I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is meant for people who wish to access their account themselves, but are unable to do so otherwise.
I have never used that computer and remain highly skeptical about this.
My question does not involve the possibility of others capturing the keystrokes by watching or a camera facing the keyboard or the screen, as that doesn't seem to be the case in this particular setting.
Instead, I would like to ask: What measures can the bank take to ensure that no user installs spyware to track other users? Again, the camera can't really see what the user is doing exactly, and the employees are most likely too busy to pay attention.
I have no knowledge of what the system actually looks like, as I have never used that workstation. I don't know whether there is a regular operating system installed with a browser that can access only the bank's website, or, perhaps, rather a software application dedicated for the task, with the access to any other OS features being locked.
One thing that came to my mind was having a snapshot that could be rolled back at any time (ideally, each time a user would be finished with their work). Is that how it is done?
Do they employ simple forensics to make sure that the integrity of the system has not been tampered with?
If neither of the above is likely, what else could be done?
And finally, the most scary question: Do the banks even care?
Please note that my expectations toward possible answers either assume that the practice is more common in worldwide banking, or simply arise out of my interest in how it should be done properly (if that's possible at all).