Kiwibank 2FA - using SMS

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › Kiwibank 2FA - using SMS

MartinGZ

376 posts

Ultimate Geek
+1 received by user: 128

Subscriber

#324250 17-Mar-2026 12:55

I know banks have to deal with the full spectrum of customers, but is Kiwibank going backwards?

KB standard login on PC has been password and KeepSafe (you know, What is Aunt Fanny's middle name type thing.) On mobile you could set biometrics and security pin (more on that later.)

Today when logging in on a PC it suggests; "If you have a verified New Zealand mobile number, using your mobile to verify your login is more secure than KeepSafe."

For the last month or two KB has suggested more and better security is coming, so I guess this is it. The full details are here: https://www.kiwibank.co.nz/help/online-banking/authentication/

The three choices are:

Biometric login. Fine, been enabled on the mobile for yonks, but needs a 4 digit pin to be enabled. Besides, not much use on my PC.
SMS one-time codes. This is new, and we know what to think on this one.
Security code: Been on mobile for a while and is a 4 digit code to:

Enhanced security
Security codes offer stronger protection than traditional passwords.

Simplify your login
Security codes are shorter than passwords and easier to remember.

Errrr? Contradiction in terms here.

I've always had a beef on this one on the mobile. Once you have logged into mobile KB, to enable biometrics you MUST have enabled a 4 digit pin. Thereafter, you can login to mobile KB using biometrics OR the 4 digit pin, to me this is pretty crap security. How is a 4 digit pin more secure than a 16 character password for goodness sake?

Note that TOTP 2FA or passkeys are not options. I can understand why businesses like banks don't like making these compulsory, but they should at least be one of the options available for those of us that are more security conscious.

Govt advice: Your two-factor authentication methods – ranked - Own Your Online

johno1234

3357 posts

Uber Geek
+1 received by user: 2843

#3471097 17-Mar-2026 13:24

Kiwibank slow on technology uptake from day 1 so no surprises here. They were slow on Apple Pay and Google Pay and still have no proper 2FA. It is inexcusable.

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#3471098 17-Mar-2026 13:25

The problem is with usability.

Can your grandma use standard 2FA? Or can she manage setting up standard 2FA with a separate app?

Can she be trusted to pick a secure password that isn't her pets name followed by 12? Will she remember it?

SMS unfortunately bridges this gap and is the "better than nothing" approach even if we know it isn't that secure. The way BNZ does it I think is excellent using a combo of SMS and app based push notifications if you have the app active and also making you wait to read the message. I think other banks will follow this.

Kiwibank is currently going through replacing their IB (you'll notice this with the 3 subdomains when you use IB - login, bank and ib with ib being their legacy platform) and I'd say they'll bring in app based push notifications and all the fun stuff other banks have.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

lapimate

353 posts

Ultimate Geek
+1 received by user: 28

Trusted

Lifetime subscriber

#3471117 17-Mar-2026 14:24

MartinGZ: ... Govt advice: Your two-factor authentication methods – ranked - Own Your Online ...

Not a word about Passkeys on the above site? Hardly new technology.

MartinGZ

376 posts

Ultimate Geek
+1 received by user: 128

Subscriber

#3471249 18-Mar-2026 09:22

michaelmurfy:

The problem is with usability.

Can your grandma use standard 2FA? Or can she manage setting up standard 2FA with a separate app?

That is understood, hence my comment in my last sentence. That does not however excuse KB from printing blatent untruths on their website; e.g. the fact that a 4 digit pin is more secure than a password "Security codes offer stronger protection than traditional passwords". Those words and the fact they have introduced SMS do not inspire much confidence in the changes they are making.

Yes KB has stated they are changing their website and making it more secure, but that is all, no info on what they aspects they are changing. Why don't they publish a roadmap so we can see where they are heading? I look at the changes and I really start to wonder why after 20 years with the bank I should remain.

As an aside on the gradma bit, my father-in-law is 100 later this year, still gets his laptop out to "skype" every week, and has only recently stopped doing his own banking. So yes there are plenty of grandmas and pas who are capable of these things, but agreed, also a heck of a lot that are not.

networkn

Networkn
32871 posts

Uber Geek
+1 received by user: 15466

ID Verified

Trusted

Lifetime subscriber

#3471252 18-Mar-2026 09:29

I've been moaning to them about this for years, they are just luddites. It's not a customer management problem, it's a they don't think their lower security standards are a problem problem.

Their last response to me was 'we hear you, however, in our history, we have never seen anyone compromised as a result of these being the way we do things, so it's not a priority for us to fix it'

If it wasn't so expensive to move our mortgage tied to a trust, we would have dumped them years ago.

richms

29104 posts

Uber Geek
+1 received by user: 10219

Trusted

Lifetime subscriber

#3471268 18-Mar-2026 10:22

Having had to deal with customer enquiries for a very basic ecommerce website with primitive SMS and email 2 factor, I can assure you that even those options are too hard for many people to understand. They will enter a code from a SMS that they got 2 weeks ago and then complain that it doesn't work. They will block the sender instead of deleting the SMS and then complain that they don't get the codes.

Richard rich.ms

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

networkn

Networkn
32871 posts

Uber Geek
+1 received by user: 15466

ID Verified

Trusted

Lifetime subscriber

#3471274 18-Mar-2026 10:32

richms:

Having had to deal with customer enquiries for a very basic ecommerce website with primitive SMS and email 2 factor, I can assure you that even those options are too hard for many people to understand. They will enter a code from a SMS that they got 2 weeks ago and then complain that it doesn't work. They will block the sender instead of deleting the SMS and then complain that they don't get the codes.

This was the argument that some people here made about why MFA shouldn't be on ManageMyHeallth and I was adamant people will adjust and was pilloried by people who should know better.

Nekminnit...

People will adjust. They must. Change is hard, so is loosing your life savings.

MartinGZ

376 posts

Ultimate Geek
+1 received by user: 128

Subscriber

#3471419 18-Mar-2026 16:38

Ahh....

Playing around, I've just discovered that you can now turn the PIN and/or Biometric login entries off/on in the app settings. Pretty certain that did not used to be the case, but good to see it now as a configuration. Needless to say, I have PIN login turned off.

But my other points still stand. Hopefully.

MartinGZ

376 posts

Ultimate Geek
+1 received by user: 128

Subscriber

#3471474 18-Mar-2026 16:50

networkn:

This was the argument that some people here made about why MFA shouldn't be on ManageMyHeallth and I was adamant people will adjust and was pilloried by people who should know better.

Nekminnit...

People will adjust. They must. Change is hard, so is loosing your life savings.

I know plenty of people who have adjusted, but sometimes it takes quite a bit of support before they get the hang of things. To me there are certain apps/websites where MFA is absolutely essential these days.