Does using a VPN impact online banking?

[The Theory]

On 1/13/2024 at 6:06 PM, BananaBandit said:

Why have they (apparently) removed email as a method of receiving a verification code? 

I don't know about CS, but my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 
I figured smaller banks won't comply with customers needs, in fact their own ease of work or less risk is a priority.

[VBF]

On 1/16/2024 at 4:20 AM, The Theory said:

I don't know about CS, but my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 
I figured smaller banks won't comply with customers needs, in fact their own ease of work or less risk is a priority.

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on. Some of them used to send an email but no more. When asked they usually mutter something about it being a Financial Conduct Authority rule but I'm not entirely sure they're correct.

[scottiejohn]

56 minutes ago, VBF said:

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on. Some of them used to send an email but no more. When asked they usually mutter something about it being a Financial Conduct Authority rule but I'm not entirely sure they're correct.

I have more than two UK Bank accounts, plus Wise and 2/3credit cards and use both Aps and online banking for all via a VPN saying I am in the UK and never have to get an SMS.   (I am obviously NOT stating what banks/companies etc for privacy reasons)

Occasionally I am asked to log on to the app of the authorising bank to allow a transfer. 

I have both UK and Thai SIMS on my phone!

[VBF]

12 minutes ago, scottiejohn said:

I have more than two UK Bank accounts, plus Wise and 2/3credit cards and use both Aps and online banking for all via a VPN saying I am in the UK and never have to get an SMS.   (I am obviously NOT stating what banks/companies etc for privacy reasons)

Occasionally I am asked to log on to the app of the authorising bank to allow a transfer. 

I have both UK and Thai SIMS on my phone!

Similar to you in terms of multiple accounts - but one of my UK banks requires authentication for every login, either by a card reader or SMS - my choice each time

Another states that a SMS containing a one time code will be sent at random logins and that seems to be the case (although doubtless there's an algorithm controlling the "randomness" somewhere)

I've just tried both of those using Norton's free VPN and both work.

Oh and yet another account will also send a SMS "randomly"

 

Not doubting your word but I find it odd that you're using UK banks and never getting SMS's  although I do not use any banking Apps on my phone - all mine is done on a PC.  Obviously the phone is used to receive the SMS's!

[scottiejohn]

9 minutes ago, VBF said:

I do not use any banking Apps on my phone - all mine is done on a PC.  Obviously the phone is used to receive the SMS's!

I suspect that is why!  By having a UK address, phone apps with UK VPN and using the same "trusted" PC which I originally authorised by my phone app via UK SIMM/VPN (can't remember which during setups) I never get an SMS! (make sure the cookies to the Financial companies are never deleted (Ccleaner etc))

[KhunHeineken]

On 1/16/2024 at 2:28 AM, soi3eddie said:

 

I VPN via my Synology Diskstation in the UK. That way it uses a UK IP address which I need to login to two business websites that geo block anything from outside the UK.

If using a popular VPN provider (such Nord, Surfshark etc.) the banks may well see a large number of connections from the same VPN IP address or range which could trigger a block. If using an IP address that is dedicated to you, then they cannot tell whether or not it's a VPN. Nord VPN are now offering dedicated IP addresses for a monthly fee.

 

Been there, done that.

 

I paid for a dedicated IP Address only to be blocked.  When I emailed the VPN company and asked how is it an IP Address, only used by me, can be blocked by a website, their answer was, basically, data center IP Address are different to residential IP Addresses. 

 

I then set up a VPN to my router in my home country and haven't had any problems. 

 

For those who can not have access to a friend's or relative's router to VPN back to, I have suggested before to look into a decentralized VPN.  Basically, someone in a house rents their router and bandwidth out to you for really cheap. 

 

You can stream and surf for hours on their residential IP Address for small money.  They are pay as you go, not a subscription, so perfect for the casual user. 

[RocketDog]

I Use Trust.Zone vpn,ususlly a Singapore 185.xxxx IP.

If I have trouble logging into a USA site, such as my bank in Colorado, I change to American IP. This is rare.

 

Just today I logged into my TDAmeritrade and Wise accounts from Singapore with no issues.

FWIW

 

 

[sandyf]

On 1/13/2024 at 8:24 PM, Moonlover said:

They cannot detect a VPN, but they can detect that you're trying to connect from a different location, i.e. your ISP is different. It's just one of the many safeguards that banks are deploying now.

Exactly.   With Wise it also applies to devices, with the account on 3 devices I have confirm almost every time I go to the account.

HSBC are also on the 3 devices but not so fussy on changing device.

[VBF]

On 1/13/2024 at 1:24 PM, Moonlover said:

They cannot detect a VPN, but they can detect that you're trying to connect from a different location, i.e. your ISP is different. It's just one of the many safeguards that banks are deploying now.

Just re-reading this thread and I wouldn't be too sure of that.

As an experiment, whilst sitting in my home in UK I switched my VPN on and tried to connect to the BBC iPlayer. It immediately blocked me citing the VPN. Switched VPN off, and BBC worked fine.

 

My point is that the BBC have the technology to  detect a VPN (which is well-known) then I rather think major banks may have too.

[sometimewoodworker]

On 1/17/2024 at 4:27 PM, VBF said:

I realise you're discussing US banks, but in the UK, most banks will need to send an SMS to a UK number in order for you to log on.

RBoS will send the required SMS to my Thai number that I have registered with them, so that is one U.K. bank group that has no problem.

[Moonlover]

7 minutes ago, sandyf said:

Exactly.   With Wise it also applies to devices, with the account on 3 devices I have confirm almost every time I go to the account.

HSBC are also on the 3 devices but not so fussy on changing device.

Wise was the first one that I noticed this. 

 

17 minutes ago, VBF said:

Just re-reading this thread and I wouldn't be too sure of that.

As an experiment, whilst sitting in my home in UK I switched my VPN on and tried to connect to the BBC iPlayer. It immediately blocked me citing the VPN. Switched VPN off, and BBC worked fine.

 

My point is that the BBC have the technology to  detect a VPN (which is well-known) then I rather think major banks may have too.

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

 

Smart VPN providers are alert for this of course and quickly shift their customers to a new IP. It's a game of cat and mouse and the mouse (the VPN provider) is always one IP ahead of the the cat (the BBC) I've been using a reliable VPN daily for almost 20 years now and I'm rarely blocked out of the iPlayer for very long.

 

But it takes some very sophisticated technology for the BBC (and other streaming services) to do this. The banks have no interest in individuals legitimately using VPNs so there is no advantage for them to make such an investment. They have other sophisticated ways of detecting illicit log on attempts.

[KannikaP]

On 1/15/2024 at 11:20 AM, sometimewoodworker said:

That looks as if the VPN service is poor unless you actually want to come from random countries. With my VPN I choose the location I want to use and that is where I come from on each use, FWIW I generally come from London Docklands 

Express VPN then!

[VBF]

2 hours ago, Moonlover said:

Wise was the first one that I noticed this. 

 

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

 

Smart VPN providers are alert for this of course and quickly shift their customers to a new IP. It's a game of cat and mouse and the mouse (the VPN provider) is always one IP ahead of the the cat (the BBC) I've been using a reliable VPN daily for almost 20 years now and I'm rarely blocked out of the iPlayer for very long.

 

But it takes some very sophisticated technology for the BBC (and other streaming services) to do this. The banks have no interest in individuals legitimately using VPNs so there is no advantage for them to make such an investment. They have other sophisticated ways of detecting illicit log on attempts.

I agree with what you say and initially disagreed with "The BBC cannot detect a VPN per se."

I use iPlayer normally, then switch "My Norton"  VPN on:

 

Note the region is set to UK  however BBC iPlayer now shows:

 

 

I switch the VPN off and iPlayer works again (after a refresh)

 

So yeah, doesn't actually SAY it's a VPN so your explanation makes sense - they must just see an all-too familiar IP address and of course, Norton 360 is used by many people worldwide.

 

 

 

[Moonlover]

40 minutes ago, VBF said:

I agree with what you say and initially disagreed with "The BBC cannot detect a VPN per se."

I use iPlayer normally, then switch "My Norton"  VPN on:

 

Note the region is set to UK  however BBC iPlayer now shows:

 

 

I switch the VPN off and iPlayer works again (after a refresh)

 

So yeah, doesn't actually SAY it's a VPN so your explanation makes sense - they must just see an all-too familiar IP address and of course, Norton 360 is used by many people worldiwide.

 

 

 

I've just done a quick scan of my VPN, connecting 3 times in quick succession and then checking my IP location. It popped up in Glasgow, Camberley and then Stalbridge. He he he, can't catch me!

[john donson]

On 1/13/2024 at 6:50 PM, gamb00ler said:

Since Schwab accepts international customers from Thailand, I assumed that a VPN was not required to access my US based Schwab account.  For over 3 years I have had no issued connecting to Schwab without a VPN.

 

schwab, is that the one where you need to put 25k usd first?

[gamb00ler]

1 minute ago, john donson said:

 

schwab, is that the one where you need to put 25k usd first?

Yes, I believe that is their minimum for an international account.

 

My account is still based in US.  I just haven't bothered to switch it to international.

[foreverlomsak]

On 1/15/2024 at 9:17 PM, topt said:

Don't switch to SCB for your banking then as their mobile app (no web based access anymore) will not let you access the app if the vpn is switched on.........

so I have found out, but Bangkok Bank does allow use of the VPN, as does both my UK bank web based apps.

[sandyf]

14 hours ago, Moonlover said:

The BBC cannot detect a VPN per se. What they do is scan the IPs that are connected to their service and seek out those that have an unusually high number of users on it and assume that it's a VPN and block it.

I would agree with that, the BBC system checks the IP and looks for suspicious IPs and blocks them. They state on the website that if you live in the UK and cannot connect with a VPN to contact them.

I changed to a VPN that rotates the IP address and had a lot less problem.

[BananaBandit]

On 1/15/2024 at 7:39 PM, bamnutsak said:

How many times did you access your account successfully in this period?

 

2 or 3 times, i think

[bamnutsak]

1 minute ago, BananaBandit said:

 

2 or 3 times, i think

 

So you can successfully log-in ~ 50% of the time using a VPN? If so, not sure the VPN is the issue?

 

Which 2FA options do you use?

 

I'd try NOT using a VPN, and use the Schwab app for 2FA.

 

Schwab also supports SMS for 2FA. Do you have a US-based SIM registered with Schwab?

[BananaBandit]

On 1/15/2024 at 11:20 PM, The Theory said:

my US bank stoped sending code by email while ago. I asked the reason last year when I was there. They replied that I need to use US phone number on file (no given reason). 

 

There's the problem!  Can't use email to verify no more. So we need to use US phone number on file. Well, I don't have US number no more. Haven't been to US in many years.

[BananaBandit]

16 minutes ago, bamnutsak said:

 

So you can successfully log-in ~ 50% of the time using a VPN? If so, not sure the VPN is the issue?

 

Which 2FA options do you use?

 

I'd try NOT using a VPN, and use the Schwab app for 2FA.

 

Schwab also supports SMS for 2FA. Do you have a US-based SIM registered with Schwab?

 

Sorry, I probably should have said that I actually think I successfully remembered to switch off VPN before logging on to my Schwab account during the past month or so. 

 

I went multiple years without having to do two-factor verification. I was so liberated from it that I evidently failed to realize that Schwab nixed email as a method of verification about 2 years ago. 

 

Recently, I started using VPN, and all of a sudden I have to verify twice in one month. It seems odd to me, and leads me to somewhat suspect that VPN is the factor. 

 

I have a US number attached to my Schwab account. That number is no longer active. I haven't been to the US in a long time.

[bamnutsak]

Asking again...

 

 

45 minutes ago, bamnutsak said:

Which 2FA options do you use?

 

[DrPhibes]

I know this is an old post but FYI, I am finding it more and more difficult to get into State and local gov websites to take care of business.  Have to use a VPN (Nord).  Now, Citibank has always let me in while using NORD set to CA, but now will no longer let me send a wire while using it.  Took an hr talking to 3 different Citi "experts" for me to realize the problem before they did.

 

Banks want more security but want us to use less, go figure...

[connda]

On 1/13/2024 at 8:24 PM, Moonlover said:

They cannot detect a VPN, but they can detect that you're trying to connect from a different location, i.e. your ISP is different. It's just one of the many safeguards that banks are deploying now.

Actually they can.  VPN ISPs use an assigned block of IP address and the banks are well aware of which blocks of IP address are assigned to VPNs as well as which company is hosting the VPN.

[connda]

On 1/14/2024 at 6:40 PM, KhunHeineken said:

The problem arises when banks and other companies blacklist data center IP Addresses, mainly for geo-blocking, but sometimes for a small layer of extra security.  

 

It's not a great idea to log into your online banking on wifi at an airport or cafe for example, unless you turn on a VPN to stop a man in the middle attack, but then many companies see you using a VPN and block you.  It's a real PITA sometimes.

 

This is why I set up a VPN to my router back in my home country.  It looks like I am still in my house access banking, streaming etc, but I could be anywhere in the world.   

Now there is an interesting approach. 

[KhunHeineken]

On 9/10/2024 at 3:41 AM, connda said:

Now there is an interesting approach. 

It's not that difficult. 

 

Most late model and decent brand routers have this inside the router settings.  It generates a config file which you put on your device.  Open VPN is popular, but Wireguard is faster and gaining in popularity. 

 

Members who have a friend / family back in their home country, they should look into it.

 

For those who have no contacts back in their home country, I suggest a DVPN.  It's a Decentralized Virtual Private Network.  These are also starting to become popular. 

 

Basically, people rent out their internet bandwidth from their home / business.  You pay as you go per MB, but it's cheap.  Not real great for streaming, but good for getting around geo-blocking for some things. 

[SunshineBB]

Banks often get wary when they see you logging in from an unusual IP address or location since they see it as a potential security risk.
If you're tired of getting blocked, you might find that using a proxy works a lot better. With a good proxy, you can keep a steady IP location, which is less likely to trigger any of those security alerts.

 

It’s more seamless and tends to work with banking sites without the same kind of issues that come with VPNs. If you’re curious, looking into some Cheap proxy options could help keep things running smoothly without the hassle.

[JackGats]

I'd have thought banking apps had no problems with VPNs nowadays. After all, it's in the bank's interest for user to connect through a VPN when they're on an unsafe network (like public WiFi). I have no problems connecting through ExpressVPN wherever I am. This doesn't mean I don't have problems with banking apps, however such problems as I have are not made worse by the VPN.

 

One of my banks has an app where I can allow the app to 1) detect the IMEI number of my smartphone and 2) my phone location. These are apparently added security features. Of course number 2) means I cannot fool my bank into believing I am somewhere else regardless of what the VPN simulates.