Questions tagged [banks]

Use for questions about security practices used by banks and other financial institutions.

Filter by
Sorted by
Tagged with
96
votes
13answers
29k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
13
votes
2answers
2k views

My bank makes me enter my password using the mouse. What's up with that? [duplicate]

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
126
votes
3answers
18k views

Should I be worried of tracking domains on a banking website?

Finland's largest bank OP (former Osuuspankki) has added tracking domains (all three owned by Adobe) in their website redesign: These domains are loaded when signed in: 2o7.net demdex.net omtrdc.net ...
32
votes
7answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
45
votes
3answers
40k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
24
votes
4answers
954 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
22
votes
6answers
2k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
7
votes
7answers
32k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
8
votes
5answers
23k views

How is Chase Mobile Deposit Secure?

Chase has this app that allows you to snap a picture of a check with your phone and deposit that check into your account. How do they prevent: Someone from depositing a check that's not written to ...
2
votes
2answers
344 views

ATM skimming with magnetic stripe

I have a question about ATM skimming. If ATMs in the UK still accept magnetic stripe can't a thief still use a cloned card at the ATM to withdraw money?
63
votes
8answers
18k views

My bank support just asked me for my online banking credentials

As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for ...
70
votes
10answers
9k views

Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
42
votes
3answers
57k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
20
votes
3answers
3k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
23
votes
5answers
10k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit card?...
19
votes
4answers
7k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
18
votes
4answers
3k views

Voice Biometrics for financial authentication

From this article: http://www.bbc.com/news/business-36762962 Apparently, it takes us 45 seconds on average just to confirm who we are. But by using computers to identify our voices, this ...
7
votes
5answers
14k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
1
vote
2answers
272 views

How should we mitigate threats that are keep coming to our security monitoring system?

We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
37
votes
5answers
16k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like ...
23
votes
3answers
4k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
9
votes
4answers
5k views

Offline brute-forcing of a bank card PIN

I may be neglecting a crucial fact here, but putting the following together leads me to believe it is dead-easy to determine a bank card's PIN using the most basic hardware available to everyone (I ...
6
votes
2answers
8k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
6
votes
2answers
701 views

Couldn't credit/debit cards easily be made more secure?

As a person who is going to get my first credit or debit card, I began researching a bit about security of them and a couple of questions came up about why the system is designed the way it is. I ...
4
votes
1answer
2k views

How secure is telephone banking?

The fallback for my online banking login at multiple banks is telephone banking. On the phone I can make payments, but I can also reset passwords, and several other critical security functions. ...
4
votes
1answer
260 views

Best practice for Users to avoid fraud for Direct Debit enabled bank accounts?

Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks. https://en.wikipedia.org/...
2
votes
1answer
422 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
1
vote
5answers
13k views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
1
vote
3answers
449 views

Are wireless card skimmers just fearmongering?

I'm not sure about other countries but Australian Banks have been releasing cards with RFID Chips in them (for what reason is beyond me since around the same time there's been payway apps which swap ...
1
vote
4answers
251 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
0
votes
1answer
834 views

Where is RSA Digital signature used in the online banking world?

When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a ...