Questions tagged [banks]
Use for questions about security practices used by banks and other financial institutions.
220
questions
1
vote
0
answers
80
views
What is the value of no paste text boxes for bank web sites?
HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
- 111
0
votes
0
answers
49
views
Is using a second hand/grey market phone for banking security a credible risk?
I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced.
It seems to me ...
- 111
3
votes
2
answers
217
views
Should bank details such as bank bic code, bank swift code, bank cc, bank code be considered as personal data and does it need to be encrypted?
I wanted to understand what elements of financial information need to be protected/encrypted. Understand that information like IBAN, bank account name, bank account number are personal data and need ...
- 31
3
votes
0
answers
280
views
Why are animated QR-codes more secure?
I recently had a look at implementing the swedish BankID identification system for an app.
A prerequisite is that a client certificate is installed on our backend, which authenticates requests from ...
- 213
0
votes
0
answers
348
views
Security: Plaid vs Quicken vs Mint
Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
- 1
1
vote
2
answers
156
views
Is it normal/safe/justifiable that a bank asks me for my full login details (account id and PIN) when calling via mobile phone?
I am calling my bank via mobile phone (in Germany) and the electronic voice asks me to
type in my account access id (via the number pad), and like-wise,
type in my account PIN, all the numbers, not ...
- 111
-1
votes
1
answer
155
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
1
vote
1
answer
142
views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
- 11
0
votes
1
answer
87
views
Visa Secure / TAN App showing wrong amount charged [closed]
So, the other day I was charging my prepaid VoIP account from sipgate.de via credit card payment. I chose 10 Eur which is the default and entered my card details.
As usual, I was redirected to a ...
- 139
1
vote
1
answer
310
views
Why does the PSD2 have an exception that requires two-factor authentication only every 90 days?
PSD2 requires two-factor authentication, which they call strong customer authentication (SCA). However, there is a “delegated regulation” 2018/389, Article 10, which adds an exception that SCA is not ...
- 113
146
votes
1
answer
18k
views
How does Shutterstock keep getting my latest debit card number?
I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since.
Silently in 2018, they activated ...
- 1,907
-2
votes
1
answer
187
views
Why is Western Union so popular among scammers? [closed]
I've heard/read about a number of scams around the internet, and most of the time, the scammer tells the victim to transfer money using Western Union. I might be biased due to my sources, but Western ...
- 3,442
2
votes
1
answer
141
views
Over-the-top (?) security practices for CVV inputs
On some internet banking websites, I've seen some CVV input fields that seem strange to me. Here is an example:
The field works as such:
You can not input a CVV code using a keyboard.
The numbers ...
- 23
0
votes
1
answer
128
views
Is there a standard about storing the password of a bank's website bank-account-management-account in a password vault?
Please assume that I use some FOSS, SaaS, public key && passwordized private key protected password vault program to primarily store passwords of websites I rarely use (such as Q&A ...
- 1
1
vote
0
answers
93
views
Is it reasonable to type a bank password in a phone call to the bank? [duplicate]
Recently my friend called their bank (via a normal phone call) to perform an operation with her account and she had to type her password during the call. Everything worked fine, the operation was done ...
- 131
1
vote
1
answer
281
views
Is this "secure email" mechanism my bank wants me to use best practice?
So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the ...
3
votes
2
answers
188
views
Can a third-party service within an e-banking portal actually be safe?
I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced.
The whole e-...
- 133
0
votes
1
answer
148
views
How can hackers steal from a savings account that has no client card? [closed]
Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used ...
- 103
38
votes
8
answers
8k
views
Why does my digital bank need my phone date and hour to be correct?
I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"?
For ...
- 493
0
votes
0
answers
99
views
Dedicated device for online investing and other security measures
I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
1
answer
209
views
Online transactions: which one is safer - credit card or netbanking? [closed]
There are various modes of online transaction, such as through entering credit card details, and through netbanking. Which one is safer? it seems there are some risks with credit card mode mode but is ...
- 135
1
vote
1
answer
160
views
What can be done with Credit or debit card informations asked by websites?
Many websites ask for payment by entering information from Credit card such as VISA card/ Mastercard etc.
Now, till date I knew that I should never tell anybody about these numbers. Then why these ...
- 135
3
votes
1
answer
227
views
Security of bank account using a 8 digit password
Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager.
The new password had to be exactly 8 digits, to be ...
- 133
1
vote
1
answer
530
views
What are security issues about sending bank alerts via email/SMS?
Banks offer to send alerts for each transaction happening on a customers account. My bank is offering three options: SMS alerts, email alerts and push alerts into their own app. Only sms alerts are ...
- 13
0
votes
1
answer
526
views
Is Gnucash's flatpak safe to use with online banking?
Can I trust the (official?) GnuCash Flatpak on Flathub, linked from here to here?
Following up on this Q&A I'm asking myself if I can trust this, bearing in mind this.
Other options would be to ...
5
votes
4
answers
496
views
Are payment card PINs safe to send via SMS?
I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards ...
- 811
0
votes
0
answers
42
views
Can anything be stolen from me using bank Information? [duplicate]
I live on a Caribbean island and i am selling my pick up truck. Someone has contacted me saying they want to buy it and ship to the US.They have asked for all my bank info, IBAN, Swift Code, Acc.#, ...
- 1
1
vote
1
answer
124
views
Cardholder info transmission between issuing and acquiring banks
Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction?
Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
8
votes
1
answer
7k
views
Western Union prompts for bank login information — ridiculously bad practice? [duplicate]
I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information.
The ...
- 647
0
votes
1
answer
2k
views
Is it possible to bypass 2FA and access bank account in this system?
Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
- 175
42
votes
3
answers
7k
views
Why are my plastic credit card and activation code sent separately?
Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate?
If a rogue element has access to my mail box ...
- 559
1
vote
1
answer
712
views
Why don't online banks use WebAuthn? [closed]
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
- 369
3
votes
1
answer
1k
views
How does the photoTAN (Cronto visual transaction signing) procedure work?
Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching ...
- 141
1
vote
1
answer
132
views
Is it safe to give multiple virtual credit card numbers to the same vendor?
There are situations when I have to give several virtual credit card numbers linked to my real credit card to the same vendor. Can a vendor guess the real credit card number by having multiple virtual ...
- 29
1
vote
4
answers
419
views
Collecting banking, credit-card statements from users
I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
- 2,149
1
vote
1
answer
241
views
Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person
Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:
The answer to a security question. This had to be entered in full and was the ...
- 11
3
votes
3
answers
513
views
Making transactions only, or almost only, by QR codes
I have a OnePlus 6 smartphone and I recently opened a bank account in a bank which seems to me very innovative in the context going payment card (debit/credit) free (using only application and/or cash)...
user123574
0
votes
2
answers
313
views
How secure is Libra considering Visa and Mastercard are behind it?
Libra is the upcoming cryptocurrency by Facebook which Facebook claims is supported by variety of tech companies including but not limited to Mastercard, Paypal and Visa.
Facebook also enforces a real ...
- 89
21
votes
7
answers
8k
views
Unexpected email from Yorkshire Bank
I have started receiving unexpected emails from Yorkshire Bank.
I have never been a customer. I don't recall applying for any of their products either, although maybe I did many years ago.
The ...
- 343
0
votes
1
answer
208
views
Online payment integration requires handling my bank credentials. Why?
When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website?
The context of my ...
- 105
1
vote
1
answer
338
views
Is the zero trust approach really so safe? [closed]
Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
- 1,204
0
votes
1
answer
130
views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
- 3
2
votes
0
answers
123
views
Are printed check security features a gimmick?
This question is perhaps a rough fit for this SE site, but it is about information security, though not specifically about computers.
When ordering company checks, there are a plethora of options. ...
- 297
1
vote
2
answers
127
views
Where would I go to use a reliably secure encrypted internet connection?
Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
- 33
0
votes
0
answers
349
views
Is there a security issue with fit4less requiring bank information and not simply card number?
When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc.
For example spotify goes through my credit card. ...
- 101
9
votes
2
answers
12k
views
Is Plaid safe if I change the password after deposit?
Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand that Plaid stores my login and password, somewhere... somehow... who really knows. A lot of people ...
- 191
1
vote
4
answers
816
views
Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?
Bruce Schneier Writes Down Passwords. So Can You
...
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
- 609
1
vote
1
answer
3k
views
Norms and Compliance for storing bank account details
I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.
However, I was wondering if there are some ...
- 11
-2
votes
1
answer
159
views
Unauthorised transfers to developer's account in bank transaction software [closed]
Our organization has software for transactions. The person who designed this software illegally designed it in such a way that when any transaction is performed 0.5 percent of the transaction goes ...
189
votes
4
answers
202k
views
Is Plaid, a service which collects user’s banking login information, safe to use?
I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
- 2,469