Use for questions about security practices used by banks and other financial institutions.
0
votes
0answers
16 views
What are the techniques to detect malware CallHome activities many times described as beaconing?
It is very common for active malware to "call home" (beaconing as we know), either to fetch updates and instructions or to send back stolen information. In an internal network where web access to the ...
7
votes
1answer
158 views
How to calculate our application security debt?
Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
29
votes
4answers
3k views
How should I verify a caller is from the bank or company they claim? [duplicate]
I often get telephone calls from my personal bank, mortgage provider or utility companies.
In most cases they start by asking me to verify my identity through the usual name/address/date of birth or ...
-1
votes
2answers
114 views
Ad fraud is growing into one of the biggest concerns. How can it affect banks?
The attached image was presented to me, but I'm confused about the risks of ad-fraud to organizations like banks. Usually, the advertisement budgets are invested only in "trusted" sources like Google ...
0
votes
1answer
26 views
Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS
Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
8
votes
1answer
236 views
Why would a banking app require access to browsing history and information about apps running on the device?
I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device.
Why would a banking app ...
0
votes
1answer
87 views
Pinhole communication with air gapped network
A long time ago ago I worked for a small bank. We used a physically separated network to host our internal servers that handled all the transactions, as well as the workstations accessing the system.
...
1
vote
1answer
153 views
Can a website use my debit card details for further transaction? [closed]
I bought a bracelet from Buzz Bargain(Sorry for advertisement) and it deducts 2.99 from my account and then they send me an email saying that we will deduct 49.9 USD after a month for a subscription ...
1
vote
2answers
58 views
Linking to a bank account: login credentials vs. routing information
Venmo wants the login credentials to my bank to link to my bank account. Giving my bank password to another party feels very wrong and is not something I am inclined to do.
However, after thinking ...
0
votes
0answers
75 views
How to check if direct debit whitelisting is in place for a specific account number?
Paying through bank transfer to other account without direct debit is more and more common these days.
Some of them are online services running bug bounties with availability of payment through bank ...
2
votes
2answers
294 views
Computer began downloading hundreds of blobs then froze
While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
3
votes
1answer
99 views
Debit Card was used fraduentely, Should I report an incident to the websites that stored my card?
Here is my situation. I had a debit card where I could transfer funds to it for limited use. I usually kept a low amount on this card just for little purchases. It was recently used in a fraudulent ...
22
votes
4answers
551 views
Bank asked for a cross login?
I was creating a new bank account here in the US at HSBC's popular online bank...
You know the step where you have to verify the account you're sending from, by receiving two small test payments?
I ...
1
vote
2answers
187 views
Are these claims about public WiFi accurate?
I received the following message from my bank:
Be careful when using wireless networks. Some wifi networks are unsecure, meaning that they may allow someone else to access information or files ...
2
votes
1answer
103 views
Is it safe to keep image of cleared check?
I am developing an online banking site. Is it advisable to build a feature that allow user to download and save an image of their cleared checks on their computer? Is there any risk to user who ...
1
vote
1answer
200 views
Storing basic financial data
I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
1
vote
1answer
181 views
PCI compliance for bank card system
There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer.
The bank can ...
5
votes
3answers
148 views
Why don't most banks in the UK use 2FA?
Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list?
Why is this more secure than using a ...
1
vote
2answers
149 views
Bank asking for password for encrypted document
My bank has advised that they are sending me a letter by email.
The letter within the email will be encrypted.
Rather than giving me a password for the letter, the bank asked me over the phone to ...
0
votes
1answer
75 views
How can the german ChipTAN / CardTAN system be secure?
The german ChipTAN (https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_CardTAN) system calculates a TAN that is send to the banking server to proof the transaction. The number ...
3
votes
0answers
53 views
Is it really risky to make your IBAN public? [duplicate]
I have already asked this question on "Personal finance & Money", but probably it wasn't the right community.
It seems that people are reluctant to give their IBAN to strangers.
I saw someone ...
6
votes
1answer
189 views
PSD2 compliant two factor authentication
According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other.
Here is the article from the directive:
*...
1
vote
2answers
55 views
Bank requires card PIN for online transactions: how is this better than standard two-factor one-time PIN?
I have a bank account in one of the main European banks. The bank recently overhauled its online banking system, making it more visually attractive (and also full of bugs and extremely annoying to use)...
79
votes
10answers
23k views
Bank wants my Online-banking PIN through the telephone
My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
3
votes
1answer
141 views
Is my online bank password security policy good enough?
My bank has an online password security policy which seems to me 100% wrong at all levels. Since it is one of the biggest banks in my country, I'm giving it the benefit of the doubt, and consider the ...
2
votes
2answers
128 views
Is this technique a secure way to confirm a user's bank account details, without requiring them to provide their credentials?
There are many financial services that can verify a user's bank account by asking for their username and password, and signing in on their behalf. Some examples are Coinbase and TransferWise.
I've ...
8
votes
5answers
2k views
Hardware token vs Fingerprint based software token
I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.
Option "hardware token":
Authentication into the web platform is done ...
3
votes
1answer
140 views
what to do if your online banking has low security standards
What can I do if I think that my online banking service is not secure enough? the bank I'm considering is hsbc us (but I believe such issues are common to many) and here's two items that I believe ...
1
vote
2answers
222 views
Online banking on wpa & wpa2 enterprise
I could use two wifi connections, both with WPA & WPA2 Enterprise security, automatic PEAP and MSCHAPv2, one of them with certificate, the other without; both require user/pwd and are on a ...
0
votes
1answer
128 views
FooCoin, a BitCoin on an encrypted smartphone OS = flawed?
Please help me with a theoretical Bitcoin equivalent called FooCoins that are encrypted inside small phone electronics that are difficult to modify and hack, using a closed source OS.
BitCoins use ...
5
votes
1answer
261 views
Is inputting a password over a phone secure
When calling my bank, they require you to input your username and password using the phone keypad. Is this a safe practice? Specifically, is this less secure than inputting my password on their ...
0
votes
1answer
222 views
Is an exploit that exposes the balance of any account in the bank a high risk exploit?
I have found an exploit to get account balance information for any account in my bank website.
What is the level of this exploit (risk, medium, low)?
and is it ethical to ask for a prize or money ...
5
votes
1answer
409 views
Can a Bitcoin Seller steal my Identity?
I was trying to buy some bitcoins on https://localbitcoins.com. However, the seller was looking for a copy of my ID and a photo of my debit card (long number covered).
I'm curious as to how open ...
1
vote
1answer
214 views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
64
votes
8answers
16k views
My bank support just asked me for my online banking credentials
As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for ...
11
votes
1answer
7k views
How is it secure for Venmo to ask for credentials?
When linking a bank account, one of the options on Venmo is to provide the username and password of your online banking account. I can't seem to find people criticizing this practice, which surprises ...
4
votes
1answer
618 views
How secure is telephone banking?
The fallback for my online banking login at multiple banks is telephone banking. On the phone I can make payments, but I can also reset passwords, and several other critical security functions. ...
124
votes
3answers
18k views
Should I be worried of tracking domains on a banking website?
Finland's largest bank OP (former Osuuspankki) has added tracking domains (all three owned by Adobe) in their website redesign:
These domains are loaded when signed in:
2o7.net
demdex.net
omtrdc.net
...
0
votes
1answer
238 views
Storing bank account details securely
I'm writing some software which has an invoicing component. Is it safe to store a bank account number and an associated sort code in a database if I use encryption? Can anything be stolen using just ...
0
votes
2answers
1k views
Is it safe to install Anaconda/Spyder/Python on laptop with netbanking?
I am new to learning Python and I am using a laptop for netbanking etc.
Is it safe to use the same laptop for netbanking and installing packages like Anaconda/Spyder/Python on the same laptop?
1
vote
1answer
200 views
How can a debit card provide different answers when the same challenge is sent to it multiple times?
I do only banking with my "PostFinance" debit card. The sign-in protocol works like this:
Enter user name and password into web form.
Get a 9 digit challenge number on website.
Type the challenge ...
5
votes
1answer
300 views
UK online bank card reader identification entropy
In the UK it's common to use a smart card and reader to log in to online banking. You insert the card, enter the PIN and get back an 8-digit code from the reader to enter into the online bank website....
0
votes
1answer
164 views
chipTan in combination with bank's portal or mobile application
I use chipTAN for authentication in banking-context because I think it's the better second factor.
Till now I use the bank´s portal via a browser on my PC.
In future I want to use the mobile ...
1
vote
2answers
232 views
How safe are android applications? [duplicate]
Can one application access data of another application in some way because it has access to files on phone storage?
Can it make screenshots/log keystrokes without my knowledge?
Do such permissions ...
1
vote
1answer
98 views
Is it safe to dial sensitive information into a telephone keypad?
I had a banking issue this past week. When I telephoned my bank, the automated system asked me to dial several digits of my bank card and the password that allows me to access my online banking system....
2
votes
1answer
79 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
3
votes
2answers
185 views
Should I close other programs as I pay bills?
In my country, I can pay bills via Internet bank. Is it preferable to close any other softwares than browser if I pay bills or does it matter if some other programs or browser tabs are on while paying?...
0
votes
1answer
52 views
Multifactor Authentication over Single Channel
I recently changed banks and the new bank's mobile-banking service has made me ask some questions.
The phone is authenticated/registered with the bank who must be keeping something like an <IMEI, ...
1
vote
1answer
60 views
Is any security gained from bank issued usernames in this authentication flow? [duplicate]
My Bank's Online Banking feature doesn't use usernames. Instead, they assigned me a digit-only account number*. To log in, I enter my number, then it brings me to a new page to prompt for my password. ...
0
votes
2answers
107 views
How unsecure is entering personal information via the keypad when phone banking?
A lot of banks I have dealt with require the customer to enter their customer number, internet banking password (or phone password) and date of birth all via the phone keypad, prior to being connected ...
