Getting bank card PIN from phone/wallet theft?

Azza · 6 Sep 2022 at 16:27

Street said:
Yep, I tested it yesterday with my Satander account and had found my ID, reset the password and got on to the app to view my PIN in under 5 minutes. All you need is the SIM card, bank card and ID with date of birth on, which presumably, were stolen along with her phone. Pretty shocking security wise! It never occurred to me before and I was wondering how they'd got around the iPhone lock/biometrics etc.

It baffles me that you don't need to do any of that 'What's your mothers maiden name?' verification stuff on either 'find my personal ID' or 'reset online banking' processes.

Pawnless Endgame · 6 Sep 2022 at 16:48

tom_e said:
She's full of **** and they refunded the money to make her go away.

koolpc said:
I believe she had the pin written down.

Feek said:
You can guarantee that the PIN was written down and kept with the card.

Sounds like something Simon0001 would do.

potatolord said:
Diary in her bag with her pin/ passwords/ login details?

Zenduri said:
An old favourite would be putting the pin in the phone as a contact. Used to see that a lot.

100% It was written somewhere so they got into her phone and her banking app and realising she ****** up she cried to the bank on twitter and they basically paid her off to stop bad press. The problem is people like this make it harder for genuine victims to sort this **** out.

I'm with you guys and also a Santander user.

You need either the Santander web login or your own biometrics to access the app. Changing the face or fingerprint with the phone would have caused the Santander app to revert back to asking for the web login.

So her relevant numbers (card PIN and Santander web login) surely were written down on something, in the same bag that had her phone.

Zenduri · 6 Sep 2022 at 16:52

Pawnless Endgame said:
I'm with you guys and also a Santander user.

You need either the Santander web login or your own biometrics to access the app. Changing the face or fingerprint with the phone would have caused the Santander app to revert back to asking for the web login.

So her relevant numbers (card PIN and Santander web login) surely were written down on something, in the same bag that had her phone.

I may eat my own words but turns out you can recover and reset the santander login detials by putting the sim in a new phone and following a process as long as you know the persons birthday which i assume they would if they had her ID in her purse/wallet

dlockers · 6 Sep 2022 at 16:55

Pawnless Endgame said:
I'm with you guys and also a Santander user.

You need either the Santander web login or your own biometrics to access the app. Changing the face or fingerprint with the phone would have caused the Santander app to revert back to asking for the web login.

So her relevant numbers (card PIN and Santander web login) surely were written down on something, in the same bag that had her phone.

Did you even read the thread before you agreed with all the incorrect people?

Try it yourself. Put your SIM in a dumb phone and go through the motions to reset your password. You just need your card, DOB and something else.

jpaul · 6 Sep 2022 at 17:07

You would expect them to be able to patch the behaviour quickly if the moved sim is the explanation
... whenever you change to a device with a new IMEI it should be asking for you to phone them, or send the code to a pre-declared backup device

Street · 6 Sep 2022 at 17:07

Scam said:
But how did they? This is what we dont know, right?

They didn't need to, just put the SIM in another phone. I did it with a spare phone here!

Azza said:
It baffles me that you don't need to do any of that 'What's your mothers maiden name?' verification stuff on either 'find my personal ID' or 'reset online banking' processes.

Yeh, it's appalling, you just need date of birth, post code, 16 digit card number and CVC number. Which, if you've stolen their wallet along with their phone, chances are you'll now have their bank card and drivers license.

Tom_ed1987 · 6 Sep 2022 at 17:47

Wouldn't transferring the victims SIM to another phone just bring up the SIM lock when they turn it on, & need the SIM pin code which the thieves wouldn't have?

Azza · 6 Sep 2022 at 17:51

Tom_ed1987 said:
Wouldn't transferring the victims SIM to another phone just bring up the SIM lock when they turn it on, & need the SIM pin code which the thieves wouldn't have?

Yes, if you've set a pin.

jpaul · 6 Sep 2022 at 18:26

yes he's right
now wondering why I've never enabled it, otherwise anyone who nicked the phone with a credit card could make online purchases.

Evidently the banks are not currently calling that negligent.

dlockers · 6 Sep 2022 at 18:28

jpaul said:
yes he's right
now wondering why I've never enabled it, otherwise anyone who nicked the phone with a credit card could make online purchases.

Evidently the banks are not currently calling that negligent.

Number high jacking means you aren't even secure with a SIM pin. People social engineer the call centre into releasing the PAC...

dlockers · 6 Sep 2022 at 18:29

Scam said:
But how did they? This is what we dont know, right?

Vote name change to 'cant scam'

GreatAuk · 6 Sep 2022 at 19:59

I remember having an Orange SIM that was pin locked years ago (like 2002ish -2009ish time I think) but had no idea what the pin was... Tried the 'default' options listed around the place but no joy so ended up getting PUK locked. Memory is a bit hazy but I think after some googling I found a sim serial number > PUK code calculator / list somewhere online which worked

. Probably not possible for newer SIM cards though I guess, Orange probably got hacked or used an unsecure algorithm for generating the codes or something I guess. (I'm 95% sure I never had to ring up customer services or whatever to get a code, as I don't think I even knew that was an option then, despite it being what everyone advises you to do now).

Anyway, since then I don't think any of my SIMs have come locked by default (or possibly came with a generic 0000 / 1234 code) and I never bothered setting a pin, because as my logic went there's no point risking the hassle of forgetting the PIN and getting locked out when I try to change phones in the future, and if my phone was stolen I'd be far more bothered by the loss of my phone than the loss of £10 or so of credit on my SIM card

. If a SIM pin is all that stands between me and my bank account getting pwned though I might have to rethink that...

Then again if someone already has your driving licence then I bet that's enough information for many mobile carriers to hand over a PUK code for the SIM, so it may not actually matter that much.

dlockers · 6 Sep 2022 at 20:02

GreatAuk said:
I remember having an Orange SIM that was pin locked years ago (like 2002ish -2009ish time I think) but had no idea what the pin was... Tried the 'default' options listed around the place but no joy so ended up getting PUK locked. Memory is a bit hazy but I think after some googling I found a sim serial number > PUK code calculator / list somewhere online which worked . Probably not possible for newer SIM cards though I guess, Orange probably got hacked or used an unsecure algorithm for generating the codes or something. I guess (I'm 95% sure I never had to ring up customer services or whatever to get a code, as I don't think I even knew that was an option then, despite it being what everyone advises you to do now).

Anyway, since then I don't think any of my SIMs have come locked by default (or possibly came with a generic 0000 / 1234 code) and I never bothered setting a pin, because as my logic went there's no point risking the hassle of forgetting the PIN and getting locked out when I try to change phones in the future, and if my phone was stolen I'd be far more bothered by the loss of my phone than the loss of £10 or so of credit on my SIM card . If a SIM pin is all that stands between me and my bank account getting pwned though I might have to rethink that...

Ah man that brings back memories! My first phone was an "Orange Savvy" and I managed to PIN lock it, then PUK lock it, and then try and enter my mobile phone number as the PUK about 30 times to ultimately brick it. All in about 3 hours of owning it. What a twerp.

jpaul · 6 Sep 2022 at 20:37

dLockers said:
Number high jacking means you aren't even secure with a SIM pin. People social engineer the call centre into releasing the PAC...

yes it was in my earlier post - reputedly they've tightened up post 2020

Moreover the several hundred car insurance I payed yesterday with a lloyds CC and sms confirmation code would have been vulnerable - nothing to do with Santander. ...
still I always cycle to the (better) gym with just a credit card,

Santander account, didn't everyone get one when they used to pay interest? is just used for paying utilities for the pittance of cash-back now.

Pity the banking app can't check if the sim pin is set before installing.

MikeTimbers · 6 Sep 2022 at 20:48

Don't ever put your wallet and your phone in the same place.

tom_e · 6 Sep 2022 at 20:51

MikeTimbers said:
Don't ever put your wallet and your phone in the same place.

One in my trousers and one in my pants?

MikeTimbers · 6 Sep 2022 at 20:52

tom_e said:
One in my trousers and one in my pants?

just use your phone to pay for things. why even carry a wallet?

dlockers · 6 Sep 2022 at 20:53

tom_e said:
One in my trousers and one in my pants?

SIM card inserted up rectum for added protection

dlockers · 6 Sep 2022 at 20:53

MikeTimbers said:
just use your phone to pay for things. why even carry a wallet?

My credit card doesn't need a battery

MikeTimbers · 6 Sep 2022 at 20:53

dLockers said:
My credit card doesn't need a battery

your phone battery often runs out?