O2 Wallet

[Tezcatlipoca]

I locked myself out of my O2 Wallet a couple of days ago, after entering (according to the website) the incorrect Pay Password too many times when trying to remove a bank account.

I am absolutely certain I was using the correct password. I used it a couple of days earlier via the Wallet app on my iPhone to activate my physical card.

I phoned up O2, reactivated my Wallet, and then went online and changed all three O2 passwords (O2, Wallet, Pay).

However, this has got me worried about the security of my account, and about the security of O2 Wallet in general.

My ultimate fear is that somehow someone gained access to my O2 account, and changed *just* the Pay password, so that they could sit and wait for me to load money into the Wallet, and then they could add their own bank account as a payee and drain all my money.

If that isn't the case, then somehow I did actually enter the incorrect Pay password multiple times, despite being absolutely sure it was correct... Or... the Wallet website itself was incorrect, and told me my password was wrong when it was not?

Anyway. These are areas in which I think O2's security could and should be improved:

1) Password length. A maximum of 12 characters (IIRC) is IMO too short.

2) Main O2 password. When you change this, you receive an email informing you that the password has been changed. This is good. But... you do not need to enter the current password again before creating a new password, unlike with *many* other sites and services. This is bad.

3) O2 Money password. You do need to enter the current one before creating a new one. This is good. But... you do not receive an email if your O2 Money password has been changed, unlike when changing the main O2 password and unlike with *many* other sites and services. This is bad.

4) O2 Money Pay password. You do not need to enter the current one before creating a new one. This is bad. You do not get an email if the Pay password has been changed. This is bad. If someone has somehow gained access to your O2 Money account, they could easily change your Pay password, enabling them (AFAIK) to potentially add their own account and then drain your money.

Something that other sites & services do that I think O2 should do (in addition to always requiring the current password to be entered before allowing it to be changed, and in addition to always sending an email notification when any of the passwords have been changed):

Proper verification when adding a new payee or doing anything else that justifies an extra layer of security, rather than just a "Pay password" that doesn't really IMO give any additional security.

e.g. NatWest online banking requires you to use your physical card and the NatWest card reader to generate a unique one-time code each time you want to add a new payee. This way, if someone has somehow breached your online account they will also need your actual card itself before they can add themselves as a payee and drain your money.

e.g. Santander online banking sends you a unique one-time code via SMS each time you want to add a new payee. This way, if someone has somehow breached your online account they will also need your mobile phone before they can add themselves as a payee and drain your money.

For O2 Wallet, the Santander method would be more appropriate than the NatWest method as not everyone will have a physical card. In fact, this method is already used by O2 Wallet for activating the O2 Wallet app on a mobile phone: You enter your main O2 password, and then get sent a code via SMS. Why not extend that to replace the Pay password?

Also: The option of some sort of "2 step" method for logging into O2 Wallet (or even better, the initial main O2 login itself) would be great, too.

PayPal's "2 step" method uses SMS to send you a code that you enter after you enter your password, and I think you can also opt for a physical code generator for a small fee. Google's "2 step" method uses a mobile app that generates a code that you enter after you enter your password, and I think you can also use SMS too. Other sites and services such as Blizzard's "Battle.net" (WoW, Diablo III) and EA/BioWare's "SW:ToR" also allow the option of "2 step" verification, using a mobile app or physical key to generate a one-time code.

Also: I think that the Notifications section in the O2 Wallet dashboard should give more information, e.g. it should tell you the time & date of any password changes, the time & date of each login, and also the IP address(es) of the last few logins. Other sites provide this sort of information, and I think it would be very helpful for a financial site such as O2 Wallet to have it.

[Anonymax Level 16: Talkative]

I understand your concerns and I'll try give my view on them as best I can.

If someone gained access to your O2 account (Portal) - they wouldn't have access to your Wallet in any way unless you used the same password for your O2 Portal account and Wallet. Wallet password requirements are more strict than standard O2 Portal passwords. Someone would have to know your Wallet Account password or Pay password to access your Wallet.

Regarding being able to reset both Wallet Account and Pay passwords from within the Wallet - without having to type a current confirmation. There's a few points here. Firstly, there's a very short timeout for the Wallet - if you don't interact with the Wallet site for about 120 seconds, it signs you out. So in order to change your Wallet passwords - someone would have to have access to the computer you just signed in with within 120 seconds of you last using it, without you seeing then. It's such a short timespan - that it makes it an unlikely scenario.

Currently the way to reset your own Wallet Account password is by either knowing your Pay password, or to call customer services. Once you're inside your Wallet, you can update either of your passwords. For the Account password reset, I don't see a problem with the current system. However I do see your point about the Pay Password not requiring you to confirm the old password. But I can think of a reason why they don't ask right now - usability.

The way the user-initiated password updates are done now are probably to make it easy for the user to update their passwords. Some people will be using the plastic Money card as their main access to the wallet, so they will rarely use the pay password and are likely to not know it when they do try to sign in online. They will probably remember their money account password as they may frequently sign in to perhaps check their balanace, but they may not be making use of features like money messaging which require that pay password. Also once 3DS (Verified by Visa) is set up, it uses a completely different password too.

They did make a change to the wallet to help users with all the passwords. At launch, your Money Account and Pay Password could not be the same. However they changed this and now they can be the same - to help users who perhaps struggle to remember various passwords. 

Overall the wallet is very secure. I can understand your concerns, but I hope you can understand that at the end of the day, to access your wallet, someone has to know:

Your O2 Portal account credentials +

• Wallet Account Password OR
• Wallet Pay Password OR
• Lots of personal and account specific information to call customer services, posing as yourself.

And I like the idea about making the notifications more detailed. When you unblocked and reset your passwords with customer services, you should have recieved a few emails and text messages informing you of those actions, as well as some notifications on your Wallet dashboard. Information like IP address access etc - while nice - may be confusing to users who don't understand or appreciate such details.

[Leonard]

Hi Tezcatlipoca,

Great post! You've obviously given it a lot of thought. So, thanks for making those suggestions and being so articulate about your concerns.

I've forwarded your post and have been assured your feedback will be taken on board and your concerns will be investigated ASAP. I'll give you an update as soon as I get more info.

Thanks again,

Leonard

[iooiuk]

Great post.

But I think we have too many diffrent passwords etc in this product. Hence why people will think they are entering a correct one, but possibly are thinking of another one.

To me 2 is more than enough.

I certainly don't agree with a max of 12  not being secure. Security in a pass is down is user choice of letter/number combinations.

Sure longet apsswords take longer to force crack, but that is not done very often... It more phishing that gets details....

So to me it's education of users and that fact a finanical co WILL NEVER ask for PIN or full passwords via email or such.

[jonsie Level 59: Quartermaster]

---

iooiuk wrote:

Great post.

But I think we have too many diffrent passwords etc in this product. Hence why people will think they are entering a correct one, but possibly are thinking of another one.

To me 2 is more than enough.

I certainly don't agree with a max of 12  not being secure. Security in a pass is down is user choice of letter/number combinations.

Sure longet apsswords take longer to force crack, but that is not done very often... It more phishing that gets details....

So to me it's education of users and that fact a finanical co WILL NEVER ask for PIN or full passwords via email or such.

---

I fully agree, two strong passwords is more than enough and obviously don't assosciate them with any personal details. I would hope that everyone would be fully aware now of phishing emails and be intelligent enough not to give any security information away and to just simply delete them.

[iooiuk]

---

jonsie wrote:

---

 I would hope that everyone would be fully aware now of phishing emails and be intelligent enough not to give any security information away and to just simply delete them.

---

Sadly not.....

I speak  to far too many people who are not even aware of phishing emails......

Or that you should NEVER give your PIN to anyone who call's you. No matter if they say they are from the bank.....

Even your bank staff do not know your PIN or even have any reason to know it.

[perksie Level 58: Overseer]

I've just had to stop a friend signing up for a free £175 Tesco voucher on Facebook.

[jonsie Level 59: Quartermaster]

---

iooiuk wrote:

Sadly not.....

I speak  to far too many people who are not even aware of phishing emails......

Or that you should NEVER give your PIN to anyone who call's you. No matter if they say they are from the bank.....

Even your bank staff do not know your PIN or even have any reason to know it.

---

I work in a bank myself and I find it's mainly the older generation who fall for the emails and, sadly, the phone calls.

[perksie Level 58: Overseer]

That's true older people just can't deal with the levels of underhandedness that exist now.

The youngsters on the other hand are making problems for themselves on sites like Facebook, where they feel it's cool to "Like" everything they see, and don't seem to be aware of the risks.

Facebook in particular is riddled with dodgy apps and scams.

[Tezcatlipoca]

Interesting replies, everyone. Cheers

A point regarding the comment about someone needing to know the O2 Portal credentials *plus* lots of personal info... The O2 Portal actually displays lots of personal info itself... Not just the name, address, DOB, phone number, and email address, but also the security answer. So if someone did have access to your O2 Portal account, they'd have all the information they needed right there...

Displaying most of it in your account details isn't an issue, but I do think it is a mistake to show the full security question *and* answer. Seriously, how many other sites actually show you the security *answer* when you look at your account info? I can't think of any myself, offhand.

Anyway, aside from that...Back to the wallet...

Even accepting that a 12 character password is sufficient, I still believe that the following are issues that should be corrected:

1) When changing your main O2 password, you should be required to enter the current password. [you do at least get an email already]

2) When the O2 Money (Wallet) password has been changed, you should receive an email informing you that it has been changed.[you do at least get asked the current password already]

3) When changing your O2 Money Pay password, you should be required to enter the current password. And when it has been changed, you should receive an email informing you that it has been changed.

4) Adding a new payee (or doing something else major) should require additional verification, such as via having to enter a code sent to you via SMS. SMS verification is a common form of additional verification used by other financial websites (such as Santander) along with Google, Yahoo, PayPal, and various others. It is also already used by O2 Wallet when activating the mobile app on e.g. an iPhone, so why not extend it further to provide real protection for adding a new payee and so on?

I'm not particularly confident about trusting non-trivial amounts of money with a service that IMO not only does not have the same kind of security as "proper" bank websites, but also doesn't even match what you would find with some other non-banking sites and services.

Anyway. Apparently my concerns have been passed on, so we'll see if anything does happen eventually...