Skip to main content

Questions tagged [banks]

Use for questions about security practices used by banks and other financial institutions.

Filter by
Sorted by
Tagged with
0 votes
1 answer
57 views

BankID and QR codes attacked by man-in-the-middle?

There is a general national login ID system used in the Nordics called BankID. Very often a user will go to a website that employs the BankID login and click "login with QR". Having done so ...
Attack68's user avatar
  • 103
0 votes
0 answers
28 views

Why is selecting a code in banking app necessary for MFA? [duplicate]

At my old bank, logging in via a browser required that I open their app on my phone and tap a button to authenticate my login. My new bank is very similar but instead of a single button to click, I ...
user2132672's user avatar
0 votes
0 answers
65 views

Modern security implementation: operation token sent to the bank by secure server

This post is related to this post on Android users stack exchange relating to conceiving of a variety of household situations and files and a post related to what immutable storage is which was ...
Joselin Jocklingson's user avatar
1 vote
1 answer
156 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
1 vote
0 answers
123 views

Are banks significantly reducing security by migrating everyone to mobile banking?

I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
TooTea's user avatar
  • 851
1 vote
0 answers
189 views

Can the IBAN of the initiator of a SEPA direct debit be faked? [closed]

I am living in Germany and when you get a phone call the phone number of the caller on the display can be faked. For example you can get a call from 110 (police phone number) but it's a scam. And that ...
zomega's user avatar
  • 145
2 votes
1 answer
364 views

Why don't bank verification services use OAuth

I'm going off of this answer, but asking a new question since that's quite old. It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
Silvio Mayolo's user avatar
0 votes
0 answers
30 views

Bank employees asked random 2 characters of password during verification! [duplicate]

Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line? They said me that it is verification procedure but I am not sure it ...
Oleksandr Ismailov's user avatar
0 votes
2 answers
712 views

Is reading off a OTP code over the phone standard practice?

I just called a number that I thought was my bank's and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone. Is this ...
Indigenuity's user avatar
  • 1,343
3 votes
1 answer
237 views

How are the bank's "voiceprint" authentication methods secure?

A few years ago, an agent from the bank rang up to say my credit card was compromised. But first they wanted me to confirm who I was. I refused, they were ringing from a private number, they could ...
Rohit Gupta's user avatar
0 votes
1 answer
205 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
GROVER.'s user avatar
  • 101
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
Wulle's user avatar
  • 611
1 vote
0 answers
134 views

What is the value of no paste text boxes for bank web sites?

HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
User65535's user avatar
  • 279
2 votes
0 answers
260 views

Is using a second hand/grey market phone for banking security a credible risk?

I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced. It seems to me ...
User65535's user avatar
  • 279
3 votes
2 answers
2k views

Should bank details such as bank bic code, bank swift code, bank cc, bank code be considered as personal data and does it need to be encrypted?

I wanted to understand what elements of financial information need to be protected/encrypted. Understand that information like IBAN, bank account name, bank account number are personal data and need ...
Sonia Mishra's user avatar
3 votes
0 answers
665 views

Why are animated QR-codes more secure?

I recently had a look at implementing the swedish BankID identification system for an app. A prerequisite is that a client certificate is installed on our backend, which authenticates requests from ...
Magnus's user avatar
  • 253
0 votes
0 answers
725 views

Security: Plaid vs Quicken vs Mint

Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
Shaurya's user avatar
1 vote
2 answers
1k views

Is it normal/safe/justifiable that a bank asks me for my full login details (account id and PIN) when calling via mobile phone?

I am calling my bank via mobile phone (in Germany) and the electronic voice asks me to type in my account access id (via the number pad), and like-wise, type in my account PIN, all the numbers, not ...
M. Rumpy's user avatar
  • 111
-1 votes
1 answer
209 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
I Stand With Israel's user avatar
2 votes
1 answer
234 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
Belf's user avatar
  • 21
0 votes
1 answer
125 views

Visa Secure / TAN App showing wrong amount charged [closed]

So, the other day I was charging my prepaid VoIP account from sipgate.de via credit card payment. I chose 10 Eur which is the default and entered my card details. As usual, I was redirected to a ...
xsrf's user avatar
  • 178
2 votes
1 answer
652 views

Why does the PSD2 have an exception that requires two-factor authentication only every 90 days?

PSD2 requires two-factor authentication, which they call strong customer authentication (SCA). However, there is a “delegated regulation” 2018/389, Article 10, which adds an exception that SCA is not ...
wrtlprnft's user avatar
  • 123
145 votes
1 answer
18k views

How does Shutterstock keep getting my latest debit card number?

I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since. Silently in 2018, they activated ...
M -'s user avatar
  • 1,947
-2 votes
1 answer
289 views

Why is Western Union so popular among scammers? [closed]

I've heard/read about a number of scams around the internet, and most of the time, the scammer tells the victim to transfer money using Western Union. I might be biased due to my sources, but Western ...
ChocolateOverflow's user avatar
2 votes
1 answer
232 views

Over-the-top (?) security practices for CVV inputs

On some internet banking websites, I've seen some CVV input fields that seem strange to me. Here is an example: The field works as such: You can not input a CVV code using a keyboard. The numbers ...
user avatar
0 votes
1 answer
291 views

Is there a standard about storing the password of a bank's website bank-account-management-account in a password vault?

Please assume that I use some FOSS, SaaS, public key && passwordized private key protected password vault program to primarily store passwords of websites I rarely use (such as Q&A ...
yolorolo's user avatar
1 vote
0 answers
272 views

Is it reasonable to type a bank password in a phone call to the bank? [duplicate]

Recently my friend called their bank (via a normal phone call) to perform an operation with her account and she had to type her password during the call. Everything worked fine, the operation was done ...
Pedro A's user avatar
  • 133
1 vote
1 answer
659 views

Is this "secure email" mechanism my bank wants me to use best practice?

So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the ...
Italian Philosophers 4 Monica's user avatar
3 votes
2 answers
295 views

Can a third-party service within an e-banking portal actually be safe?

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced. The whole e-...
1NN's user avatar
  • 133
0 votes
1 answer
195 views

How can hackers steal from a savings account that has no client card? [closed]

Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used ...
ChrisB's user avatar
  • 103
36 votes
8 answers
9k views

Why does my digital bank need my phone date and hour to be correct?

I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"? For ...
RA828's user avatar
  • 473
1 vote
0 answers
178 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
Philip Sherpa's user avatar
1 vote
1 answer
343 views

Online transactions: which one is safer - credit card or netbanking? [closed]

There are various modes of online transaction, such as through entering credit card details, and through netbanking. Which one is safer? it seems there are some risks with credit card mode mode but is ...
user avatar
2 votes
1 answer
289 views

What can be done with Credit or debit card informations asked by websites?

Many websites ask for payment by entering information from Credit card such as VISA card/ Mastercard etc. Now, till date I knew that I should never tell anybody about these numbers. Then why these ...
user avatar
3 votes
1 answer
461 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
aluriak's user avatar
  • 133
1 vote
1 answer
1k views

What are security issues about sending bank alerts via email/SMS?

Banks offer to send alerts for each transaction happening on a customers account. My bank is offering three options: SMS alerts, email alerts and push alerts into their own app. Only sms alerts are ...
Vestrigi's user avatar
0 votes
1 answer
764 views

Is Gnucash's flatpak safe to use with online banking?

Can I trust the (official?) GnuCash Flatpak on Flathub, linked from here to here? Following up on this Q&A I'm asking myself if I can trust this, bearing in mind this. Other options would be to ...
nutty about natty's user avatar
5 votes
4 answers
919 views

Are payment card PINs safe to send via SMS?

I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards ...
halfer's user avatar
  • 831
0 votes
0 answers
50 views

Can anything be stolen from me using bank Information? [duplicate]

I live on a Caribbean island and i am selling my pick up truck. Someone has contacted me saying they want to buy it and ship to the US.They have asked for all my bank info, IBAN, Swift Code, Acc.#, ...
Mike H's user avatar
  • 1
8 votes
1 answer
311 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
Lukas's user avatar
  • 238
1 vote
1 answer
164 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
Alexander Shcheblikin's user avatar
8 votes
1 answer
8k views

Western Union prompts for bank login information — ridiculously bad practice? [duplicate]

I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information. The ...
adam.baker's user avatar
0 votes
1 answer
5k views

Is it possible to bypass 2FA and access bank account in this system?

Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
Vasu Deo.S's user avatar
41 votes
3 answers
8k views

Why are my plastic credit card and activation code sent separately?

Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate? If a rogue element has access to my mail box ...
Lord Loh.'s user avatar
  • 549
3 votes
1 answer
1k views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
jj_p's user avatar
  • 379
4 votes
1 answer
2k views

How does the photoTAN (Cronto visual transaction signing) procedure work?

Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching ...
wimi's user avatar
  • 151
1 vote
1 answer
183 views

Is it safe to give multiple virtual credit card numbers to the same vendor?

There are situations when I have to give several virtual credit card numbers linked to my real credit card to the same vendor. Can a vendor guess the real credit card number by having multiple virtual ...
lim-lim's user avatar
  • 29
1 vote
4 answers
582 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
Gili's user avatar
  • 2,169
2 votes
1 answer
725 views

Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of: The answer to a security question. This had to be entered in full and was the ...
Andrew's user avatar
  • 21
3 votes
3 answers
546 views

Making transactions only, or almost only, by QR codes

I have a OnePlus 6 smartphone and I recently opened a bank account in a bank which seems to me very innovative in the context going payment card (debit/credit) free (using only application and/or cash)...
user avatar

1
2 3 4 5