Does using a VPN impact online banking?

[The Theory]

On 1/13/2024 at 6:06 PM, BananaBandit said:

Why have they (apparently) removed email as a method of receiving a verification code? 

I don't know about CS, but my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 
I figured smaller banks won't comply with customers needs, in fact their own ease of work or less risk is a priority.

[VBF]

On 1/16/2024 at 4:20 AM, The Theory said:

I don't know about CS, but my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 
I figured smaller banks won't comply with customers needs, in fact their own ease of work or less risk is a priority.

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on. Some of them used to send an email but no more. When asked they usually mutter something about it being a Financial Conduct Authority rule but I'm not entirely sure they're correct.

[scottiejohn]

56 minutes ago, VBF said:

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on. Some of them used to send an email but no more. When asked they usually mutter something about it being a Financial Conduct Authority rule but I'm not entirely sure they're correct.

I have more than two UK Bank accounts, plus Wise and 2/3credit cards and use both Aps and online banking for all via a VPN saying I am in the UK and never have to get an SMS.   (I am obviously NOT stating what banks/companies etc for privacy reasons)

Occasionally I am asked to log on to the app of the authorising bank to allow a transfer. 

I have both UK and Thai SIMS on my phone!

Edited January 17 by scottiejohn

[VBF]

12 minutes ago, scottiejohn said:

I have more than two UK Bank accounts, plus Wise and 2/3credit cards and use both Aps and online banking for all via a VPN saying I am in the UK and never have to get an SMS.   (I am obviously NOT stating what banks/companies etc for privacy reasons)

Occasionally I am asked to log on to the app of the authorising bank to allow a transfer. 

I have both UK and Thai SIMS on my phone!

Similar to you in terms of multiple accounts - but one of my UK banks requires authentication for every login, either by a card reader or SMS - my choice each time

Another states that a SMS containing a one time code will be sent at random logins and that seems to be the case (although doubtless there's an algorithm controlling the "randomness" somewhere)

I've just tried both of those using Norton's free VPN and both work.

Oh and yet another account will also send a SMS "randomly"

 

Not doubting your word but I find it odd that you're using UK banks and never getting SMS's  although I do not use any banking Apps on my phone - all mine is done on a PC.  Obviously the phone is used to receive the SMS's!

Edited January 17 by VBF
clarify

[scottiejohn]

9 minutes ago, VBF said:

I do not use any banking Apps on my phone - all mine is done on a PC.  Obviously the phone is used to receive the SMS's!

I suspect that is why!  By having a UK address, phone apps with UK VPN and using the same "trusted" PC which I originally authorised by my phone app via UK SIMM/VPN (can't remember which during setups) I never get an SMS! (make sure the cookies to the Financial companies are never deleted (Ccleaner etc))

[KhunHeineken]

On 1/16/2024 at 2:28 AM, soi3eddie said:

 

I VPN via my Synology Diskstation in the UK. That way it uses a UK IP address which I need to login to two business websites that geo block anything from outside the UK.

If using a popular VPN provider (such Nord, Surfshark etc.) the banks may well see a large number of connections from the same VPN IP address or range which could trigger a block. If using an IP address that is dedicated to you, then they cannot tell whether or not it's a VPN. Nord VPN are now offering dedicated IP addresses for a monthly fee.

 

Been there, done that.

 

I paid for a dedicated IP Address only to be blocked.  When I emailed the VPN company and asked how is it an IP Address, only used by me, can be blocked by a website, their answer was, basically, data center IP Address are different to residential IP Addresses. 

 

I then set up a VPN to my router in my home country and haven't had any problems. 

 

For those who can not have access to a friend's or relative's router to VPN back to, I have suggested before to look into a decentralized VPN.  Basically, someone in a house rents their router and bandwidth out to you for really cheap. 

 

You can stream and surf for hours on their residential IP Address for small money.  They are pay as you go, not a subscription, so perfect for the casual user. 

Edited January 17 by KhunHeineken

[RocketDog]

I Use Trust.Zone vpn,ususlly a Singapore 185.xxxx IP.

If I have trouble logging into a USA site, such as my bank in Colorado, I change to American IP. This is rare.

 

Just today I logged into my TDAmeritrade and Wise accounts from Singapore with no issues.

FWIW

 

 

[sandyf]

On 1/13/2024 at 8:24 PM, Moonlover said:

They cannot detect a VPN, but they can detect that you're trying to connect from a different location, i.e. your ISP is different. It's just one of the many safeguards that banks are deploying now.

Exactly.   With Wise it also applies to devices, with the account on 3 devices I have confirm almost every time I go to the account.

HSBC are also on the 3 devices but not so fussy on changing device.

[VBF]

On 1/13/2024 at 1:24 PM, Moonlover said:

They cannot detect a VPN, but they can detect that you're trying to connect from a different location, i.e. your ISP is different. It's just one of the many safeguards that banks are deploying now.

Just re-reading this thread and I wouldn't be too sure of that.

As an experiment, whilst sitting in my home in UK I switched my VPN on and tried to connect to the BBC iPlayer. It immediately blocked me citing the VPN. Switched VPN off, and BBC worked fine.

 

My point is that the BBC have the technology to  detect a VPN (which is well-known) then I rather think major banks may have too.

[sometimewoodworker]

On 1/17/2024 at 4:27 PM, VBF said:

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on.

RBoS will send the required SMS to my Thai number that I have registered with them, so that is one U.K. bank group that has no problem.

[Moonlover]

7 minutes ago, sandyf said:

Exactly.   With Wise it also applies to devices, with the account on 3 devices I have confirm almost every time I go to the account.

HSBC are also on the 3 devices but not so fussy on changing device.

Wise was the first one that I noticed this. 

 

17 minutes ago, VBF said:

Just re-reading this thread and I wouldn't be too sure of that.

As an experiment, whilst sitting in my home in UK I switched my VPN on and tried to connect to the BBC iPlayer. It immediately blocked me citing the VPN. Switched VPN off, and BBC worked fine.

 

My point is that the BBC have the technology to  detect a VPN (which is well-known) then I rather think major banks may have too.

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

 

Smart VPN providers are alert for this of course and quickly shift their customers to a new IP. It's a game of cat and mouse and the mouse (the VPN provider) is always one IP ahead of the the cat (the BBC) I've been using a reliable VPN daily for almost 20 years now and I'm rarely blocked out of the iPlayer for very long.

 

But it takes some very sophisticated technology for the BBC (and other streaming services) to do this. The banks have no interest in individuals legitimately using VPNs so there is no advantage for them to make such an investment. They have other sophisticated ways of detecting illicit log on attempts.

[KannikaP]

On 1/15/2024 at 11:20 AM, sometimewoodworker said:

That looks as if the VPN service is poor unless you actually want to come from random countries. With my VPN I choose the location I want to use and that is where I come from on each use, FWIW I generally come from London Docklands 

Express VPN then!

[VBF]

2 hours ago, Moonlover said:

Wise was the first one that I noticed this. 

 

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

 

Smart VPN providers are alert for this of course and quickly shift their customers to a new IP. It's a game of cat and mouse and the mouse (the VPN provider) is always one IP ahead of the the cat (the BBC) I've been using a reliable VPN daily for almost 20 years now and I'm rarely blocked out of the iPlayer for very long.

 

But it takes some very sophisticated technology for the BBC (and other streaming services) to do this. The banks have no interest in individuals legitimately using VPNs so there is no advantage for them to make such an investment. They have other sophisticated ways of detecting illicit log on attempts.

I agree with what you say and initially disagreed with "The BBC cannot detect a VPN per se."

I use iPlayer normally, then switch "My Norton"  VPN on:

 

Note the region is set to UK  however BBC iPlayer now shows:

 

 

I switch the VPN off and iPlayer works again (after a refresh)

 

So yeah, doesn't actually SAY it's a VPN so your explanation makes sense - they must just see an all-too familiar IP address and of course, Norton 360 is used by many people worldwide.

 

 

 

Edited January 18 by VBF

[Moonlover]

40 minutes ago, VBF said:

I agree with what you say and initially disagreed with "The BBC cannot detect a VPN per se."

I use iPlayer normally, then switch "My Norton"  VPN on:

 

Note the region is set to UK  however BBC iPlayer now shows:

 

 

I switch the VPN off and iPlayer works again (after a refresh)

 

So yeah, doesn't actually SAY it's a VPN so your explanation makes sense - they must just see an all-too familiar IP address and of course, Norton 360 is used by many people worldiwide.

 

 

 

I've just done a quick scan of my VPN, connecting 3 times in quick succession and then checking my IP location. It popped up in Glasgow, Camberley and then Stalbridge. He he he, can't catch me!

[john donson]

On 1/13/2024 at 6:50 PM, gamb00ler said:

Since Schwab accepts international customers from Thailand, I assumed that a VPN was not required to access my US based Schwab account.  For over 3 years I have had no issued connecting to Schwab without a VPN.

 

schwab, is that the one where you need to put 25k usd first?

[gamb00ler]

1 minute ago, john donson said:

 

schwab, is that the one where you need to put 25k usd first?

Yes, I believe that is their minimum for an international account.

 

My account is still based in US.  I just haven't bothered to switch it to international.

[foreverlomsak]

On 1/15/2024 at 9:17 PM, topt said:

Don't switch to SCB for your banking then as their mobile app (no web based access anymore) will not let you access the app if the vpn is switched on.........

so I have found out, but Bangkok Bank does allow use of the VPN, as does both my UK bank web based apps.

[sandyf]

14 hours ago, Moonlover said:

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

I would agree with that, the BBC system checks the IP and looks for suspicious IPs and blocks them. They state on the website that if you live in the UK and cannot connect with a VPN to contact them.

I changed to a VPN that rotates the IP address and had a lot less problem.

[BananaBandit]

On 1/15/2024 at 7:39 PM, bamnutsak said:

How many times did you access your account successfully in this period?

 

2 or 3 times, i think

[bamnutsak]

1 minute ago, BananaBandit said:

 

2 or 3 times, i think

 

So you can successfully log-in ~ 50% of the time using a VPN? If so, not sure the VPN is the issue?

 

Which 2FA options do you use?

 

I'd try NOT using a VPN, and use the Schwab app for 2FA.

 

Schwab also supports SMS for 2FA. Do you have a US-based SIM registered with Schwab?

[BananaBandit]

On 1/15/2024 at 11:20 PM, The Theory said:

my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 

 

There's the problem!  Can't use email to verify no more. So we need to use US phone number on file. Well, I don't have US number no more. Haven't been to US in many years.

[BananaBandit]

16 minutes ago, bamnutsak said:

 

So you can successfully log-in ~ 50% of the time using a VPN? If so, not sure the VPN is the issue?

 

Which 2FA options do you use?

 

I'd try NOT using a VPN, and use the Schwab app for 2FA.

 

Schwab also supports SMS for 2FA. Do you have a US-based SIM registered with Schwab?

 

Sorry, I probably should have said that I actually think I successfully remembered to switch off VPN before logging on to my Schwab account during the past month or so. 

 

I went multiple years without having to do two-factor verification. I was so liberated from it that I evidently failed to realize that Schwab nixed email as a method of verification about 2 years ago. 

 

Recently, I started using VPN, and all of a sudden I have to verify twice in one month. It seems odd to me, and leads me to somewhat suspect that VPN is the factor. 

 

I have a US number attached to my Schwab account. That number is no longer active. I haven't been to the US in a long time.

Edited January 19 by BananaBandit

[bamnutsak]

Asking again...

 

 

45 minutes ago, bamnutsak said:

Which 2FA options do you use?