The HSBC UK online banking website has a strangely convoluted login system that I haven't seen anywhere else before, and which I'm concerned is ineffectual and compromises security. It works like this:

  1. I enter my username, then forwarded to a new page for the next steps.
  2. I am asked a "memorable question", and enter my "memorable answer" in full.
  3. I am asked for three characters from specific positions in my password. As far as I can tell, they are always the same three positions.

I am used to Australian banks just asking me for my username and password, potentially with an SMS authentication step.

Here's a screenshot of the page in which steps 2 and 3 are carried out:

"answer your memorable question; enter the 1st, 2nd and 5th characters of your password."

Is there any advantage at all to doing this, or is this poor security compared to just asking for my password in full? I am concerned that not only is this needlessly complex, it is actually worse security than just asking for my password outright, because a potentially quite long and complex password is effectively reduced to a 3-character password.

As far as I'm concerned right now, my "memorable answer" has taken on the traditional password role, and my "password" is just an extra three characters I have for some reason.

  • Yeah, it's dumb. Super dumb. I think banks only hire web devs who fail security exams. Oct 12, 2016 at 15:29
  • 2
    Oh too bad. I was going to switch to HSBC but now I'm reconsidering my choice.. Oct 12, 2016 at 15:30
  • Thanks for the dupe suggestion, @Mike. Glad it's not just me thinking badly of it. Oct 12, 2016 at 15:34
  • @Andre I'm reconsidering my choice of HSBC too. ( ͡° ͜ʖ ͡° ) Oct 12, 2016 at 15:35


Browse other questions tagged or ask your own question.