Instant online transfers promise to remove the often frustrating delays that come with online payment transfers. With the ability to use an email address or phone number to transfer money (instead of BSB and account number) about to increase, it all adds up to online payments becoming quicker and easier than ever.
CHOICE looks at the new technology, security considerations and potential outcomes with our latest article on real-time payments:
*EDIT At last check, the service intended for launch in early 2018. Check the Osko website for the latest updates.
New Payments Platform (NPP) didnāt happen in 2017. But media statements now saying it will happen after January 2018.
(not to be confused with National Privacy Principles (NPP) )
Thanks for highlighting my error @vombatis, Iāve edited my comment to reflect the reality. The initial launch was also delayed, so it seems to be a case of āwait and seeā at the moment.
Part of the changes involved in NPP is the ability to register a label for your account (for example use your email address or phone number as identity for your account) so that the payee does not need to know/remember your BSB and account number. This PayID is an RBA initiative.
Yet we havenāt heard concrete anything from the financial organisations about how we register these labels. If that isnāt done there wonāt be anything to make work next month.
My bankās website says:
āWhen the service is launched in early 2018, weāll be in touch with all the info you need to register your PayID via the bank app or Internet Banking.ā
That is our story of life. āwhenā. I will be more impressed when I read something our illustrious governments have done that can be published with present or past tense rather than future tense. Waiting for Godot is not a very gratifying life.
A rather significant privacy issue has arisen with the PayID aspect of NPP:
Basically, those who sign up are adding their phone number or e-mail address to a reverse look-up database anyone can use. This isnāt unprecedented - social media platforms let you search for other members in the same way, but people are wise to that and have their privacy settings set accordingly. We have different expectations about how banks handle our personal info.
I find NPAAās response a bit disingenuous. They describe it as an optional feature that individual customers are making their own, informed decision about. In their view, āa person chooses to create a PayID they do so with their full consent, informed by the terms and conditions of their financial institutionā. In the real world, few read T&Cs and the banks are only promoting the benefits.
Is it any more of a worry than the phone book? Not sure thatās the right question. Itās a different database linking different pieces of information - e-mail or phone number to a name, rather than name to a physical address and phone number.
You probably ought not use this functionality unless you are a business. I would assume that most businesses intentionally publicise their phone number (they want to be contacted!) and the number could typically be mapped to the name using a search engine anyway.
Perhaps that is the test for whether to opt in. Search the web for your mobile number. If your name comes up then this new system isnāt much worse.
How long before scammers use this in order to send better text messages? Right now they may send to a whole lot of random mobile numbers but they might not be able to include the correct name to address the recipient with in each text message. This database helps the scammers with that.
While it may be opt in, users may not be giving informed consent if they donāt know about all the relevant considerations. The worst case would be where someone has intentionally opted out of the white pages for safety reasons but ends up in this database anyway. The typical scenario would be a woman escaping an abusive partner.
There are too many valid phone numbers compared with the length of a phone number. The fact that someone can even guess valid phone numbers is not ideal. If you had a one in a zillion chance of even guessing a valid phone number, that would slow the scammers and spammers down.
Presumably this whole thing would be more satisfactory if you register an email address rather than a mobile phone number - since you can invent as many new email addresses as you want at essentially no cost.
Not having used this system (yet) I wonder whether, as an individual (not a business), it is possible and permitted to register a āfalseā name against the mobile number and/or email address. When giving out the mobile number or email address to legitimate payers you could tell them what the expected name will be.
Pretty much anything to do with money or banking is more of a worry than a phone book.
I am always annoyed when a company sends me an email with a link. They should know better by now - I certainly do, and if it appears to be actionable I log into my account entirely separately to the email.
Some companies say āyou know itās from us because we use your nameā. Oh great - thatās an incredibly secure way to do business, as shown by PayID.
If you have requested a password reset sometimes it is an active link in an email you get to action the change. Hopefully they provide a link you can copy and paste as well but I have had some that do not and even with some of the copied links you have to hope the link is a safe one. I also prefer the links that have a time limit to use them so that once expired time wise no one else can use that link to take action on your account.
Two factor authentication is also useful in these cases eg you request the change but no link is sent until you type in the code supplied by email or SMS.
This is one of very few instances in which I will click a link - because a fraudster would need to know that I had requested the reset. Of course, as I use a password manager it does not occur very often.
With my bank even if logged in I need to request a change using 2 factor authentication, while not a link it still is an extra step worth having. Nor do some sites allow me to change internally until I have authorised the change by validating by an email link as an added security measure. Certainly Password Managers make the problem of forgotten passwords much less likely.
With my banks if I am making a payment to a new payee (even with PayID) then I am also required to authorise that new payee/payment by responding with a one time code. Again a safety feature to reduce the risk of a fraudulent transaction being actioned by a third party.
Even then Iām sure many people would check where the link is going against what is plausible. That wonāt catch all scams but it is a good idea.
Just putting it out there ā¦ mass data breach of large mainstream company, the company in question sends out a notice to all customers informing them of the breach and suggesting that customers change their password (perhaps even though the plaintext password has not been compromised), then it might be possible for a scammer to inject random emails with fake links and get an acceptable hit rate to make it worth his or her while.
If in fact the scammer was responsible for the data breach then the hit rate can be close to 100%. (The scammer might still want to do this because it converts a salted and hashed, best practice, password into a plaintext password.)
I am the same as the reset password email usually comes in within seconds of requesting to reset the password with the account holding website. If an email came in without a request, it would automatically be suspicious. The risk of this email being hijacked and amended in between the request and its receipt is almost zero.
The only risk is using a clickable link to reset a website password as this may divert one to a website which looks authentic, but is fishing for information. Such is only likely to occur if scammer, for example, send an email saying that your account has been suspected/expired and one needs to update their password using the provided link. This in itself should raise alarm bells and one show only ever request a password reset either through typing in the relevant URL or using that stored and known in oneās password manager.
