ING requires its app for online banking: what alternatives remain

ING limits web access without app: PSD2 does not mandate installation

Install the app or be left out. This is the ultimatum ING has issued to a segment of its customers regarding online banking starting in September, though no specific date has been confirmed. No app means no web access: the bank's alternatives are calling by phone or visiting a branch. The argument used is PSD2, the European payments directive. The issue is that PSD2 does not mention any specific application.

The measure is framed in regulatory language that lacks a solid basis. This is where the friction begins: between those who see the change as a commercial imposition disguised as law, and those who believe SMS validation is a loophole that should have been closed long ago.

Does PSD2 require installing the bank's app?

No. The European Payment Services Directive mandates Strong Customer Authentication (SCA): two independent factors to confirm transactions. That is all. The regulation requires that validation does not depend on a single element, but no article forces that second factor to be a proprietary application owned by the entity.

Several banks have resolved this via the cheaper route: a one-time code sent by SMS. Banco Santander combines the usual password with that message; BBVA does the same, as does Openbank. The recurring conclusion is uncomfortable for ING: the obligation is double validation, not the app. If someone wants to use it, they can; but presenting it as the only option is something else entirely.

The permissions required by the app

Here lies the second front. On the Play Store, the app requests a list of permissions that goes far beyond what the function requires: phone status and identity, precise location (GPS and network), approximate location, USB storage access, contacts, camera, and microphone. To validate a transfer, the camera is unnecessary unless used to scan an ID.

Some go further, claiming the app only works on devices under the manufacturer's control: no rooted phones or custom ROMs. In other words, the bank decides which phone is suitable. This is no small decision when account access depends on that single device.

SMS vs. App: which is more vulnerable?

SMS has a bad technical fruta, and for good reason. A text message travels in plain text and can be intercepted by numerous methods, starting with any installed app with permission to read and send messages. A time-limited one-time code is a barrier, but it is not a wall.

The counter-argument from app supporters is exactly that: the short message system is unfixable, whereas in-app validation is. The discussion remains unresolved on one point: documented attacks against SMS double validation have been highly targeted, not mass sweeps. No one has demonstrated a large-scale compromise.

And there is a detail often forgotten: by concentrating all security in the mobile device, a customer who loses or has their phone stolen loses control of their account. Previously, coordinate cards, IDs, and passwords were spread across different media. Now, there is a single point of failure.

What alternatives remain to avoid installing the app?

There are actually three. Telephone banking, physical branches, and, for the tech-savvy, an Android emulator on a computer: installing BlueStacks or similar to run the app within a PC, avoiding the phone. It is a workaround, not an elegant solution.

The fourth option, which is gaining momentum, is switching banks. The profiles showing the most resistance are precisely those who have never wanted to install anything. When the price of online banking is handing over mobile permissions, customers start looking elsewhere. There are also those who remind us that not everyone has a high-end smartphone: there are old or budget devices that are left behind.

Current status of access as of late September

As of the latest reports, the situation is not what the initial warning suggested. On September 23, many accounts were still accessing the web normally without the app installed. On the 27th, transfers were being completed through the usual channels. Mobile validation was already being described as optional for payroll account holders, while others continued without it.

There was, however, one day of intermittent outages: the website would reject customers after they entered their credentials, sending the code but failing to proceed, while mobile access worked fine. The next day, everything returned to normal without an official explanation.

Given this landscape, forcing the app on the entire customer base before the end of the year seems unlikely. It is highly probable that the next notice will arrive under a different regulatory guise.