My Bank's Online Banking feature doesn't use usernames. Instead, they assigned me a digit-only account number*. To log in, I enter my number, then it brings me to a new page to prompt for my password. However on the password page there is an image that I selected from a list of hundreds of images, as well as a caption, presumably in the event that you fat-finger your number. (for example: [picture of a rock] 'A cool lookin rock')
Is there any value gained in using this method of security? Is there a particular feature of this method that could be changed/dropped to enhance security? Should I be writing my bank an email?
- I've tested with a few random numbers (and characters), they result in a password prompting page with one of the images and a generic caption
- The picture captions share a similar format: they're always in lowercase and describe the image
- There doesn't appear to be any form of Captcha on either the login or password page.
*Note: Not the same as my bank account number (I would have ran).