2

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out lands you on the following page:

steam store

steam store

steam store

"Continue" redirects to the banking site and it contains two tokens. On the site itself the BIC and PIN number are required to finalize the transaction. The certificates of both the store and the bank are valid.

What keeps the bank from performing further, malicious transactions with the supplied information? What happens in case of compromise? as performing a transaction in this case does not require a PIN generated by a physical token (anyone can buy as long as they know the BIC, the PIN and there are sufficient funds on that account).

2
  • You could ask if your bank has a pre-paid card in offer, one that can be charged real-time from your account, with usual token security. This way on purchase you pre-load your card (not losing security) and than the maximum amount someone can steal from you is the pre-paid amount, usually 0. That will work not only in case of malicious website, but also any security breach on their side. OTOH, it's a bit less convenient.
    – Torinthiel
    Nov 26, 2015 at 19:21
  • The bank in question does not. I would also have to create an account there I guess only to obtain a card and then transfer some funds onto it.
    – Sebi
    Nov 27, 2015 at 20:08

1 Answer 1

3

I work in the IT system of a banking company, and as such I know a bit about what happens.

Here is the sequence of events, as I understand it, when a payment goes through:

  1. You send the payment information (BIC, PIN, etc.) to the seller's bank;
  2. The seller's bank transmits the payment request to your bank;
  3. Your bank receives the payment request, and decides to authorize the payment;
  4. That authorization goes back up the chain to the seller's bank, and you get the page telling you that your payment was successful;

Now, what happens if someone in the chain initiates a payment without your consent? Fundamentally, it relies on the fact that a payment that was authorized in that way is known as depending on an insecure payment request - and intra-bank agreements stipulate that in that case, any fraud costs must be borne by the beneficiary of the payment.

So:

  1. You will see that you have been charged fraudulently;
  2. Your bank will reimburse you;
  3. The seller's bank will reimburse your bank - in the end, the seller's bank will have gained nothing, except being noted for having allowed a fraudulent payment;

At each step of the way, you see that there is a strong trust relationship - between you and your bank, between your bank and the seller's bank. If these trust relationships are broken, then it could very easily end before a court, with very dire consequences (you leaving your bank and outing it as untrustworthy, the seller's bank being outed as untrustworthy and sued by your bank).

In short: the seller's bank would not do that voluntarily, because that could easily mean the end of its business. And if your bank is trustworthy, you should not end up footing the bill anyway. That is true, whether the seller's bank is untrustworthy or compromised.

Now, I understand it very well if you do not wish to leave such information in the hands of a bank you do not personally trust - in that case, I would suggest asking your bank about it - for example, banks can generate a disposable Credit Card number, valid only for a limited time and amount of money.

Also, there are generally rules that stipulate that such information should not be kept any longer than necessary.

3
  • In step 3, from the beginning, how does my bank know the seller's bank is trusted? I do not see how I would stand a chance in court against a multi billion dollar commercial entity if it comes to that. What if the seller's bank is malicious and steals only a fractional amount of the funds, for example 0.001% regularly. It's difficult to track and can be easily masked through procedures and internal rules. The safest bet would be to make another account at a trusted bank and put only enough funds onto it to cover the product. Then close the account after the transaction, very inconvenient.
    – Sebi
    Nov 27, 2015 at 20:17
  • The seller's bank is trusted by your bank because it has signed contracts, passed audits, etc. before being allowed to be part of the payment network. In particular, the seller's bank has already agreed that it will have to reimburse your bank in the case described here. Nov 27, 2015 at 22:50
  • As for stealing only small amounts of money, that does not change much - you would still have a line in your bank report, that you would have no recollection about - you would ask your bank about it, and your bank would inform you that it was an insecure internet payment - then you would signal to your bank that the payment was fraudulent, and the evil bank would still have to repay your bank, otherwise it would be in breach of its agreements. Nov 27, 2015 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.