Monzo’s Outdated Verification Methods: A Critical Analysis

---

Monzo, widely regarded as an innovative “challenger bank,” rose to prominence by offering real-time payments, budgeting tools (like “pots”), and a user-friendly mobile application. Historically, its technology-driven ethos and transparent marketing set it apart from traditional high-street banks. However, emerging accounts of outdated, insecure, or customer-unfriendly verification processes create a dissonance between Monzo’s self-portrayal and its actual practices. These issues include:

1.1.     Unencrypted Email Requests: 

• Users are asked to send highly sensitive identity documents (selfies with ID) via standard email—a notoriously insecure channel that can expose data to interception or misuse.

1.2.     Obscure Phone Questions: 

• Phone representatives asking about long-forgotten “pots” or details from years ago, with no flexible alternatives, forcing legitimate customers to “fail” security if they cannot recall trivial account history.

1.3.     Rigid and Unhelpful Service: 

• Anecdotes of abrupt call terminations or refusal to proceed when a user cannot satisfy a single obscure question. This leaves genuine customers locked out, fostering distrust.

• Such problems not only conflict with Monzo’s self-image of a digitally sophisticated operation but also risk contravening regulatory standards—notably, data security requirements under UK GDPR and fairness principles under the FCA Consumer Duty. For a bank priding itself on “the future of finance,” these are glaring oversights. Critics argue that if a supposedly high-tech bank continues pushing insecure email for sensitive data, it raises questions about whether it is “running with other people’s money” like a band of pirates rather than protecting customers as promised.

• This report provides an extensive analysis of these issues, their regulatory implications, consumer reactions, and recommended reforms to realign Monzo’s practices with both public expectations and fundamental data protection obligations.

2.     Introduction: Monzo’s Contradictory Reputation

• Monzo launched with a flurry of positive press and was one of the first UK fintechs to offer:

2.1.     Instant Notifications: 

• Real-time spending updates on smartphones.

2.2.     Fee-Free Spending Abroad: 

• Early marketing campaigns touted minimal foreign exchange fees.

2.3.     Pots for Budgeting: 

• Quick sub-accounts to separate funds for savings, bills, or specific goals.

2.4.     Transparent, Customer-Centric Branding: 

• A modern approach that championed openness, big on “We’re not like your old bank.”

• For years, this approach helped Monzo develop a near-cult following among younger consumers and tech enthusiasts. Many hailed it as a revolutionary “app-based bank” that put the old banking system to shame. 

• Yet, recent accounts suggest that behind the polished user interface, some of Monzo’s day-to-day operational practices remain stuck in the past—particularly when it comes to identity verification and dispute resolution. 

• These contradictions are at odds with the tagline of being a “digital-first” institution. Instead, the critics claim, Monzo sometimes behaves like an old-fashioned operation using outdated or insecure channels, effectively “pulling the rug out” from customers when they need help the most.

3.     Verification via Email: The Core Security Flaw

3.1.     The Practice: Emailing Selfies with ID

• Multiple users report being asked by Monzo to send a selfie of themselves holding their ID—like a passport or driver’s license—through unencrypted, plain-text email. 

• This tends to occur when:
  • A user is locked out of the Monzo app (e.g., after losing or changing phone).
  • Monzo flags a suspicious transaction or needs extra checks.
  • The user is trying to retrieve old statements or complete a request (such as a Subject Access Request under GDPR).

• Rather than providing a secure upload portal or in-app verification (as is done initially when opening an account), Monzo staff direct users to standard email. 
• Since email is typically unencrypted, it is an insecure channel that can be intercepted or compromised, placing personal data at substantial risk.

3.2.     Why This is Risky

3.2.1.      Exposure to Interception

• Plain email traffic can be intercepted by malicious parties, especially on public Wi-Fi or compromised networks. If an attacker gains access, they can harvest passport numbers, addresses, birthdates, and facial images—enough to commit identity fraud.

3.2.2.     GDPR Requirements

• Under the UK General Data Protection Regulation (UK GDPR), personal data (especially ID documents) must be processed securely, requiring “appropriate technical or organizational measures.” 
• Article 5(1)(f) specifically compels companies to uphold integrity and confidentiality. 
• Email attachments containing passports or licenses, in many experts’ opinions, fail the “appropriate security” test unless encrypted.

3.2.3.     Data Breach Liability

• A data breach involving unencrypted ID documents could trigger heavy fines from the UK’s Information Commissioner’s Office (ICO). 
• Past cases (e.g., major fines against companies for insufficient encryption) illustrate how regulators penalize entities that handle personal data negligently.

3.2.4.     Inconsistent with Tech-Savvy Image

• Monzo touts cutting-edge tech. Encouraging email-based identity checks directly contradicts the advanced security stance the bank claims. 
• Traditional banks have long avoided advising customers to email ID documents unencrypted, so it appears especially outdated for a self-branded “digital pioneer.”

3.3.     Customer Alarm

• Unsurprisingly, many loyal Monzo customers, who typically trust the app-based approach, feel unsettled or suspect a scam when they receive these instructions. 
• They question whether the request is legitimate, leading to confusion and a breakdown in trust. 
• The practice has been publicly lambasted on forums and social media, with critics calling it “pirate-like” data handling—akin to “stealing” personal info or at least exposing it to risk. It shatters the expectation that “digital bank” equals “secure by design.”

4.     Phone Verification: Rigid Questions and Unhelpful Calls

4.1.     Obscure “Pots” and Historical Trivia

• Monzo’s “pots” feature is a popular tool for short-term savings or budgeting sub-accounts. Some accounts date back to 2016–2018 when pots could be automatically generated (for instance, via salary-splitting). 
• Customers have reported being quizzed about the exact name of their first pot from years ago to pass phone verification. If they cannot remember or never consciously created the pot themselves, they “fail” verification.
• This approach is seen as unnecessarily obscure. The pot name is not a standard security question (like mother’s maiden name or a memorable word).
•  It feels more like an internal detail that might not be commonly known to the account owner—especially if the pot was auto-created or used only fleetingly.

4.2.     Surprise Calls and Early Timing

• Customers also mention receiving calls at times that don’t match the scheduled slot (e.g., an hour early), leaving them unprepared:
• They might not have immediate access to old statements or pot history.
• The representative apparently offers no alternative if the user says, “I can’t recall that pot name.”
• In some cases, calls ended abruptly, with the user told, “You failed security,” and no further help was provided.

4.3.     Possible Breach of FCA Standards

• The Financial Conduct Authority (FCA) has a framework for fair treatment of customers and efficient complaint resolution. A crucial concept is Consumer Duty, requiring banks to provide good outcomes for customers by being clear and not erecting unfair barriers. For instance:
  • 4.3.1. DISP 1.4.1 R (FCA Handbook) instructs firms to handle inquiries “fairly, consistently and promptly.” Rigid phone checks about pot names from years back—without a fallback method—could be viewed as unfair. It may block genuine customers from their own accounts.
  • 4.3.2. The Consumer Duty also emphasizes empathy: if a user is in a stressful situation (locked out of funds), the bank should not force them into a memory test that’s prone to failure. Doing so undermines customer welfare.

4.4.     Impact on Customer Trust

• It’s one thing to have robust security measures; it’s another to appear to be “catching out” legitimate customers who simply cannot recall a random pot name from half a decade ago. 
• The phone-based verification process, when combined with abrupt endings and no second chances, feels less like a protective measure and more like an institutional hurdle. 
• Users have described it as “pirate-level,” in the sense that they were effectively “boarded, questioned abruptly, and left adrift without explanation.”

5.     Regulatory and Compliance Overview

5.1.     UK GDPR

• 5.1.1. Article 5(1)(f): 
  • Requires data to be processed securely. Sending passports or IDs via unencrypted email undermines confidentiality.
• 5.1.2. Article 32: 
  • Mandates “appropriate technical and organizational measures” such as encryption at rest and in transit, especially for sensitive data (like government-issued IDs). 
• A simple email attachment is a widely known vulnerability, placing Monzo’s policy in questionable territory.
• A regulator could argue Monzo is not “taking all steps to ensure data security,” opening the door to potential enforcement action or fines if user data is compromised.

5.2.     FCA Consumer Duty and Complaints Handling

• 5.2.1.  Consumer Duty: 
  • Banks must ensure the best possible outcome for customers, not just meet a minimal standard of security. 
  • Overly complex or archaic methods can cause “foreseeable harm” to legitimate customers, which the Duty aims to prevent.
• 5.2.2. Fair Treatment of Customers (TCF): 
  • This principle demands that processes do not unfairly exclude or disadvantage people. 
  • ]Expecting them to recall years-old pot names or sending sensitive info via insecure channels arguably disadvantages them.
• 5.2.3. DISP 1.4.1 R:
  •  If the user is raising a complaint or is in the midst of an account closure/issue, the bank must handle it fairly and promptly. 
  • Relying on outdated security checks can hamper the resolution timeline and create additional distress.

5.3.     Potential Consequences

• 5.3.1.  Reputational Risk: 
  • Even if regulators do not formally sanction Monzo, widespread complaints and negative social media coverage erode brand trust.
• 5.3.2. Financial Penalties: 
  • Should there be a breach or a large volume of complaints, the FCA could impose sanctions. 
  • The ICO could impose fines if Monzo fails to protect personal data.
• 5.3.3. Customer Attrition: 
  • Customers may close accounts if they perceive that Monzo’s verification or security standards are dangerously lax or unfairly obstructive.

6.     Consumer Feedback and Public Perception

6.1.     Online Forums and Social Media

• Monzo’s community forum once showcased enthusiastic posts praising the bank’s “new wave” approach. Lately, threads highlight:
  • 6.1.1.  Shock at Email Practice
  • 6.1.2. Users comment that “no reputable bank” would request passports over plain email.
  • 6.1.3. Others share they initially assumed it was a phishing attempt—only to discover it was legitimate.

6.2.     Frustration over Pot-Related Quizzes

• Comments describing phone calls where the user was asked about the pot name from 2018.
• Many claim they had never personally created or named a pot, so they felt set up to fail.

6.3.     Erosion of Trust

• Some long-term fans say they’re reconsidering if Monzo is truly “cutting-edge.”
• The phrase “feels like being left high and dry by pirates” arises in a few rants—a metaphor for an institution that takes your money but leaves you on your own when verifying identity or reclaiming funds.

6.4.     Media and Competitor Banks

• Several fintech review sites and consumer advice columns have picked up on these complaints. 
• There is growing commentary that “Monzo’s polished app UI masks older back-end practices,” suggesting that the bank’s public-facing brand might be more advanced than its operational reality. 
• Competing digital banks highlight their own secure, in-app document upload features as a direct contrast, implying that Monzo’s approach is behind the times.

7.     Criticisms: “Old-Fashioned Waze” vs. Tech Claims

• Monzo’s marketing typically revolves around a forward-thinking approach—no branches, no legacy systems. 
• Yet these specific verification methods resemble:
  • 7.1.      Manual Email Exchanges—like a decades-old process predating advanced encryption.
  • 7.2.     Arcane Call Quizzes—akin to older phone-banking models that ask customers random questions from account history.
  • 7.3.     Deflections and Abrupt Endings—something many associate with poorly trained call center staff, reminiscent of older, less agile institutions.
• This discrepancy angers users who believed Monzo’s hype about being “the future of banking.” 
• Instead, they see a mismatch so jarring that they label it “bullshit” and accuse the bank of operating like “pirates”—collecting user data in insecure ways, then failing to assist when customers truly need service. 
• The frustration stems from the gap: 
• if Monzo truly were a best-in-class digital bank, why is it not using standard secure channels or more user-friendly knowledge checks?

8.     Recommendations for Improvement

• To address these criticisms and align with genuine digital standards, Monzo should:

8.1.     Overhaul Email Verification

• 8.1.1.     Implement Secure Upload Portals
  • Provide a unique, end-to-end encrypted link for users to upload ID documents.
  • Time-limited links that automatically expire reduce risk.
  • This is a common industry practice—far safer than attachments in plaintext email.
• 8.1.2.     Offer Alternate Channels
  • If the app is inaccessible, allow a password-protected PDF or document with the password sent via SMS/call.
  • Integrate an “Emergency Verification” feature within a website or a separate support app to avoid regular email.
• 8.1.3.     Educate Staff and Customers
  • Enforce a policy: “Never request unencrypted ID docs via standard email.”
  • Update help guides so customers know they have secure alternatives.

8.2.     Streamline Phone Verification

• 8.2.1.     Use Universal Security Checks
  • Rely on recent transactions, address confirmation, a passcode or code texted to the user, or partial ID info.
  • Avoid obscure questions about pot names or other rarely-used features from years ago.
• 8.2.2.     Multiple Methods for Failing One Check
  • If the user can’t confirm one detail, offer a second or third question.
  • Provide a fail-safe route, such as “We’ll send a one-time code to your phone or email on file.”
• 8.2.3.     Schedule Calls or Provide Call-Backs
  • Let the customer pick a time, so they can gather relevant info.
  • If a call is missed, allow an easy way to request a new slot without penalty.

8.3.     Bolster Consumer Duty Compliance

• 8.3.1.     Vulnerability Protocol
  • If a customer is older, disabled, or stressed, staff should pivot to a more flexible approach.
  • Document that staff must not automatically terminate calls if the first piece of info is incorrect.
• 8.3.2.     Transparency in Complaint Handling
  • Clarify how identity will be verified for complaints or account closure disputes.
  • Provide estimated timelines and escalate promptly if standard verification fails rather than leaving customers in limbo.

8.4.     Publicly Reassure and Recommit

• 8.4.1.     Publish a Security Statement
  • Outline specific steps being taken to adopt secure verification.
  • Affirm that plain email is no longer used for ID checks.
• 8.4.2.     Solicit User Feedback
  • Invite user suggestions on phone verification. Possibly run a pilot program with a different set of security questions and gather data on success rates.
• 8.4.3.     Leverage Monzo’s Strengths
  • Integrate more advanced in-app features: 
  • Video calls with embedded ID scan, user-driven re-verification via app with multi-factor authentication, etc.
  • Show the community that Monzo truly stands by its technology-forward identity.

• By implementing these measures, Monzo can address the fundamental criticisms—that it appears ironically “low-tech” or even “reckless” in verifying user identity—while fulfilling both regulatory and consumer trust obligations.

9.     Potential Consequences of Inaction

• If Monzo continues relying on unencrypted email ID checks and obscure phone quizzes, several negative outcomes could escalate:

9.1.     Regulatory Intervention

• The ICO may investigate under GDPR, particularly if a data breach occurs.
• The FCA or Financial Ombudsman Service could impose corrective actions or fines if users are systematically denied fair access or forced into insecure processes.

9.2.     Reputational Erosion

• Word-of-mouth warnings might deter new customers.
• Existing customers could switch to other digital banks that use more secure, intuitive verification channels.

9.3.     Legal Risks

• Class actions or group complaints could emerge if multiple customers suffer identity theft due to emailing passports or if many are locked out by arbitrary phone checks.

9.4.     Undermining “Digital Bank” Credibility

• Monzo’s brand relies heavily on innovation. Repeated stories of archaic or risky verification undermine that brand proposition.

10.      Conclusion: Criticisms, Contradictions, and the Path Forward

Despite marketing itself as a cutting-edge fintech disrupter, Monzo has been criticised for employing verification practices that some customers describe as “pirate-level”—storing or transmitting sensitive information in insecure ways and locking out genuine users based on questionable phone quizzes. These issues highlight a stark contrast between the public image of a forward-thinking, technology-driven bank and the reality of outdated or inconvenient security measures.

10.1.     Email Verification: 

• Insecure, unencrypted, and arguably non-compliant with GDPR’s robust security demands.

10.2.     Phone Verification: 

• Rigid, reliant on obscure pot trivia, and lacking empathy or fallback paths, causing some legitimate customers to fail security checks unfairly.

From a regulatory perspective, the bank risks running afoul of both data protection (UK GDPR) and financial conductrules (FCA Consumer Duty). From a consumer standpoint, these failures are breeding distrust and frustration, precisely the opposite of what a digital-first institution aims to foster.

Still, Monzo has the advantage of an advanced technological environment and a user base open to trying new solutions—if the bank chooses to address these lapses head-on. 

By introducing secure document-upload systems, standardising phone questions, and training staff in a more empathetic approach, Monzo could realign its operations with the modern ideals it claims to uphold. Failure to do so, however, will continue fueling the perception that Monzo is “running with other people’s money” using questionable or old-fashioned processes.

For a bank that once proudly declared it was “built to change banking forever,” the immediate priority should be to stop forcing customers to compromise their personal data through insecure channels and to start verifying them in ways that are truly consistent with the spirit of a 21st-century digital bank. Only then will Monzo shed the accusations of being a “pirate” with subpar security and fully reclaim the trust and respect it initially earned in the fintech realm.

End of  Report

Disclaimer: The above analysis is based on publicly available or commonly reported issues and commentary regarding Monzo’s verification processes. It does not constitute formal legal advice. Any regulatory implications are cited based on general references to GDPR, FCA rules, and industry best practices. For definitive guidance, consult qualified data protection or legal counsel for financial services.

This article critically examines Monzo's seemingly outdated verification methods—requesting ID selfies via unencrypted email and obscure phone quizzes about forgotten "pots." Despite presenting as a leading digital bank, these practices raise serious GDPR security concerns, frustrate legitimate customers, and potentially conflict with the FCA's Consumer Duty. The piece outlines regulatory implications, user reactions, and recommendations for Monzo to adopt modern and secure verification processes.

Below is an in-depth report highlighting criticisms of Monzo's older-style verification methods—particularly unencrypted email and obscure phone checks—despite its branding as a top-tier digital bank. This document addresses specific shortcomings, contrasts them with regulatory expectations (UK GDPR, FCA Consumer Duty), and proposes improvements.

Examining Monzo's insecure email requests and challenging phone quizzes, their impact on GDPR compliance, and recommended improvements.

1.1.     Introduction

Despite the inherent risks, sending personal data over unencrypted email remains a surprisingly common practice. In its original form, email was never designed for secure file transmission; it typically lacks robust end-to-end encryption and can be intercepted at various points. In today's data-driven world, where identity theft and cyber-attacks are rising, unprotected email exposes individuals and organizations to significant vulnerabilities. This section explores why unencrypted emails is insecure, the potential legal and financial repercussions, and how more secure alternatives better align with modern data protection standards.

1.2.     Email's Inherent Vulnerabilities

Email traffic generally passes through multiple servers without guaranteed encryption. Any malicious actor accessing a compromised network can intercept messages that are not encrypted. Stored emails might remain in plain text on mail servers, making them accessible if hackers breach those systems. In addition, phishing campaigns frequently target email accounts; once compromised, the attacker can exploit all the sensitive data in a user's inbox or sent folder. These vulnerabilities underscore that email was not designed to transmit highly confidential documents such as passports, driver's licenses, financial statements, or medical records.

1.3.     Common Types of Data at Risk

Unencrypted emails often contain government-issued identification details and sensitive financial information. Passports, driver's licenses, and confidential statements are especially valuable to cybercriminals, who can use them to open unauthorised lines of credit or carry out fraudulent transactions. When combined and sold on the dark web, personally identifiable information like full names, addresses, and birthdates can have devastating consequences. Even more troubling is the possibility of exposing medical or insurance data, which has financial implications and can infringe on a person's right to privacy.

1.4.     Consequences of Email-Based Data Exposure

When personal data is sent unencrypted, identity theft becomes significantly easier for criminals when personal data is sent unencryptedIdentity. Victims may spend years correcting their credit records, dealing with fraudulent charges, and restoring their financial integrity. Organisations responsible for the leak face legal liability, mainly if regulators conclude that insufficient security measures were in place. Beyond lawsuits and potential fines, a public data breach severely harms an institution's reputation. Customers often lose faith in entities that fail to protect their data, resulting in cancelled accounts and negative publicity. Over time, the cumulative damage can far exceed the cost of implementing secure alternatives in the first place.

1.5.     Regulatory Context and Non-Compliance Risks

In many jurisdictions, transmitting personal data via unencrypted email likely violates data 

protection rules. Under UK GDPR, for instance, organisations must demonstrate that they have taken appropriate measures to protect personal information. Article 5(1)(f) explicitly requires safeguarding data against unauthorised access or accidental loss, and Article 32 outlines the necessity for encryption and other technical measures. A single interception of sensitive data might trigger investigations by the Information Commissioner's Office, potentially resulting in hefty fines. Financial services organisations additionally face scrutiny from the Financial Conduct Authority (FCA), where insecure data handling can bring further regulatory action.
1.6.   Attack Vectors in Unencrypted Email TransmissionCriminals use various techniques to exploit plain-text email data. Man-in-the-middle (MitM) attacks enable cybercriminals to intercept or alter emails during transmission, especially on public Wi-Fi networks or compromised routers. Mailbox compromise is also a primary concern: once hackers gain access to a user's email account, they effectively acquire a treasure trove of personal information, from which they can launch more sophisticated schemes like spear phishing. Even if the immediate sender and recipient are reliable, forwarded copies and email backups create multiple weak links where data can be leaked or stolen.

1.7.     Real-World Examples of Data Exposure

Numerous high-profile cases illustrate the dangers of sending sensitive information via unencrypted channels. Organisations have been fined after their email systems were hacked, exposing thousands of customers' data. In some instances, attackers gather small fragments of PII from intercepted emails, then target individuals or customer service agents to reveal additional details. Large-scale leaks have also occurred when employees inadvertently emailed spreadsheets or documents with confidential information to unauthorised recipients. These scenarios demonstrate that unencrypted email is not merely a theoretical threat but a genuine hazard with real victims and reputational fallout.

1.8.     Best Practices for Secure Communication

Companies and individuals should opt for end-to-end encrypted services when transmitting sensitive documents. A dedicated secure portal, for instance, allows users to upload confidential files under strict encryption, with access logs and time-bound links to minimise long-term risks. If email remains the only option, password-protected attachments represent a more secure fallback. The password should be conveyed separately, for instance, by phone or text message, to avoid a single point of failure. Two-factor authentication on both the sender's and the receiver's email accounts adds another layer of protection against unauthorised access. Modern banks and fintech companies rely on in-app verification processes or websites secured via HTTPS and additional encryption, reflecting industry best practices.

1.9.     Why Some Organizations Persist with Insecure Email

Despite explicit warnings, certain institutions continue using unencrypted email because of convenience, established routines, and resistance to changing legacy systems. Staff may find it faster to email directly than implement more complex solutions, and the misconception that a small volume of transmissions poses minimal implementation risk persists. Meanwhile, fully transitioning to safer methods can require retraining personnel and investing in encryption infrastructure or secure cloud services. Unfortunately, these short-term cost savings or time benefits are overshadowed by the massive potential liabilities should a security breach occur.

1.10.     Consequences of Ignoring Security

Organisations that fail to address email-based vulnerabilities will likely face increased scrutiny from regulators as data protection laws evolve and become more strictly enforced. Data breaches can drive away customers, attract unwanted media attention, and bring legal challenges that are expensive and time-consuming to defend against. After a security lapse, regaining consumer and partner trust is often an uphill struggle, as many people prefer to move their business to providers with robust, clearly articulated safety measures. The reputational fallout can take years to mend, overshadowing any initial convenience of using unencrypted email.

1.11.     Conclusion

Sending personal data over unencrypted email is fundamentally insecure, exposing sensitive information to interception, mailbox compromise, and other cyberattacks. Individuals become vulnerable to identity theft, and organisations risk legal action, regulatory fines, and reputational damage. In an era where data privacy is paramount, entities that handle confidential information—particularly in banking, healthcare, or legal services—must adopt secure communication methods. By implementing encrypted channels, password-protected file transfers, and authentication safeguards, individuals and businesses can uphold data protection principles, demonstrate compliance, and significantly reduce the likelihood of devastating breaches.