I have had an account with a Bank in which my online accounts password was just a simple 8 character all lowercase password with two numbers. By today's standard it would probably take a single computer less than an hour to brute force the account. This bank does not do dual factor or MFA. I was wondering if they are possibly employing another method whereby extra steps are taken to protect my account with such a weak password? If so what are they doing? If nothing I suppose I my account is a ticking timebomb until I update my password and its a crap shoot?


Firstly, you will only get a few attempts to try to log in before the login is locked and you have to phone up to get it re-enabled.

Secondly, though you used only lower case and numbers, that doesn't mean that you couldn't have used more.

Thirdly, they use monitoring programmes that detect unusual activity and block it until it can be verified.

Finally, some level of loss is expected and built into the costs of doing business.

Of course, that doesn't mean to say that you should leave such a weak password in place - you absolutely shouldn't - getting a compromised account sorted could still cost you a lot in time as well as money.

Nor should you do business with a bank that allows such weak practices. Any decent bank would at least have a secondary factor such as forcing you to enter n out of n+++ characters from a secondary passcode. Or maybe an answer to one or more security questions.

  • Security questions are bad. I always opt out of using those – Kolob Canyon Jan 2 '17 at 2:14
  • They are annoying but they do work. Use a tool such as Keepass to automate the answers. A bit fiddly to get right the first time but great if you need to go in and out of your Internet banking any amount. – Julian Knight Jan 2 '17 at 13:00
  • When you say monitoring programs I take it you mean something other than an IDS/IPS type solution? – user53029 Jan 2 '17 at 14:56
  • Their monitoring programs are rather smarter than the kind of IDS/IPS you would use to protect a network and its resources. They typically use machine learning to "understand" what is normal on your account and raise a warning flag when things fall outside that range. That is why it is a good idea to let your bank know if you want to use the account from a different country for example or when buying something unusually expensive. – Julian Knight Jan 2 '17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.