The tag has no wiki summary.

learn more… | top users | synonyms

6
votes
2answers
250 views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
1
vote
3answers
189 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
49 views

What can I do as a user to minimize the risk of online banking?

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as ...
2
votes
3answers
92 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
4
votes
2answers
372 views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
16
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
1
vote
0answers
51 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
6
votes
7answers
4k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
1
vote
1answer
56 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
1
vote
1answer
51 views

What protections are put in place to prevent ACH scams?

ACH (Automated Clearing House) is an electronic network for financial transactions in the United States. ACH is used by financial institutions to handle direct deposits, checks, bill payments ...
3
votes
1answer
115 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
2
votes
2answers
1k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
1
vote
0answers
40 views

Can a victim of identity theft safely open a bank account? [closed]

A friend of mine had his identity stolen (at least including social security number and birthday), and apparently someone used the info to remove money from his current bank account with Citizens ...
5
votes
4answers
800 views

Signature instead of PIN, Visa card

Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the ...
1
vote
1answer
44 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
6
votes
1answer
247 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
11
votes
3answers
801 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
3
votes
2answers
169 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
-1
votes
1answer
83 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
2
votes
1answer
101 views

How secure is online banking with smart card? How could it be hacked?

I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
29
votes
4answers
3k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization ...
53
votes
10answers
16k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
4
votes
2answers
446 views

Why do the banks all use weaker TLS suites? [closed]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
17
votes
3answers
2k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
0
votes
1answer
97 views

Anti Skimmer and Anti fraud? [closed]

Would you please tell me what is the difference between Anti-skimmer and Anti-fraud in ATMs?
6
votes
4answers
1k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
22
votes
5answers
5k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
2
votes
4answers
184 views

safe way to communicate IBAN connection

how do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
44
votes
9answers
6k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
1
vote
1answer
120 views

Good resources on ACH/banking details security?

In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to ...
-2
votes
3answers
197 views

How do I communicate security issues encountered on an online banking platform?

Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
2
votes
2answers
172 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
21
votes
3answers
18k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
9
votes
6answers
1k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
1
vote
3answers
940 views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
0
votes
1answer
97 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
-4
votes
2answers
191 views

Windows XP has many security vulnerabilities, So why many bank using Windows XP until now? [closed]

I know many banks using Windows XP on almost computers for staff working, WinXP has many security vulnerabilities. But rarely seriously problems occured with thier system. Is there good Firewall and ...
6
votes
1answer
254 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
1
vote
1answer
73 views

Home banking site request, it possible for a small web agency?

I'm working in a web agency, i have a request to made an home banking system for a little bank. I'm searching in internet for some information about security and a good pattern to start, but naturally ...
0
votes
1answer
104 views

International bank transfer, what is safe to share?

Okay, so I am selling a smartphone, to the guy who lives in UK, or that is what he says. So for the money transfer he asks me these things. Name Bank Name Account Number Iban Swift Code. Is it ...
-1
votes
1answer
146 views

Potential damage of someone getting your online banking password [closed]

Does anyone have thoughts on the potential damage of your online banking account being hacked? I'm not sure what a person could actually do since I think they could really only pay my bills (adding a ...
8
votes
5answers
14k views

How is Chase Mobile Deposit Secure?

Chase has this app that allows you to snap a picture of a check with your phone and deposit that check into your account. How do they prevent: Someone from depositing a check that's not written to ...
0
votes
1answer
117 views

Banking platform accepts password containing subset of real password [duplicate]

How would it be possible that if my password was 123abc that my bank also accepts something like 123abc12? Isn't that an extreme security flaw? If the password was hashed and salted, wouldn't the ...
0
votes
1answer
509 views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
2
votes
2answers
134 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
0
votes
2answers
204 views

Why do some websites increase the number of characters in the password field when logging in?

Why do some websites (especially banking sites) display more characters in the password field than were actually typed? This is sometimes apparent just after clicking the login button.
0
votes
2answers
908 views

Bank Fraud Deposit

My daughter just discovered yesterday that a wire transfer of $12K had been made to her checking acct. at Chase. It said it came from a Wells Fargo in NY in the name of some name she didn't ...
2
votes
5answers
314 views

Is accepting old passwords a bad policy?

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a ...
4
votes
2answers
524 views

Online banking proof of transaction for vertification in court

So, when i do an online payment transaction i "sign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction. But ...
6
votes
4answers
543 views

Banking application login leaks information

My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows: User visits the homepage of the bank. User ...