Does your bank support two-factor authentication?


Does your bank support two-factor authentication?  

43 members have voted

  1. 1. Does your bank support two-factor authentication?

    • Yes
      33
    • No
      4
    • No But I wish they did.
      5


Recommended Posts

I recently wrote to my bank asking for two-factor authentication. I would be happy if my bank would text my cell phone with a pin that I would use in combination with my login name and password. Apparently it got sent to the IT guy. So my question is, does your bank support two-factor authentication?

The 3 different types of authentication goes as followed

1) Something you know (Like a password, or something you type off the screen)

2) Something you have (Like a cell phone or some sort of device which generates a pin, which someone would have to have in their physical possession to log into your account)

3) Something you are (This would be where you would use a finger print reader, or have your eyes scanned)

My bank has a lame two factor authentication. The second part asks for 3 words random letters from the secret key. Dont like the idea of authenticators. I would rather prefer them texting me a unique key each time I login.

I'm confused, are they asking for something you know or for something have? At the moment it sounds like just 1 factor, just something you know.

Probably password then the next step is asking for three letters from an answer you have already provided them

So password

Give letter 1, 3, 5 of your secret answer

Authorised.

That is prob for online banking though.

My bank uses two-factor authentication for setting up new payees and changes to account settings but not for general online banking (transfers between accounts, viewing statements, etc). It's a decent compromise between practicality and security.

I would prefer banks used mobile more. In particular I would like to be notified every time money is withdrawn from an ATM or purchases above a certain amount are made. I've got an Italian friend and her bank sends her texts when a certain amount is withdrawn, which I think all banks should be required to offer.

I know that is an option with some accounts but not all which I agree should be required "theyarecomingforyou"

And same, setting up payees etc they require a automated telephone call with a pin and all sorts for bank of scotland

My bank has a lame two factor authentication. The second part asks for 3 words random letters from the secret key. Dont like the idea of authenticators. I would rather prefer them texting me a unique key each time I login.

That's what my bank does when I do an online sign in as well.

My bank does give you the option of alerts via email. But only a select few alerts. It does not let you set a dollar amount to be notified about.

For instance, I would like to sent an alert when a check / credit or debit is made on my account for $200 or more.

but what it will alert people about is if their tax refund arrived in their account :angry:

Hmm well I did just see where I can get an alert if my account falls below X amount of dollars. So I just turned that on and set an amount. I guess that's handy.

A physical key card of 72 6-digit codes for login, changing settings and some third-party online services, first 3 digits for confirmation of payments.

Not enough entropy for my liking. Also - three "strikes" and one has to go to the bank in person to unlock online banking again - which I've also had to do once due to taking the wrong key card and then wondering why it didn't accept the thing.

I bank in the UK with NatWest, they use 2 factor authentication in a sensible way. Barclays require you to use a physical chip and pin device every time you login, whilst secure it rapidly becomes a pain in the neck when you're out and about and need access - like that emergency purchase when you're at the office. NatWest only require you to use it when paying someone for the first time or when transferring large sums of money. I can cope with that!

  • Like 1

One of my banks only allow 6-8 character passwords, and I don't believe they even allow special characters . . .

My bank has a limit of 17 characters. The fact they have a limit at all is scary!

Mine uses two forms of something I know. A UN/PW and then a PIN, also if it's an IP address I've never logged in with they as a Secret Question. Pretty good security without getting in my way very much.

One of my banks only allow 6-8 character passwords, and I don't believe they even allow special characters . . .

Capital One is this way...I really wish they would allow me to use a stronger password.

I'm confused, are they asking for something you know or for something have? At the moment it sounds like just 1 factor, just something you know.

CW-88 explained it best, quote below:

Probably password then the next step is asking for three letters from an answer you have already provided them

So password

Give letter 1, 3, 5 of your secret answer

Authorised.

That is prob for online banking though.

I think banks need to up their game. The likes of Steam and Blizzard are providing better login security but I guess no bank has had their online security breached as bad as both these outlets.

My bank requires the following when logging in online.

Access ID: A number provided by the bank.

PIN: A password that the user makes up for themselves.

Authentication Key: A random 6 digit number generated by a key generator supplied by the bank. Number is good for about 30 seconds before a new number has to be generated.

Not sure what else they could do. :)

My bank (Locally owned), has sort of a two factor authentication they think will be best. You log in - and it cross checks against your IP, if it changes, then it sends you a 'pin' to authenticate yourself either to your cell or email on file. Once you enter the pin, you are good to go with just your regular password. Before that, they had a picture that you were supposed to recognize and if you did, answered the question about it and then your password.

Personally, would LOVE to see more support on sites for Yubikey authentication - super easy to do and quite secure.

Personally, would LOVE to see more support on sites for Yubikey authentication - super easy to do and quite secure.

Ya, I bought one when it first came out. I just don't know where it is...hmmm.

my UK bank asks for a 10 digit number and then it'll ask me for 3 random characters from my set password and then for a random 3 digits of my cards pin number.

Canadian credit union asks for member number then it'll ask me for the answer to a security question. If I answer right it'll take me to a password page but it also displays 2 images I chose during signup to verify that the page is "true". Only if the images match should I enter my password.

Overall both institutions seem pretty secure. Never had any issues with fraud with either (touch wood)

I also have an account with another canadian bank and they just ask for debit card number and a password. If it detects that i'm logging on from an odd location or IP it'll ask a security question too.

my UK bank asks for a 10 digit number and then it'll ask me for 3 random characters from my set password and then for a random 3 digits of my cards pin number.

Canadian credit union asks for member number then it'll ask me for the answer to a security question. If I answer right it'll take me to a password page but it also displays 2 images I chose during signup to verify that the page is "true". Only if the images match should I enter my password.

Those "images" were defunked a long time a lot. The phishing sites would actually grab the "images" from the legit site and show them to you on the fake one."

HSBC in the UK are ahead with this type of thing.

You have your log on ID and a password.

Then you have to input the six digits from their "Secure Key" device.

6a01053620481c970b015390bf1a2e970b-500wi

When turning on the device, it asks for a 4-digit pin number, then randomly generates a 6-digit number of which you have to input to get into the bank.

Hassle for when I am elsewhere, but I don't remember my log on ID so only log on at home where the secure key is.

Here's their link with a demo.

It's not strictly two-factor, but it's as secure as it gets.

You enter your card number on the site (not a credit card, number is never used to pay), then put your card in a portable reader thingy and use that to scan an optical code on your PC display. Select what you want to do (logon/sign/buy), enter your PIN and then you get a response to enter on the web page.

To sign transactions or to buy stuff you not only have to enter your PIN number on the reader but also the (total) amount. Pretty much secures you against malicious spoofing of your transactions. I consider this to be extremely safe and you don't have to remember any passwords.

  • 1 month later...

Mine uses a random generated 8 digit password which is send to the registered mobile to authenticate any online payment.

The bank also has 3 passwords.

1) Login

2) Transaction

3) Profile

Login password needs to be changed every 2 months.

So to complete any online payment, I have to know 3 passwords. Login, Transaction and the password sent to mobile which is valid for 1 hr.

Pretty decent.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I'm fine with a little reasonable promotion of Edge, but the degree which they do it right now I consider extremely unreasonable. 
    • Microsoft AI boss no longer believes that AI will replace human workers by David Uzondu Mustafa Suleyman, the head of Microsoft AI, recently took back his statements concerning white-collar jobs that he gave to the Financial Times in an interview made back in February, where he claimed that AI would replace office workers within 12 to 18 months. On Monday's episode of The Verge's Decoder, Suleyman recast the technology as more like a helpmate than a tool designed to take over your job. He explained that smaller office duties will "increasingly become digitized, automated" as people generate more digital materials. During the discussion, Suleyman emphasized a "very important distinction" between "tasks" and "jobs" to clarify his previous claims. He argued that his earlier comments only referred to individual actions that people perform at their desks. Suleyman used to work for DeepMind, the research lab he co-founded in 2010 alongside Demis Hassabis and Shane Legg, before he left in 2022 to establish Inflection AI and build an empathetic digital assistant. Microsoft hired him in March 2024 to lead its newly formed "Microsoft AI" division, placing him in charge of consumer products like Copilot, Bing, and Edge. His February comments also detailed plans for Microsoft to achieve self-sufficiency with a $140 billion infrastructure budget to train frontier models, predicting that creating a customized AI will soon feel like creating a podcast or a new blog: The 41-year-old is not the only AI executive who's softened his "AI will replace you" stance. OpenAI's CEO, Sam Altman, last month used X to push back against employment panic by arguing that his startup builds tools to assist humans rather than build replacements. He had previously garnered backlash by suggesting that many modern office roles that AI might replace did not qualify as "real work" in the first place, at least when you compare desk jobs to physical, historical labor like farming.
    • Adobe Acrobat Reader DC 2026.001.21662 by Razvan Serea Adobe Acrobat Reader DC software is the free, trusted standard for viewing, printing, signing, and annotating PDFs. Its the only PDF viewer that can open and interact with all types of PDF content – including forms and multimedia. It’s connected to Adobe Document Cloud – so you can work with PDFs on computers and mobile devices. Adobe Document Cloud is a revolutionary, modern and efficient way to get work done with documents in the office, at home or on-the-go. At the heart of Document Cloud is the all-new Adobe Acrobat DC, which will take e-signatures mainstream by delivering free e-signing with every individual subscription. Document Cloud includes a set of integrated services that use a consistent online profile and personal document hub. With Adobe Document Cloud, people will be able to create, review, approve, sign and track documents whether on a desktop or mobile device. Businesses will be able to take advantage of Document Cloud for enterprise which provides enterprise-class document services that integrate into systems of record such as CRM, HCM, CLM, and CMS, adding speed, efficiency and transparency to getting business done with documents. Adobe Acrobat Reader DC new feature highlights: Work with PDFs from anywhere with the new, free Acrobat DC mobile app for Android or iOS. Select functionality is also available on Windows Phone. Use the new Fill & Sign tool in your desktop software to complete PDF forms fast with smart autofill. Download the free Adobe Fill & Sign mobile app to add the same option to your iPad or Android tablet device. Save money on ink and toner when printing from your Windows PC. Store and access files in Adobe Document Cloud with 5GB of free storage. Get instant access to recent files across desktop, web, and mobile devices with Mobile Link. Sync your Fill & Sign autofill collection across desktop, web, and iPad devices. Adobe PDF Pack premium features includes: Convert documents and images to PDF files. Use your mobile device camera to take a picture of a paper document or form and convert it to PDF. Turn PDFs into editable Microsoft Word, Excel, PowerPoint, or RTF files. Combine multiple files into a single PDF (web only). Get signatures from others with a complete e-signature service. Send, track, and confirm delivery of documents electronically instead of using fax or overnight services (tracking not available on mobile). Store and access files online with 20GB of storage. Download: Adobe Acrobat Reader DC 64-bit | 719.0 MB (Freeware) Link: Adobe Acrobat Reader DC Home Page | Release Notes | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Meta will now use data from outside businesses to personalize AI responses by David Uzondu In an update that's rolling out globally (except in a handful of countries), Meta will use your data from outside businesses to personalize your AI responses and your primary feeds. Meta already utilizes your shopping activity to target ads, but the company now plans to expand this tracking to personalize other "parts of your experience" like feed algorithms and AI assistant chats. The company is replacing the two settings ("Your activity off Meta technologies" and "Activity from other businesses") that currently let you disconnect off-platform activity with a single, renamed setting called Activity from other businesses. If you don't want Meta to manipulate your feed and AI responses using your outside history, you can just turn the Activity from other businesses setting off in your account settings. This toggle resides within your Accounts Center, applying your choice to every connected profile. Turning this off will not stop companies from sending your data to Meta. The company will still collect your web interactions, but it only uses them to train products, while still accessing external accounts you connect. When The Verge spoke to Meta spokesperson Emil Vazquez, the representative said that this update will exclude several locations at launch, including the European region, the UK, Brazil, Thailand, South Africa, Turkey, South Korea, Ecuador, Nigeria, and Kenya. The new update comes at a time when the social media giant is recovering from a major PR disaster involving generative AI. Last week, there was a huge security issue on Instagram where attackers figured out a way to trick Meta AI into handing over account ownership (even if the victim had 2FA enabled). Some of the affected accounts include the dormant Obama White House profile, cosmetics brand Sephora, the Chief Master Sergeant of the Space Force, and security researcher Jane Manchun Wong. Internally, the company also had to scale back plans on its Model Capability Initiative (MCI), an employee-monitoring program designed to train corporate AI models by recording worker keystrokes and screen activity, after employees raised privacy concerns and complained about severe battery life drain.
    • JetBrains is working to cut false positives in RustRover 2026.2 by David Uzondu Recently, JetBrains released the fifth EAP build of its dedicated IDE, RustRover 2026.2, bringing improvements like a Run gutter icon for criterion_main! macro benchmarking and a feature that alerts you when there are unused traits in your current scope. Now, the company is out with a blog post addressing one of the "most common" complaints from users: false positives. In RustRover, a false positive occurs when the editor incorrectly highlights something as an error even though the project compiles and runs successfully. This mismatch flags a gap between the IDE's internal intelligence and the actual compiler. When the editor flashes red warnings over perfectly valid code, developers lose trust in the tool, which stalls momentum. Traditionally, RustRover runs cargo check to detect compiler errors and warnings, but it also relies on its own code analysis engine to power real-time features. To provide quick feedback, this engine parses your source code into a syntax tree while inferring types and resolving names as you type. Because this engine must work on broken, half-written code and react instantly, its logic sometimes diverges from the compiler's, producing false positives that do not exist in the compiler's eyes. JetBrains said that it has a "dedicated task force" focused specifically on identifying and fixing false positives by analyzing user reports and examining large-scale open-source projects. To speed up this process, the team built an internal system modeled after Crater, the famous Rust project that compiles and runs tests for every single crate published on crates.io. This automated pipeline compares the diagnostics from RustRover's analysis with actual compiler output to catch discrepancies before they reach users, ensuring smoother workflows. RustRover, for those who're unaware, is a dedicated IDE designed specifically for Rust developers. It's been around for a couple of years now, providing features like built-in debugging via LLDB, seamless cargo integration, advanced macro expansion, and HTML support. JetBrains distributes the app under two licensing models: a paid commercial subscription and a free option for non-commercial use.
  • Recent Achievements

    • One Year In
      Primer1st earned a badge
      One Year In
    • Experienced
      JayZJay went up a rank
      Experienced
    • Reacting Well
      Sir_Timbit earned a badge
      Reacting Well
    • Week One Done
      rubentuben8 earned a badge
      Week One Done
    • Week One Done
      ARaclen earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      512
    2. 2
      PsYcHoKiLLa
      229
    3. 3
      Edouard
      134
    4. 4
      ATLien_0
      87
    5. 5
      Steven P.
      80
  • Tell a friend

    Love Neowin? Tell a friend!