Use for questions about security practices used by banks and other financial institutions.

learn more… | top users | synonyms

25
votes
8answers
2k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
1
vote
1answer
41 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
5
votes
2answers
177 views
+50

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
2
votes
1answer
69 views

Router as MITM to steal data

I was reading a blog post about ATM skimming and the following quote (at the end of the article) caught my eye: Ivanov allegedly used two devices — a router to steal the bank data of customers ...
13
votes
1answer
342 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
5
votes
1answer
213 views

PayPal is asking for my Bank Details. How secure is this? [closed]

I am from the UK but I'm living in Poland. I have two British bank accounts and a Polish account. The two British accounts are linked to a PayPal account registered from the UK and the Polish one is ...
1
vote
2answers
74 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
2
votes
0answers
35 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
6
votes
4answers
238 views

If most ATMs are Windows XP, and Windows XP is no longer updated…?

...how do banks keep their ATMs safe? Have a handful of companies sprouted after XP's end of cycle offering patches?
1
vote
1answer
19 views

How are sites like PersonalCapital safe/trustworthy?

Sites like PersonalCapital require you submit your account login details for every one of your banking account providers. Could personal capital potentially log into your financial accounts and make ...
1
vote
2answers
149 views

Money stolen via Android malware Port 4000 remote anything exploit

As background, my business bank account was compromised. The compromise also involved call forwarding of a smartphone. So they got bank credentials and cell phone credentials. I initially suspected ...
0
votes
1answer
128 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
4
votes
2answers
114 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
29
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
0
votes
0answers
52 views

stream cipher & e-banking

As I read on internet, I ran into these two question. Yet, I thought about it but still don’t know how to tackle it. May I have your help? (a) During an e-banking transfer the bank uses a stream ...
0
votes
1answer
54 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
39
votes
3answers
5k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
3
votes
5answers
600 views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
0
votes
5answers
329 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
2
votes
1answer
106 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
8
votes
2answers
237 views

not allowing pasting of bank account number

One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number. Therefor, every month I am forced to ...
2
votes
0answers
58 views

Do inter-bank transactions guarantee that the amount of money is preserved? How?

I recently transfered money between two of my bank accounts in the same bank, using the e-banking interface, and, once I approved the transfer the website announced having "successfully transfered ...
13
votes
2answers
393 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
4
votes
1answer
207 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
8
votes
1answer
155 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
2
votes
2answers
135 views

ATM skimming with magnetic stripe

I have a question about ATM skimming. If ATMs in the UK still accept magnetic stripe can't a thief still use a cloned card at the ATM to withdraw money?
2
votes
1answer
191 views

What to do in case of a weak certificate on my bank's website?

My bank's website, while always having had a 'green lock' in the address bar doesn't have this anymore. I then called the bank with a phone number I found on the same website, and asked that the ...
3
votes
1answer
93 views

Do card issuers give merchants new expiry dates for recurring payments? [closed]

Recently I got an email from, let's say, “Company X” saying: some banks provide updated expiration dates for automatically renewing subscriptions I find it really hard to imagine that my bank ...
1
vote
1answer
138 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
3
votes
3answers
1k views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
2
votes
2answers
558 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
3
votes
3answers
269 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
7
votes
1answer
114 views

In the Netherlands, is there danger in my name and bank account number being public?

I know of the question Bank account number and account holder in check exposed? , but the answers to it are quite US-specific (checks and such) and I live in the Netherlands. Dutch banks are ...
5
votes
3answers
312 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
250 views

What can I do as a user to minimize the risk of online banking?

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as ...
2
votes
3answers
555 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
1
vote
0answers
107 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
19
votes
3answers
3k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
3
votes
1answer
306 views

Why do websites ask for the last four digits of your social security number?

Quite a few websites, Coinbase and Stripe most notably, ask for the last four digits of your social security number to 'verify your identity'. Assuming these websites are not trying to fraud you, how ...
2
votes
1answer
174 views

What protections are put in place to prevent ACH scams?

ACH (Automated Clearing House) is an electronic network for financial transactions in the United States. ACH is used by financial institutions to handle direct deposits, checks, bill payments ...
4
votes
1answer
225 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
1
vote
1answer
70 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
9
votes
1answer
552 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
14
votes
3answers
5k views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
5
votes
2answers
1k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
-1
votes
1answer
256 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
1
vote
1answer
127 views

How secure is online banking with smart card? How could it be hacked?

I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
7
votes
2answers
1k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
30
votes
4answers
7k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization ...
63
votes
10answers
24k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...