why does your bank (again) impose a deadline on you?

In some banks, it is necessary to wait several days before you can transfer money to a new beneficiary. This, despite the implementation of reinforced security measures. We explain their choices to you.

Yes, you have finally found a house that you like for the summer holidays. To finalize the rental, all you have to do is transfer the requested deposit to the owner’s account. Time is running out, you’re not the only one out there. Problem: Your bank asks you to wait 48 or 72 hours before you can send the money. Time, she explains, to validate this new transfer beneficiary.

If this situation seems familiar to you, it is because you are a customer of a banking institution which continues to apply a timeout. However, they are becoming increasingly rare.

Adding a beneficiary, highly sensitive

These delay periods, let us remember, have long been the norm. A few years ago, they constituted the first level of the arsenal put in place by banks to fight against fraud and secure your money.

Adding a beneficiary, in fact, is a highly sensitive operation. An ill-intentioned third party who manages to penetrate your online banking space and add himself to your beneficiaries can empty your accounts at high speed. This type of usurpation is also one of the main objectives of scams involving fake advisors, which are currently becoming increasingly popular. ‘huge damage.

The problem is that this delay is also a irritating for users. Even more so since the arrival of instant transfer, which now allows money to be transferred to another account in less than 10 seconds, 7 days a week, 365 days a year.

Strong authentication, the new standard

The banks have found the solution: strong authentication. Since 2021, they have the obligation touse this type of device to secure online payments by credit card. The name varies depending on the brand (digital key at BNP Paribas, Scur’Pass at Banque Populaire and Caisse d’Epargne, Scuripass at Crdit Agricole, Mobile Confirmation at Crdit Mutuel, etc.), but the principle is always the same. This is to ensure that the operation is properly initiated by the card holder by asking them to provide additional proof: a secret code, biometric authentication, the use of a trusted device (mobile, tablet or computer) previously registered…

The use of these strong authentication protocols has thus been extended to other sensitive operations, including the addition of beneficiaries. Result: many banks have abandoned the timeout when there is strong user authentication.

Some, however, continue to allow their customers the possibility ofadd a beneficiary without going through strong authentication, but by a less robust method, such as sending a one-time SMS code. In this case, they maintain a timeout period. This is the case, for example, at Banque Populaire (72 hours), Caisse d’Epargne (72 hours) or Crdit Agricole (48 hours).

Belt and suspenders

Finally, there is a 3rd category. Some brands, increasingly rare, prefer to play belt and suspenders, in implementing strong authentication in the enrollment process while now a timeout. This is the case of La Banque Postale (48 hours), Crdit Mutuel de Bretagne (72 hours, only via the website), but also digital banks like Hello bank! (24 hours) or Fortuneo (24 48 hours).

The brands in question did not wish to discuss in detail the reasons for this double security. The issue, of course, is that of find the best way to protect accounts, even if it means degrading (a little) the user experience, deprived of real time. (…) The security of our customers and their assets is a priority, confirmed for example by communication from Hello bank!. When a new beneficiary is added, a notification is sent to the customer allowing them to react if they are not the originator of the addition. The 24-hour delay allows it to prevent recording.

In the background, obviously, the explosion, in recent months, of manipulation fraudduring which the criminals do not just steal data allowing them to usurp a means of payment, but contact their victims directly, often by telephone, to get them to validate operations protected by advanced security devices.

Because strong authentication is not infallible. It guarantees banks that their client has intervened to validate an addition of beneficiary. Not that this validation wasn’t obtained through trickery.

Transfers: is your bank doing enough against fraud?