Questions tagged [banks]
Use for questions about security practices used by banks and other financial institutions.
0
votes
1answer
98 views
Is the zero trust approach really so safe? [closed]
Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
0
votes
1answer
49 views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
1
vote
0answers
68 views
Are printed check security features a gimmick?
This question is perhaps a rough fit for this SE site, but it is about information security, though not specifically about computers.
When ordering company checks, there are a plethora of options. ...
0
votes
0answers
11 views
What data associated with my payment card does a merchant or a payment processor get when I purchase something with it? [duplicate]
If I use a debit or credit card to purchase something online, what data does the party that charges my card get? I understand that there are payment processors like Stripe or PayPal that act as a ...
1
vote
2answers
60 views
Where would I go to use a reliably secure encrypted internet connection?
Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
0
votes
0answers
36 views
Is there a security issue with fit4less requiring bank information and not simply card number?
When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc.
For example spotify goes through my credit card. ...
2
votes
1answer
135 views
Is Plaid safe, if I change the password after deposit?
Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand the fact that Plaid store my login and password, somewhere... somehow... who really knows. A lot of people ...
1
vote
3answers
176 views
Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?
Bruce Schneier Writes Down Passwords. So Can You
...
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
1
vote
1answer
97 views
Norms and Compliance for storing bank account details
I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.
However, I was wondering if there are some ...
-2
votes
1answer
112 views
Unauthorised transfers to developer's account in bank transaction software [closed]
Our organization has software for transactions. The person who designed this software illegally designed it in such a way that when any transaction is performed 0.5 percent of the transaction goes ...
4
votes
2answers
3k views
Is Plaid, a service which collects user’s banking login information, safe to use?
I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
0answers
45 views
How does using an app rather than code card to authenticate improve security?
Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know:
Our bank account number (we have that written down)
A password we've picked. We ...
1
vote
2answers
200 views
How should we mitigate threats that are keep coming to our security monitoring system?
We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
-1
votes
1answer
95 views
Which encryption methods are used in online banking?
How does the connection get established in online banking?
Just with SSL?
I searched the internet for that, but there are just 'user guides' if you want to use online banking but not how it works on ...
1
vote
1answer
74 views
Deutsche Bank PhotoTan app signed with self-signed certificate?
Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this:
# ...
10
votes
4answers
1k views
Why should we prevent users from saving their passwords in their password manager?
I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.
I noticed ...
1
vote
0answers
39 views
What are the most important security controls to implement when deploying BYOD in an organization? [closed]
In organizations like banks that have already many security controls. Will implementing BYOD (our organization employees will be able to use their own computers to access the organization when they ...
0
votes
1answer
122 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
-3
votes
2answers
208 views
End to end encryption in mobile banking? [closed]
Can we use E2EE to secure the communication between the bank and it's customers in the applications of mobile banking? And what is the status off E2EE vs SSH regarding this matter?
11
votes
3answers
389 views
How to calculate our application security debt?
Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
29
votes
4answers
3k views
How should I verify a caller is from the bank or company they claim? [duplicate]
I often get telephone calls from my personal bank, mortgage provider or utility companies.
In most cases they start by asking me to verify my identity through the usual name/address/date of birth or ...
-1
votes
2answers
127 views
Ad fraud is growing into one of the biggest concerns. How can it affect banks?
The attached image was presented to me, but I'm confused about the risks of ad-fraud to organizations like banks. Usually, the advertisement budgets are invested only in "trusted" sources like Google ...
1
vote
1answer
55 views
Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS
Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
7
votes
1answer
251 views
Why would a banking app require access to browsing history and information about apps running on the device?
I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device.
Why would a banking app ...
0
votes
1answer
162 views
Pinhole communication with air gapped network
A long time ago ago I worked for a small bank. We used a physically separated network to host our internal servers that handled all the transactions, as well as the workstations accessing the system.
...
1
vote
1answer
250 views
Can a website use my debit card details for further transaction? [closed]
I bought a bracelet from Buzz Bargain(Sorry for advertisement) and it deducts 2.99 from my account and then they send me an email saying that we will deduct 49.9 USD after a month for a subscription ...
1
vote
2answers
69 views
Linking to a bank account: login credentials vs. routing information
Venmo wants the login credentials to my bank to link to my bank account. Giving my bank password to another party feels very wrong and is not something I am inclined to do.
However, after thinking ...
0
votes
0answers
99 views
How to check if direct debit whitelisting is in place for a specific account number?
Paying through bank transfer to other account without direct debit is more and more common these days.
Some of them are online services running bug bounties with availability of payment through bank ...
2
votes
2answers
355 views
Computer began downloading hundreds of blobs then froze
While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
4
votes
1answer
108 views
Debit Card was used fraduentely, Should I report an incident to the websites that stored my card?
Here is my situation. I had a debit card where I could transfer funds to it for limited use. I usually kept a low amount on this card just for little purchases. It was recently used in a fraudulent ...
22
votes
4answers
572 views
Bank asked for a cross login?
I was creating a new bank account here in the US at HSBC's popular online bank...
You know the step where you have to verify the account you're sending from, by receiving two small test payments?
I ...
1
vote
2answers
270 views
Are these claims about public WiFi accurate?
I received the following message from my bank:
Be careful when using wireless networks. Some wifi networks are unsecure, meaning that they may allow someone else to access information or files ...
2
votes
1answer
107 views
Is it safe to keep image of cleared check?
I am developing an online banking site. Is it advisable to build a feature that allow user to download and save an image of their cleared checks on their computer? Is there any risk to user who ...
1
vote
1answer
445 views
Storing basic financial data
I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
1
vote
1answer
512 views
PCI compliance for bank card system
There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer.
The bank can ...
5
votes
3answers
269 views
Why don't most banks in the UK use 2FA?
Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list?
Why is this more secure than using a ...
1
vote
2answers
150 views
Bank asking for password for encrypted document
My bank has advised that they are sending me a letter by email.
The letter within the email will be encrypted.
Rather than giving me a password for the letter, the bank asked me over the phone to ...
0
votes
1answer
101 views
How can the german ChipTAN / CardTAN system be secure?
The german ChipTAN (https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_CardTAN) system calculates a TAN that is send to the banking server to proof the transaction. The number ...
3
votes
0answers
54 views
Is it really risky to make your IBAN public? [duplicate]
I have already asked this question on "Personal finance & Money", but probably it wasn't the right community.
It seems that people are reluctant to give their IBAN to strangers.
I saw someone ...
7
votes
1answer
343 views
PSD2 compliant two factor authentication
According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other.
Here is the article from the directive:
*...
1
vote
2answers
63 views
Bank requires card PIN for online transactions: how is this better than standard two-factor one-time PIN?
I have a bank account in one of the main European banks. The bank recently overhauled its online banking system, making it more visually attractive (and also full of bugs and extremely annoying to use)...
78
votes
10answers
24k views
Bank wants my Online-banking PIN through the telephone
My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
3
votes
1answer
158 views
Is my online bank password security policy good enough?
My bank has an online password security policy which seems to me 100% wrong at all levels. Since it is one of the biggest banks in my country, I'm giving it the benefit of the doubt, and consider the ...
2
votes
2answers
134 views
Is this technique a secure way to confirm a user's bank account details, without requiring them to provide their credentials?
There are many financial services that can verify a user's bank account by asking for their username and password, and signing in on their behalf. Some examples are Coinbase and TransferWise.
I've ...
8
votes
5answers
2k views
Hardware token vs Fingerprint based software token
I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.
Option "hardware token":
Authentication into the web platform is done ...
3
votes
1answer
155 views
what to do if your online banking has low security standards
What can I do if I think that my online banking service is not secure enough? the bank I'm considering is hsbc us (but I believe such issues are common to many) and here's two items that I believe ...
1
vote
2answers
267 views
Online banking on wpa & wpa2 enterprise
I could use two wifi connections, both with WPA & WPA2 Enterprise security, automatic PEAP and MSCHAPv2, one of them with certificate, the other without; both require user/pwd and are on a ...
0
votes
1answer
131 views
FooCoin, a BitCoin on an encrypted smartphone OS = flawed?
Please help me with a theoretical Bitcoin equivalent called FooCoins that are encrypted inside small phone electronics that are difficult to modify and hack, using a closed source OS.
BitCoins use ...
5
votes
1answer
266 views
Is inputting a password over a phone secure
When calling my bank, they require you to input your username and password using the phone keypad. Is this a safe practice? Specifically, is this less secure than inputting my password on their ...
0
votes
1answer
226 views
Is an exploit that exposes the balance of any account in the bank a high risk exploit?
I have found an exploit to get account balance information for any account in my bank website.
What is the level of this exploit (risk, medium, low)?
and is it ethical to ask for a prize or money ...
