Use for questions about security practices used by banks and other financial institutions.

learn more… | top users | synonyms

4
votes
2answers
53 views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT some questions arise: Are software components of SWIFT ...
2
votes
1answer
66 views

Router as MITM to steal data

I was reading a blog post about ATM skimming and the following quote (at the end of the article) caught my eye: Ivanov allegedly used two devices — a router to steal the bank data of customers ...
13
votes
1answer
334 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
4
votes
1answer
195 views

PayPal is asking for my Bank Details. How secure is this? [closed]

I am from the UK but I'm living in Poland. I have two British bank accounts and a Polish account. The two British accounts are linked to a PayPal account registered from the UK and the Polish one is ...
1
vote
2answers
72 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
29
votes
3answers
29k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
2
votes
0answers
35 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
6
votes
4answers
237 views

If most ATMs are Windows XP, and Windows XP is no longer updated…?

...how do banks keep their ATMs safe? Have a handful of companies sprouted after XP's end of cycle offering patches?
1
vote
1answer
18 views

How are sites like PersonalCapital safe/trustworthy?

Sites like PersonalCapital require you submit your account login details for every one of your banking account providers. Could personal capital potentially log into your financial accounts and make ...
5
votes
2answers
1k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
2answers
142 views

Money stolen via Android malware Port 4000 remote anything exploit

As background, my business bank account was compromised. The compromise also involved call forwarding of a smartphone. So they got bank credentials and cell phone credentials. I initially suspected ...
0
votes
5answers
314 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
0
votes
1answer
103 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
4
votes
2answers
113 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
29
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
19
votes
3answers
3k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
2
votes
1answer
190 views

What to do in case of a weak certificate on my bank's website?

My bank's website, while always having had a 'green lock' in the address bar doesn't have this anymore. I then called the bank with a phone number I found on the same website, and asked that the ...
0
votes
1answer
52 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
0
votes
0answers
52 views

stream cipher & e-banking

As I read on internet, I ran into these two question. Yet, I thought about it but still don’t know how to tackle it. May I have your help? (a) During an e-banking transfer the bank uses a stream ...
13
votes
2answers
390 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
39
votes
3answers
5k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
3
votes
5answers
589 views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
8
votes
1answer
153 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
63
votes
10answers
24k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
2
votes
1answer
106 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
7
votes
4answers
3k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
8
votes
2answers
234 views

not allowing pasting of bank account number

One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number. Therefor, every month I am forced to ...
2
votes
0answers
58 views

Do inter-bank transactions guarantee that the amount of money is preserved? How?

I recently transfered money between two of my bank accounts in the same bank, using the e-banking interface, and, once I approved the transfer the website announced having "successfully transfered ...
2
votes
2answers
135 views

ATM skimming with magnetic stripe

I have a question about ATM skimming. If ATMs in the UK still accept magnetic stripe can't a thief still use a cloned card at the ATM to withdraw money?
4
votes
1answer
202 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
4
votes
2answers
2k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
7
votes
7answers
14k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
3
votes
1answer
93 views

Do card issuers give merchants new expiry dates for recurring payments? [closed]

Recently I got an email from, let's say, “Company X” saying: some banks provide updated expiration dates for automatically renewing subscriptions I find it really hard to imagine that my bank ...
4
votes
4answers
400 views

Safe way to communicate IBAN connection

How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
19
votes
3answers
2k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
1
vote
1answer
137 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
7
votes
1answer
114 views

In the Netherlands, is there danger in my name and bank account number being public?

I know of the question Bank account number and account holder in check exposed? , but the answers to it are quite US-specific (checks and such) and I live in the Netherlands. Dutch banks are ...
3
votes
3answers
1k views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
2
votes
2answers
556 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
3
votes
3answers
269 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
7
votes
2answers
1k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
5
votes
3answers
311 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
242 views

What can I do as a user to minimize the risk of online banking?

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as ...
2
votes
3answers
544 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
5
votes
2answers
1k views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
1
vote
0answers
107 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
3
votes
1answer
302 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
2
votes
1answer
172 views

What protections are put in place to prevent ACH scams?

ACH (Automated Clearing House) is an electronic network for financial transactions in the United States. ACH is used by financial institutions to handle direct deposits, checks, bill payments ...
4
votes
1answer
224 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
5
votes
4answers
2k views

Signature instead of PIN, Visa card

Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the ...