NatWest - home card reader?

[Max Demian]

With Barclays?

[Theo]

HSBC Group's (HSBC, First Direct, M&S Bank, maybe some others) two-factor-authentication device is not a card reader. They're a Vasco Digipass - the device is keyed to your account and is used instead of a card, not with it:

Probably the most common EMV CAP (ie card readers) are made by Gemalto (formerly Xiring):

- these devices are mostly interchangeable. However you do need the EMV CAP 'app' on your card: you'll get a 'wrong card' or similar message if the card has no CAP support. Generally, only cards that are used for online banking have the CAP app - most credit cards, for instance, don't.

I don't think Lloyds Group (Lloyds, Halifax, Bank of Scotland) use card readers or tokens, instead using codes sent by SMS - at least for consumer banking.

(Many banks also rely on a mobile app as an alternative 2FA solution, relying on passcodes or fingerprints to authenticate you to the app, and then using that to generate login codes)

Theo

[Michael Chare]

I have 3 different ones and as far as I am aware they are completely interchangeable. If I go on holiday I usually take the one belonging to the least important a/c.

[Dave Plowman (News)]

But you need your card and PIN?

[Martin Brown]

It is the first two, four or six digits of the card that determine the card issuer - every bank has a different IIN prefix.

Indeed catches any single digit error and most transpositions.

Based on what someone else has said I would be inclined to believe that the cards intended to be used with an offline reader contain an app or flag that isn't present on cards belonging to banks that don't use it.

[Robin]

No, with 3 other banks.

I thought Barclays deleted payees after _13_ months of inaction (which gives a month as leeway for "annual" payments such as a water bill).

[Martin Brown]

That seems unlikely. I have more than one account with my bank and all their cards work in the same card reader (different PINs).

Until recently HSBC used a magic clock 6 digit dongle device which was user account linked but the new one is more like a card reader. I no longer bank with them.

[Martin Brown]

I have had some problems trying to figure out how to delete old ones for eg. non-existent defunct credit cards. That has improved recently.

[Bob Eager]

Click on the Security item on the left hand menu. There's then a link for ordering a (free) card reader.

What the system does is give you a one-time code. The card reader reads your card (and validates it with the PIN). Then you enter the one-time code and get another back. That is entered on the bank site.

Proves you are in possession of card and PIN. Only needed for setting up newv stuff, usually.

[John Rumm]

Yes, you can only use each code once. You can pre-computer a few of them and store them for later use. That will let you login without the machine and card, but you still would not be able to authorise a new payee.

This *is* 2FA - the specific object you must possess is the bank card. Without it, you can't use the card reader to generate a identification code or to authorize a transaction.

[Andy Burns]

No, because for certain transactions in-branch, they will put your card in their reader (same device as yours) and ask you to enter your pin into it.

[John Rumm]

Some of the devices handed out for some banks are not actually card readers, but real time secure token generators. They generate a code based on the current time and the user's pin, but don't actually use the card at all. In those cases the device itself is tied to the users account and is not interchangeable.

[Michael Chare]

What annoys me is that I can't use these devices to check a credit card pin.

[Dave Plowman (News)]

True. Perhaps you shouldn't have your PIN written on the card?

[Martin]

How would they know your PIN?

[Martin]

HSBC's are set up with the users PIN code in it.

[Martin]

+1

[Dave Plowman (News)]

Yup - I had that too, with Barclays. Asked at my local branch - not the one I'd previously been assigned to - and couldn't really get a satisfactory explanation. Or where I should post the odd cheque to in future - they suggested using the paying in envelopes. Website not much help either. Think the answer was simply post to any branch you have the address for. Seemed odd. ;-)

When my nice convenient local branch closed, they wrote to me saying I was being transferred to another. And not the closest one to me either. But by that time I didn't much go to any branch anyway. But wasn't informed when they closed that new branch, and given a another one as before.

[Martin]

or cut off fingers when they introduce finger print ID.

[Dave Plowman (News)]

I have two current accounts with different cards and PIN for both. Same PINsentry unit works with both.