from Which? said: “Online banking is increasingly part of our daily lives, and at the same time online scams are becoming more sophisticated. People can only do so much to protect themselves from fraud – it’s time for banks to shoulder more of the responsibility and introduce extra protections to safeguard their customers.”

In the test, First Direct and HSBC were given the highest security scores, closely followed by Barclays, M&S Bank and Nationwide.

TSB, which received the lowest score, said: “It is our number one priority to offer safe and secure banking facilities for our customers across all of our products and services. To achieve this we maintain complex and multilayered fraud prevention controls which will not be visible to the customer – or reflected in this survey. We continually review and improve our services to ensure they remain robust and fit for purpose.”

Lloyds, meanwhile, said the research did not accurate reflect “the highly sophisticated security our customers benefit from”.

Contributor

Miles Brignall

The GuardianTramp

Related Content

Article image
So you think you’re safe doing internet banking?
Britain’s leading expert on cyber security refuses to bank online. We ask if you should follow suit

Miles Brignall

21, Nov, 2015 @6:59 AM

Article image
'I lost £95,000 in a bank scam after my solicitor's email was hacked'
Sally Flood managed to claw two-thirds back, but says lenders should do more to protect customers

Rupert Jones

29, Feb, 2020 @1:00 PM

Article image
Lloyds customer loses £5,200 in email scam – but can't get refund
Business account holder prepares to sue bank after paying real bill into bogus account

Miles Brignall

01, Dec, 2018 @7:00 AM

Article image
Banks act to stop transfer scams and errors
‘Confirmation of payee’ system matches account number to holder’s name, so users will know cash is going to right recipient

Patrick Collinson

29, Nov, 2016 @9:30 AM

Article image
Millions of UK bank customers miss out on security checks
Several banks yet to bring in confirmation of payee, which checks sender is paying the right recipient

Rupert Jones

20, Mar, 2021 @12:30 PM

Article image
TalkTalk scam victims say it’s time for answers
As another customer explains how he was conned out of £6,300 after the firm’s security breach, the ICO is seemingly stalling while a class action moves closer

Miles Brignall

18, Feb, 2017 @6:59 AM

Article image
One family's nightmare as fraudsters ransack Barclays account by phone
Criminals changed the address on a teacher’s account, then took out a £24,000 loan in her name and stole her savings

Miles Brignall

13, Aug, 2016 @6:00 AM

Article image
Banks to check account names to beat transfer fraud
‘Confirmation of payee’ system will stymie increasingly sophisticated criminal scams

Rupert Jones

18, Oct, 2018 @5:47 PM

Article image
How to create the perfect password
Standard words won’t protect you from determined hackers. But you can make your online accounts safe in just a few easy steps

Patrick Collinson

21, May, 2016 @5:59 AM

Article image
Banks need to tackle web fraud
Losses from online crime are borne by customers but there are simple changes that could help protect them

Patrick Collinson

30, Jul, 2016 @6:00 AM