Questions tagged [banks]
Use for questions about security practices used by banks and other financial institutions.
204
questions
0
votes
1answer
75 views
How can hackers steal from a savings account that has no client card? [closed]
Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used ...
38
votes
8answers
7k views
Why does my digital bank need my phone date and hour to be correct?
I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"?
For ...
0
votes
0answers
42 views
Dedicated device for online investing and other security measures
I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
1answer
66 views
Online transactions: which one is safer - credit card or netbanking? [closed]
There are various modes of online transaction, such as through entering credit card details, and through netbanking. Which one is safer? it seems there are some risks with credit card mode mode but is ...
1
vote
1answer
81 views
What can be done with Credit or debit card informations asked by websites?
Many websites ask for payment by entering information from Credit card such as VISA card/ Mastercard etc.
Now, till date I knew that I should never tell anybody about these numbers. Then why these ...
3
votes
1answer
95 views
Security of bank account using a 8 digit password
Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager.
The new password had to be exactly 8 digits, to be ...
1
vote
1answer
137 views
What are security issues about sending bank alerts via email/SMS?
Banks offer to send alerts for each transaction happening on a customers account. My bank is offering three options: SMS alerts, email alerts and push alerts into their own app. Only sms alerts are ...
0
votes
1answer
91 views
Is Gnucash's flatpak safe to use with online banking?
Can I trust the (official?) GnuCash Flatpak on Flathub, linked from here to here?
Following up on this Q&A I'm asking myself if I can trust this, bearing in mind this.
Other options would be to ...
3
votes
2answers
131 views
Are payment card PINs safe to send via SMS?
I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards ...
0
votes
0answers
31 views
Can anything be stolen from me using bank Information? [duplicate]
I live on a Caribbean island and i am selling my pick up truck. Someone has contacted me saying they want to buy it and ship to the US.They have asked for all my bank info, IBAN, Swift Code, Acc.#, ...
1
vote
1answer
79 views
Cardholder info transmission between issuing and acquiring banks
Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction?
Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
7
votes
1answer
2k views
Western Union prompts for bank login information — ridiculously bad practice? [duplicate]
I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information.
The ...
0
votes
1answer
582 views
Is it possible to bypass 2FA and access bank account in this system?
Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
42
votes
3answers
7k views
Why are my plastic credit card and activation code sent separately?
Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate?
If a rogue element has access to my mail box ...
0
votes
1answer
331 views
Why don't online banks use WebAuthn? [closed]
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
1
vote
0answers
70 views
How are institutions physically connected to SWIFTNet?
There is a lot of information to be found about SWIFT and the protocols that are being used by its members to exchange messages. However, I could not find much information about how banks and ...
3
votes
0answers
443 views
How does the photoTAN procedure work?
Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching ...
1
vote
1answer
89 views
Is it safe to give multiple virtual credit card numbers to the same vendor?
There are situations when I have to give several virtual credit card numbers linked to my real credit card to the same vendor. Can a vendor guess the real credit card number by having multiple virtual ...
1
vote
4answers
262 views
Collecting banking, credit-card statements from users
I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
1
vote
1answer
90 views
Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person
Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:
The answer to a security question. This had to be entered in full and was the ...
3
votes
3answers
463 views
Making transactions only, or almost only, by QR codes
I have a OnePlus 6 smartphone and I recently opened a bank account in a bank which seems to me very innovative in the context going payment card (debit/credit) free (using only application and/or cash)...
0
votes
2answers
265 views
How secure is Libra considering Visa and Mastercard are behind it?
Libra is the upcoming cryptocurrency by Facebook which Facebook claims is supported by variety of tech companies including but not limited to Mastercard, Paypal and Visa.
Facebook also enforces a real ...
21
votes
7answers
8k views
Unexpected email from Yorkshire Bank
I have started receiving unexpected emails from Yorkshire Bank.
I have never been a customer. I don't recall applying for any of their products either, although maybe I did many years ago.
The ...
0
votes
1answer
110 views
Online payment integration requires handling my bank credentials. Why?
When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website?
The context of my ...
1
vote
1answer
189 views
Is the zero trust approach really so safe? [closed]
Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
0
votes
1answer
89 views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
1
vote
0answers
81 views
Are printed check security features a gimmick?
This question is perhaps a rough fit for this SE site, but it is about information security, though not specifically about computers.
When ordering company checks, there are a plethora of options. ...
1
vote
2answers
84 views
Where would I go to use a reliably secure encrypted internet connection?
Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
0
votes
0answers
136 views
Is there a security issue with fit4less requiring bank information and not simply card number?
When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc.
For example spotify goes through my credit card. ...
4
votes
1answer
2k views
Is Plaid safe if I change the password after deposit?
Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand that Plaid stores my login and password, somewhere... somehow... who really knows. A lot of people ...
1
vote
4answers
491 views
Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?
Bruce Schneier Writes Down Passwords. So Can You
...
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
1
vote
1answer
1k views
Norms and Compliance for storing bank account details
I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.
However, I was wondering if there are some ...
-2
votes
1answer
119 views
Unauthorised transfers to developer's account in bank transaction software [closed]
Our organization has software for transactions. The person who designed this software illegally designed it in such a way that when any transaction is performed 0.5 percent of the transaction goes ...
51
votes
3answers
48k views
Is Plaid, a service which collects user’s banking login information, safe to use?
I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
0answers
59 views
How does using an app rather than code card to authenticate improve security?
Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know:
Our bank account number (we have that written down)
A password we've picked. We ...
1
vote
2answers
291 views
How should we mitigate threats that are keep coming to our security monitoring system?
We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
-1
votes
1answer
289 views
Which encryption methods are used in online banking?
How does the connection get established in online banking?
Just with SSL?
I searched the internet for that, but there are just 'user guides' if you want to use online banking but not how it works on ...
1
vote
1answer
151 views
Deutsche Bank PhotoTan app signed with self-signed certificate?
Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this:
# ...
11
votes
4answers
2k views
Why should we prevent users from saving their passwords in their password manager?
I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.
I noticed ...
1
vote
0answers
45 views
What are the most important security controls to implement when deploying BYOD in an organization? [closed]
In organizations like banks that have already many security controls. Will implementing BYOD (our organization employees will be able to use their own computers to access the organization when they ...
0
votes
1answer
200 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
-3
votes
2answers
533 views
End to end encryption in mobile banking? [closed]
Can we use E2EE to secure the communication between the bank and it's customers in the applications of mobile banking? And what is the status off E2EE vs SSH regarding this matter?
11
votes
3answers
435 views
How to calculate our application security debt?
Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
29
votes
4answers
6k views
How should I verify a caller is from the bank or company they claim? [duplicate]
I often get telephone calls from my personal bank, mortgage provider or utility companies.
In most cases they start by asking me to verify my identity through the usual name/address/date of birth or ...
-1
votes
2answers
136 views
Ad fraud is growing into one of the biggest concerns. How can it affect banks?
The attached image was presented to me, but I'm confused about the risks of ad-fraud to organizations like banks. Usually, the advertisement budgets are invested only in "trusted" sources like Google ...
1
vote
1answer
79 views
Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS
Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
7
votes
1answer
322 views
Why would a banking app require access to browsing history and information about apps running on the device?
I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device.
Why would a banking app ...
0
votes
1answer
356 views
Pinhole communication with air gapped network
A long time ago ago I worked for a small bank. We used a physically separated network to host our internal servers that handled all the transactions, as well as the workstations accessing the system.
...
1
vote
1answer
268 views
Can a website use my debit card details for further transaction? [closed]
I bought a bracelet from Buzz Bargain(Sorry for advertisement) and it deducts 2.99 from my account and then they send me an email saying that we will deduct 49.9 USD after a month for a subscription ...
1
vote
2answers
493 views
Linking to a bank account: login credentials vs. routing information
Venmo wants the login credentials to my bank to link to my bank account. Giving my bank password to another party feels very wrong and is not something I am inclined to do.
However, after thinking ...
