Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough information to allow an attacker to drain an account if they get the monthly statement. Yet, they do need to be updated from time to time.

What can one do to protect against fraudulent attempts?

share|improve this question
There are published guidlines on what is required when dealing with banking information. I would look to that when dealing with banking information. As a customer the only security controls banks like Bank of America one of the largest banks in the US is being able to log into the account itself. – Ramhound Aug 29 '12 at 11:02

Certainly, one can ask an extra question that's not normally asked in the regular online banking process. That will provide some measure of protection.

I think the best defense, though, is to ensure that a change of address triggers mailing a notification to the old address. Then delay any mail to the new address for a week. If the change was fraudulent, this gives the user a reasonable opportunity to respond. Automated phone calls to the former phone number of record may also be helpful.

share|improve this answer
I agree! This answer is spot on. Sending a notification any time the address is changed is a great recommendation. One addition I would suggest: if the system allows multiple addresses (e.g., multiple email addresses), send a notification any time an additional email address is added. Reason: this is one way that hackers who have compromised someeone's account try to retain access (that way, they can see password resets and such). – D.W. Aug 29 '12 at 17:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.