My bank has an online password security policy which seems to me 100% wrong at all levels. Since it is one of the biggest banks in my country, I'm giving it the benefit of the doubt, and consider the possibility that I'm not seeing the full picture...
The way I access the online portal is using my ID card number (issued by my country) as username, and the same PIN from my main credit card as password. This seems wrong for several reasons:
- The password I use for accesing online banking features is a 4-digit PIN.
- I cannot easily change my online banking password, I have to go to an ATM and change my PIN.
- If I happen to lose my credit card, which is bad enough, also my online banknig features would be compromised.
- Even though some of the most "risky" features require an aditional so-called "digital-firm" which is chosen by me, this digital-firm must be an 8-digit PIN.
Is this bad enough as it seems (like get out of that bank bad enough)? Could they be using any security policies which I cannot see to mitigate possible attacks? Are these kind of bad policies common whithin big banking firms?