The Core

I strongly recommend that you remove all banking apps from your phones and use a stay-at-home desktop for online banking.  Just this week I was reading a security report that said thieves are targeting phones then *immediately* submitting an account recovery.  The 2-factor authorization is sent to the phone --which they have.  That locks out the owner. Then they start going through the banking apps.

A woman who got locked out of her Apple account minutes after her iPhone was stolen and had $10,000 taken from her bank account says Apple was 'not helpful at all'

https://finance.yahoo.com/news/woman-got-locked-her-apple-163000848.html

+
/r roughly covered the way the account recovery method works when stolen

In the typical case when a phone is stolen (and they have the iPhone passcode), they attempt to disable find my iPhone, but that requires the Apple ID Password. Instead, you can reset the Apple ID Password (WITHOUT HAVING THE APPLE ID PASSWORD) and from there do anything you want. The user will not be able to sign into their Apple ID anymore to report the phone as stolen, and the thief will have your Apple Id, Device, and Phone #, which unlocks most of your world even if you have 2FA turned on.

You can try it yourself, go to Settings > Click your iCloud Account > Password & Security > Change Password.

Even with 2FA enabled for your Apple ID, you can reset the password from here. And for everyone saying just don't type in your passcode in public, there are plenty of times that FaceID and TouchID fail a few times and you have no choice but to enter the passcode.

Q: apple lets you disable their ability to recover your lost password by generating recovery keys that you print out and store safely, at which point they lose the ability to recover your account. Wouldn't that stop unauthorized access?

You can still reset the Apple ID password with only the phone's passcode, having a recovery key in place doesn't help at all. Even if you have a recovery key a new one can be generated without having to enter the Apple ID password.

Q: Any solution?

Not really.

At a minimum you should not use iCloud Keychain and use a 3rd party password manager.

Once they have access to your account you should expect for your other Apple devices to be locked down and rendered completely unusable. You will not be able to use those devices at all if FindMy iPhone/iPad/Mac is enabled.

You should have a backup of all your important documents, photos, and videos backed up to a 3rd party (and not just time machine) you should also expect to never have access to your @icloud.com email again.

Xenomorph Android malware now steals data from 400 banks

https://www.bleepingcomputer.com/news/security/xenomorph-android-malware-now-steals-data-from-400-banks/

Xenomorph v3 is far more capable and mature than the previous versions, able to automatically steal data, including credentials, account balances, perform banking transactions, and finalize fund transfers.

This brings me back to the method my neighbors use when traveling. They bring a debit card that they fund with just the amount they think they will need on the trip and use only that card. They may carry a backup card with their passport for emergencies, I don't know. The point being that the only card they pull out during a trip is one with a max downside of say $5000.

I use revolut when travelling. That limits my exposure, AND gives me easy currency. I also carry Amex and Mastercard, but not on my phone. The only way to load revolut is from a home PC with all the widgets and passwords.

I suspect there are flaws in how I use it, as I also have 2 phones, one with wifi for when I can get it with (Usual phone) and one with a local sim for any calls. Last trip to the USA I lost both, at different times, (the problem there was having 2 on both occasions, habit has me checking for 1 phone, a dual sim would be better!)

Main Bank apps on the phone?... no way. Cheques can go to the post office in the UK. Still works.

Watching older folks deal with money in this digital age is scary.

The BBC describes it as, among many other things like crypto exchange, "A pre-paid debit card that enables cash machine withdrawals in 120 countries"
https://www.bbc.com/news/business-47768661

It sounds like that's your main use case. So if I follow, you use your desktop to transfer funds to Revolut and fund up the card, then you use that to pay when abroad. Am I getting close?

I'm particularly interested as I'm traveling to Switzerland and France at the end of April and it's been quite a while, so I've been wondering about the best way to pay for things but have not looked into it.

>> protection

Yeah, in reading up on it, I realized that I had heard of it, but only in the context of depositors getting incorrectly flagged for fraud, having their accounts locked, and taking months to resolve it. For some people, especially some younger people with not much money looking for low fees, they were using it as their only or primary account and so this was a real hardship because they had $7000 locked up and that was all their savings. So they were defaulting on rent and other things.

I'm not worried about that. But the no-fee/low-fee currency exchange and limited access to ATMs and so forth looks very handy.

>offers good two-factor auth

Yeah, over the last few months several security articles have said "most banking software is still in the early 2000s."

World’s Biggest Bank ICBC Forced to Trade Via USB Stick After Russia-Linked Hack - Bloomberg

https://www.bloomberg.com/news/articles/2023-11-10/world-s-biggest-bank-forced-to-trade-via-usb-stick-after-hack