OT - Which is Safer, Internet or Phone

[thescullster]

Came to renew the car tax last week and the credit card is near limit.

Don't like using debit card on-line due to (perceived) lack of protection against fraud etc. So decided to use debit card and touch tone automated phone renewal.

Although this takes much careful input of numbers into phone, it all went smoothly.

Got to wondering whether there are security loopholes using this method. Clearly with on-line card detail entry there is possibility of key log virus, scam sites, wireless sniffing (if you use wireless for financial transactions - I don't). But are there equivalent weaknesses in these automated phone transaction systems?

Also, does anyone know if a written acknowledgement is sent as proof of tax status?

Thanks

Phil

[Dave Plowman (News)]

Dunno about acknowledgement. You can tick a box for this online. Never done it by phone - no option to press a button for one?

My feeling is it would be very much easier to hack into a phone line and get your details that way - if anyone could be bothered. Mobile more difficult.

You do know you pay extra to use a credit card over a debit card for VED?

Must admit I rely on Spybot to tell me if anyone tries to install a nasty here.

[Adrian]

But you'd have been happy to use credit card online...?

Why not just go down the post office...?

[Chris Bartram]

It's possible, though unlikely, someone could listen in and decode the DTMF keystrokes.

There's no written acknowledgement, but you can check tax status online:

.

BTW, Not doing transactions over wireless is a bit paranoid IMO. Your wireless connection (should be) encrypted anyway, plus the financial site would also be over HTTPS, so you've got 2 levels of encryption. The real worry is whether you trust the other end to be secure (see

for just one recent example), and (less likely) a man-in-the middle attack between your router and the server.

[thescullster]

snip...........

No, there wasn't an option presented for this.

But is the hacking of phone lines widespread, generalised and indiscriminate like malware?

Yes I did pick this up during the renewal process ta.

IME, whatever malware/anti-virus solution you use will fail at some time. But this may not be obvious until specific issues start to occur with your device. Then you download a different app, rescan and find the nasties that have slipped through the net.

Phil

[thescullster]

Happier using credit card than debit card due to higher levels of insurance/fraud prevention protection.

Going down the post office involves surgical removal of an appendage.... the settee! Not sure how long the Post Offices will still be involved now there are no paper disks to be issued.

Phil

[Adrian]

They come into play if a purchase turns out to be iffy. The fraud protection would be pretty much the same in a case like this.

Either way, so long as you don't do something daft using a fake website or fake number, the risk is minimal.

Poor lamb!

I don't believe there's any plans to stop. There'd be an outcry if they did. If they were going to, they'd have done it in October. But, if you're worried about it, more reason to do it over the counter now, to show that customers do still want it.

[Sailor]

thescullster wrote

You can phone the DVLA callcentre to renew tax

Not exactly rocket science is it.

[Dave Plowman (News)]

That's what my brother says and does. Round here, even in central London, there's not a post office close to where I normally shop. So It would either be a longish walk or pay to park. And then queue. Sometimes for ages. If you do have a post office without a queue, I wonder how long it will survive.

Taxing the car online takes a matter of minutes. And now there's no disc to display, can be done at the last minute too.

[Dave Plowman (News)]

I did once have a convenient sub post office locally - and where you could park for free. However, it didn't do VED - if it was still there it probably would now as things changed for that.

It was closed down. The owner said it was profitable - the PO wanted to increase the use of the main branch about 3/4 mile away on the High Street with no free parking. And anytime I used it a massive queue. Which was generally only to tax the cars. As soon as this became possible online, I no longer use it. For anything.

[thescullster]

Thanks Chris

The tax and MOT status site is useful. I think I renewed in the last five days, so it still shows my car as Taxed and Due.

Having both wired and wireless networks at home, I prefer to use wired connection for anything sensitive. Despite encryption, mac address filtering and wireless isolation, I will still use wired for speed and security.

Interesting Moonpig link - not seen that one!

Phil

[bert]

In message , "Dave Plowman (News)" writes

To do that you would have to know which phone line to listen to and when. This would require access to and knowledge of an exchange or street cab. Whereas to hack online transactions the hacker can sit at home and generate a suitable malware and let it spread itself and pick up combinations of user id/password or card no/security code at random

As should everyone - other ant-nasty software tools are available

[Dave Plowman (News)]

Yes you would. But for those who are paranoid about such things I was simply saying I personally would find that easier to do.

The hacker has to write suitable software *and* get it installed on your computer. Then interpret the results. I've a feeling simply sending out lots of phishing emails may get easier results.

And at least try and understand what it's telling you. If it blocks a change to the registry and you simply click on OK to let anything happen, it may not be worth bothering with.

[Reentrant]

You can now also pay by Direct Debit, which is protected against fraud by the bank's DD Guarantee. There's no DVLA surcharge if you pay for 12 months by DD.

[John Rumm]

The main weakness of most of these systems are not the card details in transit, but in their safe keeping by the back end systems once they have them. So phone is unlikely to be any different in that respect.

You can presumably check online:

[Michael Chare]

If you apply online you do get an email. It did make me think I had spent £270 just to get an email.

[Sailor]

John Rumm wrote

Crap. There is no need to keep CC details once the transaction is complete. If you allow the likes of Amazon to keep your card details, more fool you.

[John Rumm]

How would you know?

Just because there is no need to keep them for an extended period, that does not mean that they don't have a need to keep them at all.

If they are kept for any period of time, then they are vulnerable. Even if immediately discarded after processing how do you know they are not still sat in memory or scattered in a page file etc?

As always its a trade off of security vs convenience.

[John Rumm]

Tthat is exactly what he said he did... do keep up at the back!