Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity to optimize and carefully select the best bank instead of just picking the one around the corner like I did the first time round.

One factor which I put a high weight on is the security of my bank, but I'm not a security expert. I have my own views on which factors are important, but I suspect that some (or all) of them are wrong.

Thus: What security factors are important when selecting a bank?

To get things started, my guess is that I should look for include:

  • Multifactor authentication
  • Authentication which does not enforce low maximum levels of security (e.g. you must use your mother's maiden name for identification over the phone).
  • Quick (preferably instantaneous) changes when I chose to update my authentication data (i.e. no 3-business day delays for password changes).

though there are more I can think of...

share|improve this question
3  
Ask an existing customer to go through their password reset process for online banking. That's usually where the security dragons sleep. –  Polynomial Dec 3 '12 at 11:26
2  
Pretty much all the banks in the US have very similar security, all of them are required to implemente "2-factor authentication" sadly this means "security questions" and not actually implement '2-factor security` the correct way. –  Ramhound Dec 3 '12 at 14:52
2  
@Ramhound Don't forget those "security images". –  Iszi Dec 3 '12 at 14:58
1  
Sadly, banks are often a great example of doing the right thing wrong. They read up on these new-fangled protection methods, then foul up the implementation horribly. –  Polynomial Dec 3 '12 at 15:55
1  
@AviD - I am making fun of the so called "security question" and "verification image" these banks use. The only reason we have these systems is because they are required to implement them. The reason they don't implement the RIGHT thing is because they know their customers won't put up with the trouble. The problem is the people that would go to the effort of using an security token/smart-card is not the majority of their customer base so we all suffer. They were required to implement '2 factor' authenication sadly what they implemented is not really helpful. –  Ramhound Dec 3 '12 at 17:31
show 3 more comments

3 Answers

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers.

I would research the security accreditations that the bank has, and the level of certification of its it staff if the information is available. I would also research customer feedback as to how their response to security incidents has been, as it isn't just about standards, but how well it is managed.

share|improve this answer
add comment

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past.

However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure account you should detach it from yourself as much as possible.

You can use a few techniques to separate yourself from this account:

  • Don't carry a cash card for the account (and definately not a contactless one) - It's much more likely your card will be skimmed than your bank will be broken into by a l33t hacker
  • Opt out of paper statements - Can't forget to shred what you don't have
  • Route pay slips and bills to another account and pass through funds with direct debit - This way the accounts that hold most of your funds will not appear on other systems or on related paper work.
share|improve this answer
    
Insurance. It seems common sense to me, but this is the only answer which mentions it. Federal deposit insurance systems also have limits, so if you have a lot of savings, be careful. I'd like to add "diversify", get accounts at very different banks. Insurance takes time to kick in and you need to pay your rent. I keep my chequing with one bank, my savings at another and my stocks in a third. –  mgjk Dec 3 '12 at 18:36
add comment

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever.

Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =)

Having worked for a large bank doing IT Security, I am biased, so I will not suggest a particular bank. However, I don't feel like the size of a company's IT Security groups are honestly and widely announced. I know that the banks with which I am familiar didn't announce their group sizes, and grossly over-embellished their available skill sets. I had to become intimately familiar with their organizations and have a relationship with an employee before having unfettered information about their security posture.

There are some banks which have truly good security. They are the big banks, period. Little banks may try but there are two issues. First, they don't have the money or the skill to implement security well. Second, if they have better rates than a bigger bank, it is because they are slimming their margins to unreasonable and unsustainable profits, and therefore skimping on things like security.

share|improve this answer
1  
Here is a recent example of a small-but-not-that-small bank getting breached. rrstar.com/blogs/alexgary/x1156349536/… –  Steel City Hacker Dec 5 '12 at 15:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.