A few days ago I received a brand new Nationwide Debit card. This was to replace my old card which was working fine.
Being a bore I realised that they must be introducing Card Readers, as this would be the only reason for them reissuing people cards, and a couple of days ago my assumptions were validated, when I received a new Nationwide Card Reader through the post.
As with Barclays and NatWest the Nationwide Card reader is in essence the same under the covers, as all these Card Readers follow the same APACs 2FA (2 Factor Authentication) standard, therefore a Barclays Debit Card can be used in a Nationwide Card Reader for Barclays Online Banking. However whereas the Barclays card reader labelled PINSentry is specifically built for Barclays around Accessibility (with rubber pads to stop it moving on a desk), the Nationwide Card reader is a pretty generic device, and in my opinion not as well built as the Barclays, but lets be honest they all do exactly the same thing.
The 2FA Devices rely upon the User using their card in the device performing one of the 3 security features and then being generated a 1 time only passcode they can then enter into the corresponding Online Banking site. There are currently 3 Security Features of the APACs 2FA Standard, and each device regardless of the manufacturer can perform all 3 features:
Identify - The simplest verification method, using Bank Card and PIN to provide a 1 time passcode to the Customer.
Capture and Responce - This is slightly more complicated, asking the customer to enter then PIN and then answer a number of questions before receiving a 1 Time passcode.
Sign - The user enters their PIN, and the account they are paying followed by the amount and are generated a 1 time only passcode to sign that particular payment transfer.
How Nationwide are using 2FA
The interesting thing to note, is how Nationwide are planning to use 2FA Card Reader. They are NOT planning to use the device for logging in to the Online Banking site (Barclays currently do this)
Instead they are planning to use the Capture and Response feature to validate a user when the user is doing the following:
- Viewing a Statement PDF
- Changing their Memorable Data or Passnumber
- Changing an individual 3rd Party payment.
They are also using the Sign Feature similar to Barclays to Sign every 3rd Party payment, or when changing details of a regular 3rd party payment, e.g. an external Standing Order.
Only time will tell as to which Card Reader process will prove most favourable, but it is good to see all the Banks jumping on the 2FA bandwagon. I am also aware HSBC is currently performing a closed trial of 2FA Card Reader authentication, so I think its only time before HBOS and LloydsTSB follow suit.
What will be interesting is if firstdirect implement 2FA card reader security for their online banking.
Links:
http://www.nationwide.co.uk/security
http://www.barclays.co.uk/pinsentry/
http://www.natwest.co.uk
http://www.halifax.co.uk
http://www.hsbc.co.uk