Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anyone have thoughts on the potential damage of your online banking account being hacked? I'm not sure what a person could actually do since I think they could really only pay my bills (adding a new payee would require additional security information to set up). They might be able to see my account number I suppose since they could look at scanned checks, but even that doesn't seem like a large risk.

The reason I ask is that I am weighing the risks of signing up to things like Mint and Level.

Thanks!

edit: From what I understand, when a new payee has been added to the account, I have to enter my debit card number. I also have two-factor authorization turned on, but for this question I would like to consider the case if I did not have it turned on (which I imagine resembles most users).

I'm going to see if I can clarify my question further. I'm curious to know what are the possible devious things a stranger could do if they had access to my bank account.

share|improve this question

closed as unclear what you're asking by TildalWave, Xander, tylerl, Adnan, Lucas Kauffman Jan 27 at 19:47

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
We need more information about how exactly your bank's online banking system is secured. Online banking systems often use two-factor authentication, but it varies which kind of factors and for what functionality. –  Philipp Jan 27 at 15:23

1 Answer 1

up vote 2 down vote accepted

It will depend on your bank, obviously, as some will require other authentication for actually transferring funds (several use 2FA, seperate data, text message authorisation), but risks I can think of include:

  • Transferring funds, for banks that would allow that
  • Paying bills, then socially engineering refunds elsewhere
  • Collection of information for identity fraud or social engineering attacks ("Hello Mr Blank, I see that your account ending 1234 is overdrawn due a payment to [Actual Direct Debit Here], did you make this transaction, I'll just need to run you through security questions at this point

Don't underestimate the power of the information that your banking password allows access to. Your personal details can be used against you, or to persuade others that an attacker is you. Once someone has the same access as you, all bets are off, and your bank account is empty.

share|improve this answer
    
To restate Owen's answer, just because you can't think of a way to abuse your bank account doesn't mean a thief can't! Why does anyone have a bank account? We put our money in banks so they can help us protect and manage our money. But it's still our money, and we need to work to protect it, too. That includes keeping secret those things that could be used against us, even if we don't understand how they could be. –  John Deters Jan 27 at 17:33
    
With this in mind, is it too risky to trust companies like Mint and Level to handle your bank passwords? –  Clue Face Feb 1 at 4:27
    
I'd say so, yes. I wouldn't do it –  Owen Feb 3 at 12:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.