Halifax on-line

They have taken their online service down because of an email scam. My bookmark points to the login page and gives some info on what is going on. Try this link and see if you get the page I get to which explains why they have temporarilly taken the service down:

- Julian

This news item just came up on my Yahoo homepage. It gives the details:

- Julian

I wonder how it could protect Halifax from users who give away their details to anybody asking?

Vadim

Yeah. I did wonder about that as well. It's an interesting problem. One of my online accounts (I can't remember which) has a choice of about 10 personal questions and it asks me a random one when I log on (things like "what is your father's first name?", "what was your first school?", "where were you born?". I can imagine that some people might be tricked by these emails into divulging their password and PIN number to a fake site, but it is hard to imagine anyone would be stupid enough to go to a site and re-enter all the personal questions and answers, even if they could remember what questions they'd set up in the first place.

I suppose another alternative, and unfortunately a costly one for the banks and hence for us (since they will find a way to pass the costs on to the customers) is to re-set everyones login details and post out new passwords with a very clear leaflet to warn people to never ever fall for this sort of scam again. If this is the approach they end up taking then I fear we will be denied online services until we can get fresh passwords, i.e. days or weeks rather than hours or days.

- Julian

Presumably it protects the users from their own naievity, at the cost of possibly annoying the rest of us. I don't see the logic of reopening the site today though - unless they are changing all our passwords!

An Email notification would have been courteous.

AFAIR Barclays at least have said that only a handful of people have given their details away. Presumably most people clued up enough to operate online accounts don't fall for such obvious scams.

It's perhaps a bit surprising that they don't make more use of digital certificates, which pretty much remove the possibility of this kind of scam, but I suspect that they're too complicated for a lot of people to manage.

Indeed.

John.