X
Tech

Get bank statements on your mobile

But how secure is the service?
Written by Dan Ilett, Contributor

But how secure is the service?

Twenty UK banks are set to roll out ATM services to customer mobile phones by the end of summer.

Bank statements and mobile phone top-ups are the first services to be offered by Link, the cash machine operator, which has partnered with the banks.

First Direct has already announced it will be using the service, mobileATM, and major high street banks are set to follow.

Richard Kimber, chief executive of First Direct, said: "[Our] customers were the first to enjoy text message services back in 1999, following our earlier innovations in telephone and internet banking. We see mobileATM as a further way of extending choice and convenience for our customers."

To use the service, consumers must download a Java application onto their phone by sending a text message or calling Carphone Warehouse.

The application works on a chip and PIN principle, where the phone acts as the chip and the user types in their PIN. But to bolster security, banks have insisted on a second method of authentication: technology integration firm Morse built the application with the option of a one-time-use password every time the user logs on.

Professor Fred Piper, director of information security group, Royal Holloway University of London, said: "mobileATM has demonstrated that they take security very seriously. We have just completed an in-depth security risk assessment of their current service and are impressed with their security specification. [It] has excellent potential for helping to secure internet banking with their two-factor authentication system."

Although the mobile service is giving the option to provide two-factor authentication, high street banks currently offer no equivalent service for internet banking.

A spokeswoman for the Association of Payment and Clearing Services, said: "This isn't providing two-factor authentication - what it's doing is providing a platform or an option. This service allows you to view your account but you can't do anything like move money.

"This is one of two options for two-factor authentication. The other is card-based - what we're working on is an industry-wide standard for card-based. In the future you could end up with both but it's a commercial decision."

Editorial standards