Major bank warns Aussies over rising threats to account security
- Replies 12
If you’ve ever felt a little more secure knowing your bank sends you a text message to confirm your identity, you’re not alone.
For years, SMS-based two-factor authentication (2FA) has been the gold standard for keeping our hard-earned savings safe from prying eyes.
But now, one of Australia’s biggest banks is sounding the alarm: those reassuring text messages might not be as secure as we think.
Macquarie Bank, Australia’s fifth-largest lender, has made a bold call, warning that the days of relying on SMS 2FA are numbered.
According to Olivia McArdle, Macquarie’s head of deposits, the technology is too outdated to keep up with the increasingly sophisticated tactics of cybercriminals.
‘We think the days of Australian banks relying solely on SMS to verify customer account activity are numbered,’ McArdle said.
The main issue? Those brief, often cryptic text messages don’t provide enough detail for customers to know exactly what they’re approving.
That means you could be giving the green light to a scammer without even realising it.
The warning from Macquarie comes hot on the heels of a series of cyber breaches at some of Australia’s largest superannuation funds.
In March, hackers managed to infiltrate five major super funds using a technique called ‘credential stuffing’—where stolen usernames and passwords, often bought on the dark web, are used to break into accounts.
The problem is made worse by the fact that many people reuse the same passwords across multiple accounts.
While multi-factor authentication (MFA) can help slow down these attacks, SMS-based 2FA is proving to be a weak link in the chain.
Xavier O’Halloran, CEO of Super Consumer Australia, didn’t mince words:
‘Australians are legally required to put their money into super. Today’s news is chilling when we know super funds aren’t doing enough to protect Australians’ retirement savings.
When something goes wrong, too many people are being left without support, answers, or access to their own money.’
Cybercriminals are finding new ways to bypass SMS-based two-factor authentication (2FA), making it less reliable than it once was.
Tactics include impersonation scams where victims are tricked into handing over codes, spoofed messages that appear to come from legitimate sources, pop-up SMS alerts that vanish without a trace, and even phone porting to hijack numbers.
These methods allow scammers to intercept or manipulate 2FA messages, giving them access to sensitive accounts.
To stay protected, experts advise taking proactive steps.
Avoid sharing codes or clicking links in messages, even if they seem urgent.
Use strong, unique passwords for each account and consider app-based authentication instead of SMS.
Always verify suspicious activity by contacting your bank directly, and routinely monitor your financial accounts for unauthorised transactions.
Macquarie’s warning is a wake-up call for the entire industry. As cyber threats evolve, so too must our defences.
Many banks are already moving towards more secure forms of authentication, such as biometrics (fingerprint or facial recognition) and app-based verification.
But until these measures become standard, it’s up to all of us to stay vigilant. Remember, scammers are counting on us to let our guard down—so let’s not give them the satisfaction!
Have you ever received a suspicious text from your bank or been targeted by a scam? Do you feel confident in your bank’s security measures? Share your experiences and tips in the comments below.
For years, SMS-based two-factor authentication (2FA) has been the gold standard for keeping our hard-earned savings safe from prying eyes.
But now, one of Australia’s biggest banks is sounding the alarm: those reassuring text messages might not be as secure as we think.
Macquarie Bank, Australia’s fifth-largest lender, has made a bold call, warning that the days of relying on SMS 2FA are numbered.
According to Olivia McArdle, Macquarie’s head of deposits, the technology is too outdated to keep up with the increasingly sophisticated tactics of cybercriminals.
SMS-based two-factor authentication was deemed outdated and insecure by a major bank. Credit: golubovy / iStock
‘We think the days of Australian banks relying solely on SMS to verify customer account activity are numbered,’ McArdle said.
The main issue? Those brief, often cryptic text messages don’t provide enough detail for customers to know exactly what they’re approving.
That means you could be giving the green light to a scammer without even realising it.
The warning from Macquarie comes hot on the heels of a series of cyber breaches at some of Australia’s largest superannuation funds.
In March, hackers managed to infiltrate five major super funds using a technique called ‘credential stuffing’—where stolen usernames and passwords, often bought on the dark web, are used to break into accounts.
The problem is made worse by the fact that many people reuse the same passwords across multiple accounts.
While multi-factor authentication (MFA) can help slow down these attacks, SMS-based 2FA is proving to be a weak link in the chain.
Xavier O’Halloran, CEO of Super Consumer Australia, didn’t mince words:
‘Australians are legally required to put their money into super. Today’s news is chilling when we know super funds aren’t doing enough to protect Australians’ retirement savings.
When something goes wrong, too many people are being left without support, answers, or access to their own money.’
Cybercriminals are finding new ways to bypass SMS-based two-factor authentication (2FA), making it less reliable than it once was.
Tactics include impersonation scams where victims are tricked into handing over codes, spoofed messages that appear to come from legitimate sources, pop-up SMS alerts that vanish without a trace, and even phone porting to hijack numbers.
These methods allow scammers to intercept or manipulate 2FA messages, giving them access to sensitive accounts.
To stay protected, experts advise taking proactive steps.
Avoid sharing codes or clicking links in messages, even if they seem urgent.
Use strong, unique passwords for each account and consider app-based authentication instead of SMS.
Always verify suspicious activity by contacting your bank directly, and routinely monitor your financial accounts for unauthorised transactions.
Macquarie’s warning is a wake-up call for the entire industry. As cyber threats evolve, so too must our defences.
Many banks are already moving towards more secure forms of authentication, such as biometrics (fingerprint or facial recognition) and app-based verification.
But until these measures become standard, it’s up to all of us to stay vigilant. Remember, scammers are counting on us to let our guard down—so let’s not give them the satisfaction!
.png){kind=icon}
