I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced.
The whole e-bill solution is provided by a third party (let's call it "Partner"). Its user-interface opens within a scrollable area of the e-banking portal.
Once I log in to the e-banking portal through my Banks website (on a private browser window), automatically I have access also to the interface of Partner, as such interface is part of the e-banking portal.
The workflow for paying a bill looks as follows:
- Partner signals me the presence of an e-bill in a distinct notification area of the e-banking portal.
- I open Partners interface, and approve the bill to be paid on date X.
- The approved bill will display in Partners interface, but not in Banks interface. From Banks point of view, the bill doesn't exist (yet).
- On day X, Partner will charge the bill to my account. From that point on, the bill will display on searches within Banks interface.
From a security point of view, such workflow leaves me perplex, for the following reasons:
- When I log in / log out on the server of Bank, automatically I am logged in / logged out also on the server of Partner.
- Partner can charge my account even when I am not logged in. Bank doesn't have any trace of which bills I have approved and which bills I haven't approved. Partner basically has the possibility to charge any amount to my account for whatever reason.
- All my interaction with the services are happening within a web application. This web-application needs to be connected to my Banks server as well as to Partner's server, since my Bank actually doesn't know which my interactions with Partner are. In such interactions, there are at least four components: a) Bank's front-end, b) Bank's back-end, c) Partner's front-end, d) Partner's back end (while c is integrated into a from a user-perspective). Such situation seems rather complex to me and hard to control from a security point of view.
(As a side note: while I "trust" my Bank, I don't necesarily trust Partner. Moreover, when I opened my e-banking access, I entered a written contract with my Bank. I do not have any written agrrement with Partner, I just had to "Accept the Terms" before getting access to the e-billing.)
EDIT 1: The access Partner has is much different than for example the one a credit card company has. My credit card company might be able to charge my account once per month, or send me a bill which I then approve. Through Partner instead, I might be receiving e-bills from dozens of companies (phone company, internet provider, tax office ...), so Partner will charge my account several times per month. I therefore need to check the charged amounts twice: the first time when I approve the bills, the second time when they are effectively charged to my account.
Here are my main questions:
- Can the described user-interface and workflow actually be implemented in a secure way?
- Doesn't the presence of a third-party massively increase the risk of fraud?
While it is evident that I can at any time contest a (fraudulent) transaction, I actually want to avoid situations in which such transactions can happen. I am asking these questions from a user-perspective. I am not a Security specialist, but rather a IT security enthusiast.
EDIT 2: At the same time, the focus of my question is not so much if I trust Partner, but if really at the basis the integration of a third-party application into an e-banking portal can safely be implemented, and if it doesn't inherently mean there's a much bigger attack surface for fraudulent third parties. It's not so much about "am I safe as a user", but much more about "can this be considered best practice? Is this a safe way to manage things?" This brings me to a third (partial) question:
- Given that Partner is running an application which is completely distinct from the Banks application, shouldn't Partner have a distinct login mechanism? Is this a "user-friendliness vs. security" tradeoff, or can the whole mechanism be "safely" (= as "safe" as e-banking can be) managed?