Is It Safe to Keep Vanguard/Banking Apps on iPhone

[stan1]

Ok.
So I am on vacation in say NYC. I have a Schwab app on my IPhone.
I need to do a transaction on Schwab that I initiate, have my Face ID and they text me my login code when I start logging in.
Some of you are saying this is not safe. Some are saying it is as secure as it gets.
This is why people get confused.
I honestly have not seen any stories of people doing this and having a financial disaster.

It's safe and millions of Americans do it every day, so long as you don't do it in a crowded bar where someone is going to slip drugs into your drink or on a street corner where someone will grab your phone. Also don't tell your Uber driver you are a crypto king. So its your personal security of yourself and your phone you have to be careful about.

[JBTX]

I don’t have investment apps on phones. I don’t go on them often and when i do I do it via PC. I do have banking apps on phones and I am using those almost everyday.

[NewRain]

Ok.
So I am on vacation in say NYC. I have a Schwab app on my IPhone.
I need to do a transaction on Schwab that I initiate, have my Face ID and they text me my login code when I start logging in.
Some of you are saying this is not safe. Some are saying it is as secure as it gets.
This is why people get confused.
I honestly have not seen any stories of people doing this and having a financial disaster.

I think it’s safe to have the Schwab app on your iPhone if it’s configured properly, you don’t carry the phone in public places, and have a good reason for doing this. I have it on a secondary iphone, with no cell service, for when I travel on extended trips (several months of travel). Also, use the Symantec VIP hardware token for your codes not text.

A banking app for my credit union (usually with a $5-10k balance) is on my normal everyday carry iphone. In the very unlikely event that I’m forced to unlock my iPhone, I don’t want it to be the iPhone with my Schwab app on it. Even then, it would probably be difficult for criminals to drain a Schwab account from an iPhone, but I don’t want to find out, since the most likely ways I can think of might involve being kidnapped or held hostage or something like that.

[hoops777]

Phones are for talking.

I am old enough to remember when that was actually their one and only purpose and you could not take them with you.Those were the days. Finding a pay phone to call home.

[PersonalFinanceJam]

Phones are for talking.

That is the least useful feature of my current "phone". They are not phones anymore. They're pocket sized, very powerful computers with always on network connections. Phone is just another app on the device.

[quantAndHold]

An updated app on an updated OS on an encrypted phone with biometric login, and multi factor authentication setup with the bank, is the safest way to interact with your financial accounts that exists. Far safer than a phone call, an email, or even an in person visit to the bank. All of those features I mentioned are pretty standard.

A phone is also a more hardened target than your laptop.

I don’t keep the Vanguard app on my phone because it’s more convenient to do my Vanguarding at home where I have a keyboard and monitor, but I do have banking apps on my phone that I use all the time. I wouldn’t hesitate to have brokerage apps on my phone if I needed them.

[SWYK]

I also set screen time to zero for these apps.

That’s really smart. I assume you then use a screen time password to add more time as needed. Funny, I’ve set app limits for my kids but never thought about using it this way…for myself. Although I only see that you can set the limit as low as 1 minute.

[jebmke]

I also set screen time to zero for these apps.

That’s really smart. I assume you then use a screen time password to add more time as needed. Funny, I’ve set app limits for my kids but never thought about using it this way…for myself. Although I only see that you can set the limit as low as 1 minute.

I think you're right. The lowest value is 1 minute. I have a screen time code established, yes. Bank, Amazon, and a couple other ones I can't recall right away.

[upwind]

I won’t comment on safety or risk issues. However, for me in this regard, my standard is that only what is essential for daily public activity would be on a take everywhere phone.

For me this would mean at most maybe a banking app from a bank used for everyday transactional purposes.
I don’t currently have any financial or banking apps on mobile devices. I previously had one when I did some mobile deposits but that was a minor account.

If I had a clear need to add something I might but I have no need to carry my entire life and the keys to my kingdom on a device that accompanies me everywhere I go. It strikes me as foolish. Personal situations and requirements vary.

I do have one credit card in my digital wallet. But that is something very different than account access.

[upwind]

What do they do if you don't have the apps? Let you go? If you don't use Zelle, then what -- do they let you go?

Well if you believe some of these reports then they may resort to old fashioned thievery and take you to an ATM and force you to withdraw money. I think the apps are safe, but it looks like you don't want to be on the mean streets of Chicago late at night/very early morning.

My dad always said nothing good happened after midnight.

Many of us don’t have ATM cards and it’s not something you necessarily have to take everywhere people take their phones which is essentially everywhere. Furthermore, a bank checking account is usually minor compared to a brokerage and access to other account types.

[Global100]

Street thief sees a person currently using a financial app, grabs the phone while its still logged-in and runs.

[stan1]

Street thief sees a person currently using a banking app, grabs the phone while its still logged-in and runs.

That's a person issue, not a phone issue. Don't use a banking app in an insecure location such as on a busy street corner.

Set the phone up so you have to reauthenticate frequently. Phone is probably safer than a Gucci over the shoulder purse, a backpack, or a bulging wallet in back pocket.

[UpperNwGuy]

this is Bogleheads where some will say it's not safe unless you are doing online banking from an unlit windowless room with a dedicated computer with it's own internet connection used only for financial institutions.

I met a woman who did exactly that. And she was critical of me for not doing the same.

[stan1]

this is Bogleheads where some will say it's not safe unless you are doing online banking from an unlit windowless room with a dedicated computer with it's own internet connection used only for financial institutions.

I met a woman who did exactly that. And she was critical of me for not doing the same.

People are not good at objectively evaluating risk. I have a friend who takes extreme measures with his online presence and phone, but then he tells me he has a six figure valued stack of gold bars in his home. Yes he told me that, so I guess he trusts me more than the NSA and his mobile phone carrier. No idea how many other people he has told.

[upwind]

Anyone can install a financial app on their phone. But they still need your login credentials. There is nothing that ties the phone an app is installed on to particular user. If I have your credentials, then I can install an app on my phone and login. It's not having the app on your phone that's the risk, it's having the credentials.

Most, or least many, apps (including the one bank app I have used) don’t require you to login every time once they are setup. At best there might be biometrics.

For websites some people store login credentials on device that auto fill in with biometrics. This feels icky to me. I couldn’t login when I was out and about even if I wanted to because I do not know or carry full password for anything and they are not on or accessible from any mobile device.

[Global100]

Street thief sees a person currently using a banking app, grabs the phone while its still logged-in and runs.

That's a person issue, not a phone issue. Don't use a banking app in an insecure location such as on a busy street corner.

Set the phone up so you have to reauthenticate frequently.

Yes, agree with the first line of the reply: no use in insecure locations! As for the second line: if I were to grab someone's phone while logged-into Vanguard brokerage during market hours, I'd immediately sell their individual stocks and then use the proceeds to buy index fund ETF for them : )

[upwind]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

Ok. That makes more sense now.
In the past there was no encryption and now there is in most cases. The security has changed and the old warnings are still what a lot of people like me remember.
With that being said, I am still not doing banking on public WiFi
I feel very good about using my phone thru cellular if I need to do something financial now.

Encrypted data is just that encrypted data. That is great and fine (although I’ll go on record here and now as saying all, current, encryption will eventually fall).

However, what people are overlooking is that you need to be certain you are presenting credentials to the correct computer. Too many devices are setup to simply accept the DNS configuration provided by the WiFi device to which they connect. If I control the DNS server you use I control your connections. So blindly using any WiFi network you stumble over without having your device setup in what is probably a non-default configuration may still be a problem. The point is there are still security considerations when using random WiFi networks.

[jebmke]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

Ok. That makes more sense now.
In the past there was no encryption and now there is in most cases. The security has changed and the old warnings are still what a lot of people like me remember.
With that being said, I am still not doing banking on public WiFi
I feel very good about using my phone thru cellular if I need to do something financial now.

Encrypted data is just that encrypted data. That is great and fine (although I’ll go on record here and now as saying all, current, encryption will eventually fall).

However, what people are overlooking is that you need to be certain you are presenting credentials to the correct computer. Too many devices are setup to simply accept the DNS configuration provided by the WiFi device to which they connect. If I control the DNS server you use I control your connections. So blindly using any WiFi network you stumble over without having your device setup in what is probably a non-default configuration may still be a problem. The point is there are still security considerations when using random WiFi networks.

makes sense. I don't use my ISP's DNS service, partly because in the past it has been a bit wonky and sometimes when I get reports from the local peanut gallery that "the internet is out" it turns out that the DNS server on the other end is out. So I changed our router. I recently also changed my iPhone and iPad since I take them with me to other locations. I'd have to check but I think I am now using Quad9.

[DrChronzworth]

Your iPhone is the most hardened piece of consumer electronics you can buy.

Yah there are IPhones from 2008 that the FBI / NSA have active open bounties on because they can’t get into them.

So long as your password isn’t a four digit pin and you disable biometrics there’s really no safer method of accessing something online.

A thief could always break into your house and steal your laptop / desktop - unless you have TrueCrypt on your hard drive the thief would have a much easier time discovering your logins than if they stole a locked Iphone.

[hoops777]

As a non tech person, my final take after reading all these posts is this.
When traveling in the USA, I feel comfortable using my iPhone to access my brokerage if need be. I do not feel comfortable using public wi fi to access financial accounts, even if that has seen big improvement in security.
I feel that is a pretty reasonable course of action.
All of my accounts are 2 factor authentication with a verbal secret password or phrase for phone calls.
I am aware someone can assault me to gain access.
I am aware of a lot of bad things that can happen in day to day life.
I do know there is no evidence I am aware of, of someone properly using their Schwab IPhone app and having that intercepted and an account somehow drained.
Live on.

[Nohbdy]

This thread has over 5k views and 70 replies.

I don’t see any first hand or second hand experience with an actual related problem.

Is this really something to worry about?