Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough information to allow an attacker to drain an account if they get the monthly statement. Yet, they do need to be updated from time to time.

What can one do to protect against fraudulent attempts?

  • There are published guidlines on what is required when dealing with banking information. I would look to that when dealing with banking information. As a customer the only security controls banks like Bank of America one of the largest banks in the US is being able to log into the account itself.
    – Ramhound
    Aug 29, 2012 at 11:02

2 Answers 2


Certainly, one can ask an extra question that's not normally asked in the regular online banking process. That will provide some measure of protection.

I think the best defense, though, is to ensure that a change of address triggers mailing a notification to the old address. Then delay any mail to the new address for a week. If the change was fraudulent, this gives the user a reasonable opportunity to respond. Automated phone calls to the former phone number of record may also be helpful.

  • 1
    I agree! This answer is spot on. Sending a notification any time the address is changed is a great recommendation. One addition I would suggest: if the system allows multiple addresses (e.g., multiple email addresses), send a notification any time an additional email address is added. Reason: this is one way that hackers who have compromised someeone's account try to retain access (that way, they can see password resets and such).
    – D.W.
    Aug 29, 2012 at 17:37

As the main risk is that a fraudulent user will change the address so to misuse the account, one very effective security control in this case would be requirement for 2 factor authentication - know, have, or am. For example, before completing the address update, you can have the user enter a password / PIN as well as a string of random numbers on an RSA token.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .