Receiving 2FA codes

I may be overthinking :roll_eyes:

At the moment, we have a few bank and other accounts which provide 2FA via SMS. I have them all set up to send me the SMS, which means that Madame would have a problem in the event of my incapacity.

The only solution I can think of is to have a phone number accessible to both of us, on a phone used solely for this purpose.

Use the App if the accounts have one. That removes most of the SMS needs.

It skirts 2FA in some ways - you need SMS to link the app and accounts - but after that it’s generally a mix of “authorised” device - password and fingerprints on most of the ones I use.

Purchases are approved by opening the app and “approving” - the app will always need a password/fingerprint to open.

1 Like

Thanks

Rather than edit. The approval of online purchases doesn’t skirt 2FA. In many ways it’s better (you need a password or fingerprint to open the app) not just have the phone like an SMS

It’s things you do inside the app that skirt 2FA. Log on with my fingerprint - approve with my fingerprint… The fact I “approved” the device I believe is what counts as first factor.

1 Like

Also, if your stuff gets stolen, it’s harder to access the app than it is your incoming text messages as they just need to put your SIM in another phone if they can’t access yours.

1 Like

It turns out the old HTC phone will take up to 5 fingerprints as ID. So I think I’ll use that.

If they have a phone with fingerprint authentication enabled with their fingerprint, could they put your sim in their phone and use that to get into your banking app ? Yes, it will be detected as a new device but then they usually send you an SMS or email for confirmation.

No, as they wouldn’t have your credentials to login to the app (hopefully). SIM swapping only really works for SMS and voice call authentication. That’s why it’s highly recommended to have a lock code on the SIM so that, even if they swap it, they won’t be able to unlock it.

I login to my Revolut account on my phone with just my fingerprint. Nothing else is required. If I try to login on a new phone, I assume an SMS or email acknowledgement of my login on a new device will be needed. If it’s an SMS with an authentication code then simply putting my sim in a new phone would allow someone to bypass the security with thier own fingerprint. If it’s an email, more difficult. If it’s enter your other credentials then impossible without knowing my other credentials, which aren’t of course in the phone. I would hope that they use the last method.