Another Tangerine security nightmare | Tangerine Bank | Discussion forum

Please consider registering
guest

sp_LogInOut Log In sp_Registration Register

Register | Lost password?
Advanced Search

— Forum Scope —




— Match —





— Forum Options —





Minimum search word length is 3 characters - maximum search word length is 84 characters

sp_Feed Topic RSS sp_TopicIcon
Another Tangerine security nightmare
June 16, 2023
4:40 pm
HermanH
Member
Members
Forum Posts: 1169
Member Since:
April 14, 2021
sp_UserOfflineSmall Offline

My mother logged into Tangerine and did her business over the weekend. Two days later, she tries to get back into her accounts and enters her UserID and password. Tang is set to send her 2FA via text, but it never arrives. So, she tries again. No luck. Fearing a security lock-out from too many attempts, we call into a CSR and ask what's happening. She completes her transactions and is told that it might be due to maintenance, since it was about that time. She was told to try back in the morning. I warned the CSR that we didn't want to get locked out from security, since it takes forever to get them on the line. She assured us that everything looked okay on their end and she had cleared any attempts.

My mother tries the next morning and promptly gets locked out. Because we have some joint accounts, I am also locked out of my accounts.

For the next 3 hours, we try to get my mother bank into the system. However, every time I try to explain the problem to Security (her inability to receive 2FA via text), they refused to do anything because I am not the account holder and promptly hang up. 6 TIMES, this happens over THREE HOURS. She tried to tell them to talk to me and that she authorized it, but they refused outright.

My mother is 90 yrs old and speaks English poorly. I can barely understand or explain the situation. How the heck can she tell them what is happening, even with me trying to whisper the explanation into her ear?

They kept trying to authenticate her by asking inane questions such as, "what is the balance in one of your accounts?", "if you have a GIC, what are the maturity instructions?", or "What was your last transaction?" The ultimate insult was, "Tell us the security code we just sent you via text". I exploded and told them that was the entire reason she was contacting you, SHE CAN'T RECEIVE 2FA TEXT!

Who can remember this stuff? She's 90-yrs old and can't remember what she had for breakfast. I do, only because I help her with her accounts. The whole point of going online is to check these things.

After 3 hours, I finally tried a different path and entered my account to clear security and regain access before asking the CSR to switch accounts and clear security for my mother. She got her password re-set and everything works, as long as she uses the telephone system and not a computer.

A service request was put in for their IT to call and figure out why they stopped sending 2FA via text is in process. The scary thing about this is that they could conceivably have kept ignoring her requests for help and refusing to allow anyone to help the process. And this was ALL created from Tang's end. Everything worked, until they broke something. (She can receive text from other contacts.) They could not even change the 2FA from text to phone call or change phone numbers.

Just now, it seems to have cleared and she received a torrent of text messages from Tang. Whew. Just scary how she also managed to get me locked out of my accounts.

I cringe at the stupidity awaiting me after she passes, if I have to gain access to her accounts and settle her affairs.

June 16, 2023
6:25 pm
fat_dog
Member
Banned
Forum Posts: 38
Member Since:
June 6, 2023
sp_UserOfflineSmall Offline

When ever you deal with online entities only . I think you have to be prepared with enough resources in local banks . So that you can cover serials month worth of bills . In such a case like this can you not try the Ombudsman process by sending them a letter explaining you are trying to establish your identity with the bank . And work through this processes instead of speaking with CSR who do not have the authority or the ability to help you .

Just keep some money in a local bank as well . as an online one

June 16, 2023
6:33 pm
AltaRed
BC Interior
Member
Members
Forum Posts: 2900
Member Since:
October 27, 2013
sp_UserOfflineSmall Offline

Fully agree. I would not limit myself to online digital banks only and indeed would not use online digital banks as my primary banking. My POA and Executor will/should thank me.

June 16, 2023
9:17 pm
Loonie
Member
Members
Forum Posts: 9259
Member Since:
October 21, 2013
sp_UserOfflineSmall Offline

Alas, online FIs are not in the business of catering to the needs of people with disabilities, elderly etc. They target younger customers.

If you want to help your mom with her banking, get it set up as a POA. If the FI or your mom won't go for that, look elsewhere.

My mom is over 100, speaks English perfectly, and I would not put her money in an online FI. I have found bricks-and-mortar CUs to be the most helpful so far. RBC and CIBC both get a failing grade from me on this question.

June 17, 2023
5:10 am
chamnic
Member
Members
Forum Posts: 31
Member Since:
December 18, 2018
sp_UserOfflineSmall Offline

HermanH said

I cringe at the stupidity awaiting me after she passes, if I have to gain access to her accounts and settle her affairs.  

Actually, when we cleared my mom's estate, of all the banks she had dealings with, Tangerine was the most (and by far) efficient and quick to liquidate all accounts. There were two others (from the big 5) that she had dealing with, and they were both horrendous, disorganized and slow as molasse in winter. That was our experience with Tangerine, hope yours will be as efficient when time arrives.

June 17, 2023
5:42 am
dougjp
Member
Members
Forum Posts: 575
Member Since:
January 9, 2011
sp_UserOfflineSmall Offline

The story gave me chills. Specifically 2FA limited to smartphone/text. I'm part of the 24% of Canadians without a smartphone (64% of seniors, by the way, half of whom don't have a cell phone).

An actual phone call to the phone number they have on file for her with a code, and/or an e-mail with a code is fine for most places/banks, and including the government. For the others like Tang, why escalation from the script reader level to someone who knows and is able to do.....something in these cases, is inexcusable. Tang has her telephone number on file, they could simply call her!

Another example - my wife, who does have text ability, is locked out of Google because she changed phones & number and hadn't logged in to Google for some time, and they have her old mobile phone number.

The main accomplishment of almost all organized protests is to
annoy people who are not in them.

June 17, 2023
6:36 am
Slybanking
Member
Members
Forum Posts: 108
Member Since:
July 28, 2016
sp_UserOfflineSmall Offline

HermanH said
My mother logged into Tangerine and did her business over the weekend. Two days later, she tries to get back into her accounts and enters her UserID and password. Tang is set to send her 2FA via text, but it never arrives. So, she tries again. No luck. Fearing a security lock-out from too many attempts, we call into a CSR and ask what's happening. She completes her transactions and is told that it might be due to maintenance, since it was about that time. She was told to try back in the morning. I warned the CSR that we didn't want to get locked out from security, since it takes forever to get them on the line. She assured us that everything looked okay on their end and she had cleared any attempts.

My mother tries the next morning and promptly gets locked out. Because we have some joint accounts, I am also locked out of my accounts.

For the next 3 hours, we try to get my mother bank into the system. However, every time I try to explain the problem to Security (her inability to receive 2FA via text), they refused to do anything because I am not the account holder and promptly hang up. 6 TIMES, this happens over THREE HOURS. She tried to tell them to talk to me and that she authorized it, but they refused outright.

My mother is 90 yrs old and speaks English poorly. I can barely understand or explain the situation. How the heck can she tell them what is happening, even with me trying to whisper the explanation into her ear?

They kept trying to authenticate her by asking inane questions such as, "what is the balance in one of your accounts?", "if you have a GIC, what are the maturity instructions?", or "What was your last transaction?" The ultimate insult was, "Tell us the security code we just sent you via text". I exploded and told them that was the entire reason she was contacting you, SHE CAN'T RECEIVE 2FA TEXT!

Who can remember this stuff? She's 90-yrs old and can't remember what she had for breakfast. I do, only because I help her with her accounts. The whole point of going online is to check these things.

After 3 hours, I finally tried a different path and entered my account to clear security and regain access before asking the CSR to switch accounts and clear security for my mother. She got her password re-set and everything works, as long as she uses the telephone system and not a computer.

A service request was put in for their IT to call and figure out why they stopped sending 2FA via text is in process. The scary thing about this is that they could conceivably have kept ignoring her requests for help and refusing to allow anyone to help the process. And this was ALL created from Tang's end. Everything worked, until they broke something. (She can receive text from other contacts.) They could not even change the 2FA from text to phone call or change phone numbers.

Just now, it seems to have cleared and she received a torrent of text messages from Tang. Whew. Just scary how she also managed to get me locked out of my accounts.

I cringe at the stupidity awaiting me after she passes, if I have to gain access to her accounts and settle her affairs.  

If I can suggest an explanation for the problem about 2FA. 6 months ago I had a weird charge on my cell phone bill around $5 and when I called the phone company about that they reversed the charge and told me it was from a premium text message and that I can put a hold on premium text message to avoid that situation in the future. So I did that but one of the consequence is that this hold also blocked all my 2FA texts from my financial institutions. So just a thing you might want to check with your cell provider. Good luck.

June 17, 2023
9:46 am
RetirEd
Member
Members
Forum Posts: 1019
Member Since:
November 18, 2017
sp_UserOfflineSmall Offline

HermanH and Slybanking: I'm wondering why the senior mom could receive texts but not the two-f***er-ID text. Was it possible the Tangerine system was sending an MMS (Multimedia Message System) text instead of SMS (Short Message System) text?

Traditional text messages go by a legacy SMS route that does not require or consume data. (Those used to be limited to 160 characters, but now up to five of them can be automatically chopped and reassembled. That limit led to the shorter original Twitter limit, leaving room for addressing data.) Any text including images, attachments, sounds, slideshows or whatever else they've added goes via MMS, using data, and cannot be received or displayed by users without data or with phones that can't handle data - even though users may be charged for the data they don't receive!

There's also a little-known "Flash SMS" that can be sent to pop up without user interaction, intended for such things as emergency messages without "4G" (LTE) capability. Some outfits use this for one-time passwords and it might be what Tangerine is torturing people with. You'd have to ask them to kick you up to a technically competent representative.
RetirEd

RetirEd

June 17, 2023
10:23 am
HermanH
Member
Members
Forum Posts: 1169
Member Since:
April 14, 2021
sp_UserOfflineSmall Offline

Thanks for all the good ideas and theories on causes to the text problem. The situation was cleared the day after the stoppage appeared. I do not know if it was an SMS/MMS cause, premium text charge, or whatever. The accumulated 2FA text messages all appeared at the same time and the system has returned to normal.

I can't say for a certainty if it was a Tang problem or phone provider problem, but I feel it was Tang's bug, since other SMS messages were received from other contacts with no problem or delay.

June 18, 2023
7:00 pm
COIN
Member
Members
Forum Posts: 1109
Member Since:
March 15, 2019
sp_UserOfflineSmall Offline

So far my only issue is that the Tangerine lady's voice has a bit of an accent and that is why I ask for the security code twice to make sure.

June 19, 2023
1:24 pm
mebe
Member
Members
Forum Posts: 25
Member Since:
May 21, 2021
sp_UserOfflineSmall Offline

Several months ago, EQ was having problems sending the user authentication code via email.

When I called them the CSR said it was a re-occuring problem on their end that was fixed earlier in the day, but then broke again in the afternoon. There was no ETA for a fix, other than to keep trying over the next hour or so.

The problem was fixed within an hour after my call, and that's when I saw all the EQ email earlier attempts appear all at once in my email inbox.

So whether it's emails or texts, the account authentication process is often hanging by a thread (but this thread is not to blame).

My 75-year-old friend is in a Long-term care home, wheelchair bound, and yet Scotia Bank wants him to go to the bank with his expired debit card (since he got one silly question wrong) to get a new one (he was moved to a different LTC before the new card was mailed to his previous home that he no longer lives in). Sure, it was his fault for not trying to change the address, but since he has no online account, the bank wouldn't let anybody else help him out, once he failed the authentication questioning process.

At leas his Scotiabank account still works, so his LTC can automatically take his money to pay the rent (while I can help him access his money from a different bank, that has online access).

Hello, sir. Before we send you another card, can you tell me if you use an initial?

Answer: No.

Sorry, sir, you lose.

With no Scotia online account to check, he didn't know if there was an initial used or not, so he thought they wondered if he still signed his name using his initial, and answered no.

The next month when I visited him to sign his tax return, I had him practise his signature before he signed the tax return, and then laughed when he added his middle initial for the first time in years. I told him not to bother using his middle initial since he didn't use it the previous year when he signed the tax return.

He may be old, but his brain still works.

June 19, 2023
3:11 pm
mebe
Member
Members
Forum Posts: 25
Member Since:
May 21, 2021
sp_UserOfflineSmall Offline

I rarely use the texting feature of my phone, but sometimes when I'm waiting for a text notification from a bank, CRA, etc., I don't hear a notification noise, nor are there any texts in the messeging section of my phone. However, if I check for notifications simply by sliding my finger down from the bar at the top of my phone, I see the text messages. At some point, those same text messages usually appear several minutes later, but usually without any noise warning.

Other times if I'm in a partially shielded room with limited internet access, the text notifications don't appear in the message section until soon after I leave the room.

I just assume that there might occasionally be a more time-consuming method that my android phone goes through when it tries to access my text message section, rather than my top-of-the-phone notification list.

Texting, texting, 1,2,3. Is it there yet?

June 22, 2023
11:43 am
DevPatel
Member
Members
Forum Posts: 26
Member Since:
April 2, 2015
sp_UserOfflineSmall Offline

Irrespective of whether I can receive SMS or not, Tangerine guys should give alternative method to authenticate. could be an email, could be something else.
I tried calling them to remove 2FA, but was told no.
What happens if I am out of country and do not have roaming service, how am I supposed to login.
Unnecessary hassles in the name of security.

June 22, 2023
12:07 pm
HermanH
Member
Members
Forum Posts: 1169
Member Since:
April 14, 2021
sp_UserOfflineSmall Offline

DevPatel said
Irrespective of whether I can receive SMS or not, Tangerine guys should give alternative method to authenticate. could be an email, could be something else.

There is an alternative method. You can give them a phone number to call to send you the authentication code. It can be more problematic if you are out of country (or have a Call Authorization service like Telus), but it is possible. Just know that you must authenticate BEFORE you can change the method of receiving the text/phone call. It is not possible to change authentication methods prior to actual authentication.

June 22, 2023
1:05 pm
Winnie
Ontario
Member
Members
Forum Posts: 463
Member Since:
December 7, 2011
sp_UserOfflineSmall Offline

DevPatel said
I tried calling them to remove 2FA, but was told no.
 

It is very simple and easy.
You need to call them and tell them that you do not have phone.
That is all, 2FA will be removed and you will have security questions as before.
Me and a few other people did that, absolutely no problem.

June 22, 2023
1:16 pm
HermanH
Member
Members
Forum Posts: 1169
Member Since:
April 14, 2021
sp_UserOfflineSmall Offline

I only use old-fashioned phone for my personal access and there is no requirement for 2FA for access. I cannot do everything online access allows, but I do all that I need (except for the creation of new links.)

CSR told me that if I wish to create links, I must do it online.

June 22, 2023
1:34 pm
Tommy Tutalidge
Member
Banned
Forum Posts: 19
Member Since:
June 8, 2023
sp_UserOfflineSmall Offline

HermanH said
My mother logged into Tangerine and did her business over the weekend. Two days later, she tries to get back into her accounts and enters her UserID and password. Tang is set to send her 2FA via text, but it never arrives. So, she tries again. No luck. Fearing a security lock-out from too many attempts, we call into a CSR and ask what's happening. She completes her transactions and is told that it might be due to maintenance, since it was about that time. She was told to try back in the morning. I warned the CSR that we didn't want to get locked out from security, since it takes forever to get them on the line. She assured us that everything looked okay on their end and she had cleared any attempts.

My mother tries the next morning and promptly gets locked out. Because we have some joint accounts, I am also locked out of my accounts.

For the next 3 hours, we try to get my mother bank into the system. However, every time I try to explain the problem to Security (her inability to receive 2FA via text), they refused to do anything because I am not the account holder and promptly hang up. 6 TIMES, this happens over THREE HOURS. She tried to tell them to talk to me and that she authorized it, but they refused outright.

My mother is 90 yrs old and speaks English poorly. I can barely understand or explain the situation. How the heck can she tell them what is happening, even with me trying to whisper the explanation into her ear?

They kept trying to authenticate her by asking inane questions such as, "what is the balance in one of your accounts?", "if you have a GIC, what are the maturity instructions?", or "What was your last transaction?" The ultimate insult was, "Tell us the security code we just sent you via text". I exploded and told them that was the entire reason she was contacting you, SHE CAN'T RECEIVE 2FA TEXT!

Who can remember this stuff? She's 90-yrs old and can't remember what she had for breakfast. I do, only because I help her with her accounts. The whole point of going online is to check these things.

After 3 hours, I finally tried a different path and entered my account to clear security and regain access before asking the CSR to switch accounts and clear security for my mother. She got her password re-set and everything works, as long as she uses the telephone system and not a computer.

A service request was put in for their IT to call and figure out why they stopped sending 2FA via text is in process. The scary thing about this is that they could conceivably have kept ignoring her requests for help and refusing to allow anyone to help the process. And this was ALL created from Tang's end. Everything worked, until they broke something. (She can receive text from other contacts.) They could not even change the 2FA from text to phone call or change phone numbers.

Just now, it seems to have cleared and she received a torrent of text messages from Tang. Whew. Just scary how she also managed to get me locked out of my accounts.

I cringe at the stupidity awaiting me after she passes, if I have to gain access to her accounts and settle her affairs.  

Getting them on the phone must be like winning the lottery. I've tried so many times to phone them over the past years to close my accounts but never got through even once. So one each year I add a dollar or subtract a dollar from the non registered accounts. These accounts are just a carryover from my ING Direct accounts. The 3 combined accounts have about 7 dollars combined in total.

June 22, 2023
2:29 pm
cgouimet
Member
Members
Forum Posts: 1474
Member Since:
February 7, 2019
sp_UserOfflineSmall Offline

Tommy Tutalidge said

Getting them on the phone must be like winning the lottery. I've tried so many times to phone them over the past years to close my accounts but never got through even once. So one each year I add a dollar or subtract a dollar from the non registered accounts. These accounts are just a carryover from my ING Direct accounts. The 3 combined accounts have about 7 dollars combined in total.  

I have waited but I found it much better in the last few months.

Regarding closing your account(s), I've never tried it but online at Tangerine, open the account then 'Account Details', scroll down and you find a large 'Close Account' button.

CGO
June 23, 2023
10:11 am
Winnie
Ontario
Member
Members
Forum Posts: 463
Member Since:
December 7, 2011
sp_UserOfflineSmall Offline

I closed 2 accounts online at Tangerine, very easy, just press Close Account button. No calling needed.

June 23, 2023
10:14 am
cgouimet
Member
Members
Forum Posts: 1474
Member Since:
February 7, 2019
sp_UserOfflineSmall Offline

Winnie said
I closed 2 accounts online at Tangerine, very easy, just press Close Account button. No calling needed.  

Thanks for confirming that

CGO

Please write your comments in the forum.