I just got off the phone with an investment firm where I have an account. About a month ago, they blocked online access to my account due to "malware or a virus" found on my PC or device. Since we had been overseas for most of that month, and according to their logs the time when the "virus or malware" was discovered was roughly 1pm on March 29th (and we were already out of the country), that means that the number of devices we could have logged on with is reduced down to only 4 (two Android phones, an Android table, and an iPad). The time stamp would have been roughly 1am the following day in the country we were visiting, about 1-2 days after we arrived. After talking with the customer service manager for some length of time, there has been no activity in my account, other than payroll deposits as expected, so I don't think anything untoward has occurred.

They refused to grant me access to my account until I'd had my devices / PC "professionally cleaned". I have no idea how they'd be able to know I'd done this, besides I'm a computer professional, and I'm reasonably certain none of my devices are infected with anything. Once I've done this, they will change passwords and usernames, etc. to allow me access to the account.

What I suspect actually happened was me trying unsuccessfully to log onto the account from my tablet (I vaguely remember something like this happening right after we got there, but didn't think much of it). I probably tried too many times and the account got blocked. Since I was trying from an out of the US IP address, this made it suspicious. That's my guess.

My actual question is, is it possible for a given website to be able to detect that the log on attempt is occurring from a device that has a virus or malware on it? I don't believe it's possible for them to sniff my devices, but I figured you guys would know better than me.


It is unlikely, but that also depends on what they might classify as a virus/malware. To answer this, one needs to consider what types of access a website has to a client that is visiting it.

JavaScript can be used to probe a bit about the system:

  • Your coarse location
  • Installed extensions
  • Device info
  • Information about services on your local machine or network (port scanning)

Most of these aren't very likely to provide indication of any malicious software being present. It is more likely that they detected a suspicious login attempt from a device (maybe the device appeared to be in a different location) and somehow assumed one of yours was compromised. Seems a bit overkill.


While you probably hope for a solid „nope“, it’s not not easy.

First off: I think account lock out as you described is what I would suspect as well, yet there might be more to it than you trying to log in from a non-US IP. But more on that below.

Secondly: There are some ways to detect very specific kinds of malware using JavaScript (and much more via Java applets) for example.

Those ways would make it possible to detect some malware; I doubt your bank is using such methods, however.

Albeit an infection might be detectable by a website, I suspect the following:

You connected via a WiFi at your destination, probably. Not only does that probably provide access for more people than you, providers outside the US (the EU, for example) assign different IPs to customers every 24 hours. Now, if someone else - or another customer at another time - has hit a honeypot, the IP would be in databases as compromised (for example, because it partook in a DDoS or sent spam).

If now your log in attempts triggered a check of that IP and your bank has data subscribed from honeypots, they might conclude a infected device.

  • That's a pretty good guess. I connected to a relative's wifi, but they had WPA2 encryption. I haven't heard about them having any related problems but since they're in finance too, they're careful about such things. Could it be a block of IP addresses? They live in a well to do area, and I wouldn't be surprised if they (along with their neighbors, some of whom don't even bother to encrypt their connections) would be targeted. – delliottg Apr 30 '18 at 18:13
  • It might not even be close by and isn’t related to encryption. My guess is: someone else got the address before you and had a infected machine. I think it’s a combination of your logon attempts and a bad reputation of that IP you tried it from. – Tobi Nary Apr 30 '18 at 18:16
  • Ah, that makes sense, they have lots of guests, kids in college, friends of kids in college, etc. Thanks for the insight! – delliottg Apr 30 '18 at 18:19
  • Again: might not even be the WiFi, might be a completely different customer of the same ISP if that ISP happens to use dynamic IP addresses. – Tobi Nary Apr 30 '18 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.