The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
52 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
3
votes
2answers
69 views
+50

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
27
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
0
votes
0answers
47 views

stream cipher & e-banking

As I read on internet, I ran into these two question. Yet, I thought about it but still don’t know how to tackle it. May I have your help? (a) During an e-banking transfer the bank uses a stream ...
0
votes
1answer
32 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
38
votes
3answers
5k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
3
votes
5answers
345 views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
0
votes
4answers
155 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
2
votes
1answer
98 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
8
votes
2answers
200 views

not allowing pasting of bank account number

One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number. Therefor, every month I am forced to ...
2
votes
0answers
55 views

Do inter-bank transactions guarantee that the amount of money is preserved? How?

I recently transfered money between two of my bank accounts in the same bank, using the e-banking interface, and, once I approved the transfer the website announced having "successfully transfered ...
13
votes
2answers
349 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
4
votes
1answer
140 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
9
votes
1answer
127 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
2
votes
2answers
117 views

ATM skimming with magnetic stripe

I have a question about ATM skimming. If ATMs in the UK still accept magnetic stripe can't a thief still use a cloned card at the ATM to withdraw money?
1
vote
1answer
174 views

What to do in case of a weak certificate on my bank's website?

My bank's website, while always having had a 'green lock' in the address bar doesn't have this anymore. I then called the bank with a phone number I found on the same website, and asked that the ...
3
votes
1answer
82 views

Do card issuers give merchants new expiry dates for recurring payments? [closed]

Recently I got an email from, let's say, “Company X” saying: some banks provide updated expiration dates for automatically renewing subscriptions I find it really hard to imagine that my bank ...
1
vote
1answer
123 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
3
votes
3answers
774 views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
2
votes
2answers
435 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
3
votes
3answers
253 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
7
votes
1answer
107 views

In the Netherlands, is there danger in my name and bank account number being public?

I know of the question Bank account number and account holder in check exposed? , but the answers to it are quite US-specific (checks and such) and I live in the Netherlands. Dutch banks are ...
5
votes
3answers
299 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
179 views

What can I do as a user to minimize the risk of online banking?

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as ...
2
votes
3answers
471 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
1
vote
0answers
97 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
19
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
3
votes
1answer
219 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
2
votes
1answer
132 views

What protections are put in place to prevent ACH scams?

ACH (Automated Clearing House) is an electronic network for financial transactions in the United States. ACH is used by financial institutions to handle direct deposits, checks, bill payments ...
1
vote
0answers
56 views

Can a victim of identity theft safely open a bank account? [closed]

A friend of mine had his identity stolen (at least including social security number and birthday), and apparently someone used the info to remove money from his current bank account with Citizens ...
4
votes
1answer
194 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
1
vote
1answer
63 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
7
votes
1answer
462 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
12
votes
3answers
3k views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
4
votes
2answers
788 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
-1
votes
1answer
217 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
2
votes
1answer
118 views

How secure is online banking with smart card? How could it be hacked?

I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
7
votes
2answers
970 views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
29
votes
4answers
6k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization ...
61
votes
10answers
22k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
5
votes
2answers
621 views

Why do the banks all use weaker TLS suites? [closed]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
6
votes
7answers
11k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
0
votes
1answer
135 views

Anti Skimmer and Anti fraud? [closed]

Would you please tell me what is the difference between Anti-skimmer and Anti-fraud in ATMs?
7
votes
4answers
3k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
23
votes
5answers
7k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
4
votes
4answers
319 views

Safe way to communicate IBAN connection

How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
2
votes
1answer
185 views

Good resources on ACH/banking details security?

In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to ...
47
votes
9answers
6k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
-2
votes
3answers
248 views

How do I communicate security issues encountered on an online banking platform?

Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
2
votes
2answers
215 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...