TSB and Co-operative Bank told to 'urgently address' security concerns as scammers use 'loopholes' to target customers

The consumer champion Which? assessed the apps and websites of 13 current account providers in January and February 2024, with help from computer security experts.

Each of the banks used multi layered security, however the ones that ranked last fell short of the standards customers should expect, Which? said.

TSB was ranked lowest and second lowest retrospectively for its mobile app security and its online security.

Which? gave the bank a score of 54 per cent for its mobile app security and 67 per cent for its online security.

Which? warned customers that their sensitive data could be read by other apps running on their phone. The bank’s handling of sensitive data could be improved, the consumer group said.

They also raised concerns that the app stores users’ credentials in a way which may make it more likely that other apps could access them.

TSB told Which? that the matter was under review and a fix will be “considered in the future”.

The bank also sent a phone number in a text alert that Which? said could be replicated by scammers.

TSB told Which?: “We have removed phone numbers from the vast majority of SMS alerts with this alert being the final in plan for updating to remove the phone number.”

TSB’s password requirements also raised concerns, the investigation found, as users may choose insecure passwords which could be easier for scammers to crack without any prompting.

TSB said: “We continue to strengthen the security of our internet and mobile banking while delivering a positive and convenient user experience for customers.

“That’s reflected in our high app store ratings.”

The Co-Operative Bank were also ranked at the bottom of their study.

They scored 61 per cent in its study for online security and 57 per cent regarding the security on its mobile app - second to last.

Which? said the bank failed to require a two-factor authentication login on a test laptop and did not block customers from setting weak passwords.

Researchers could log in from two different IP addresses at the same time without the older session being terminated and, like TSB, there were still phone numbers in alerts and security codes sent via text.

The Co-operative Bank said: “The security of our customers’ accounts is always our top priority.

“Customers can be assured we have robust security measures in place to protect them and their money.

“We are constantly reviewing and enhancing our security controls and we will be delivering a number of further improvements in 2024 to give our customers peace of mind that they can continue to bank safely and securely with us.”

Which? said it is calling for TSB and the Co-operative Bank to urgently address the issues that its researchers found.

Sam Richardson, deputy editor of Which? Money, said: “With many people increasingly banking online or on their phones, it’s crucial that the banks we trust with our money have security protections that are up to scratch.

“While our investigation found no major security issues, there were some areas of concern that we think the banks in question need to urgently address, so that sophisticated scammers can’t use loopholes to target innocent victims.

“With fraudsters still relentless in their pursuit of our money and a general election looming, the next government must make fighting fraud a national priority, with a fraud minister installed to work across multiple government departments.”

GB News has contacted TSB and the Co-operative Bank for comment.