Questions tagged [banks]

Use for questions about security practices used by banks and other financial institutions.

Filter by
Sorted by
Tagged with
144
votes
1answer
17k views

How does Shutterstock keep getting my latest debit card number?

I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since. Silently in 2018, they activated ...
128
votes
3answers
18k views

Should I be worried of tracking domains on a banking website?

Finland's largest bank OP (former Osuuspankki) has added tracking domains (all three owned by Adobe) in their website redesign: These domains are loaded when signed in: 2o7.net demdex.net omtrdc.net ...
97
votes
13answers
30k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
89
votes
3answers
91k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
76
votes
10answers
28k views

Bank wants my Online-banking PIN through the telephone

My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
70
votes
10answers
10k views

Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
70
votes
9answers
14k views

How can “USB stick” online identification possibly work?

My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced. Most importantly, they introduced a rather ...
70
votes
10answers
41k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
63
votes
8answers
18k views

My bank support just asked me for my online banking credentials

As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for ...
50
votes
9answers
10k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
42
votes
3answers
7k views

Why are my plastic credit card and activation code sent separately?

Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate? If a rogue element has access to my mail box ...
42
votes
3answers
9k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
42
votes
3answers
59k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
38
votes
8answers
7k views

Why does my digital bank need my phone date and hour to be correct?

I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"? For ...
37
votes
5answers
19k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like ...
32
votes
7answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
29
votes
4answers
7k views

How should I verify a caller is from the bank or company they claim? [duplicate]

I often get telephone calls from my personal bank, mortgage provider or utility companies. In most cases they start by asking me to verify my identity through the usual name/address/date of birth or ...
24
votes
5answers
1k views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
23
votes
3answers
5k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
23
votes
5answers
10k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit card?...
22
votes
6answers
2k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
22
votes
3answers
18k views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
21
votes
7answers
8k views

Unexpected email from Yorkshire Bank

I have started receiving unexpected emails from Yorkshire Bank. I have never been a customer. I don't recall applying for any of their products either, although maybe I did many years ago. The ...
21
votes
4answers
3k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
20
votes
4answers
7k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
19
votes
3answers
14k views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
18
votes
4answers
3k views

Voice Biometrics for financial authentication

From this article: http://www.bbc.com/news/business-36762962 Apparently, it takes us 45 seconds on average just to confirm who we are. But by using computers to identify our voices, this ...
14
votes
1answer
3k views

How safe is my contactless bank card?

In the past few years Contactless Payment cards have been introduced and I have been reading some articles surrounding security of these cards. The following article "Stealing data from contactless ...
13
votes
2answers
2k views

My bank makes me enter my password using the mouse. What's up with that? [duplicate]

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
13
votes
2answers
2k views

not allowing pasting of bank account number

One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number. Therefor, every month I am forced to ...
13
votes
1answer
14k views

How is it secure for Venmo to ask for credentials?

When linking a bank account, one of the options on Venmo is to provide the username and password of your online banking account. I can't seem to find people criticizing this practice, which surprises ...
13
votes
2answers
1k views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
11
votes
4answers
2k views

Why should we prevent users from saving their passwords in their password manager?

I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account. I noticed ...
11
votes
3answers
446 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
11
votes
1answer
1k views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
10
votes
2answers
1k views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
9
votes
4answers
5k views

Offline brute-forcing of a bank card PIN

I may be neglecting a crucial fact here, but putting the following together leads me to believe it is dead-easy to determine a bank card's PIN using the most basic hardware available to everyone (I ...
9
votes
5answers
17k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
9
votes
3answers
4k views

Bank forces me to use six character alphanumeric password

My bank (it's Westpac, one of the big ones in Australia) has some strange restrictions on passwords. They're maximum 6 characters in length and it must contain only characters A-Z and digits 0-9, and ...
9
votes
6answers
2k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
9
votes
1answer
582 views

PSD2 compliant two factor authentication

According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other. Here is the article from the directive: *Article ...
8
votes
5answers
3k views

Hardware token vs Fingerprint based software token

I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option. Option "hardware token": Authentication into the web platform is done ...
8
votes
4answers
9k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
8
votes
5answers
23k views

How is Chase Mobile Deposit Secure?

Chase has this app that allows you to snap a picture of a check with your phone and deposit that check into your account. How do they prevent: Someone from depositing a check that's not written to ...
8
votes
1answer
8k views

PayPal is asking for my Bank Details. How secure is this? [closed]

I am from the UK but I'm living in Poland. I have two British bank accounts and a Polish account. The two British accounts are linked to a PayPal account registered from the UK and the Polish one is ...
8
votes
2answers
2k views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
8
votes
2answers
6k views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
8
votes
2answers
325 views

Is having a piece of paper with 2 fake PINS a good solution to mitigate credit-card theft?

I am planning to travel and thought about credit-card theft. Would it be a good idea to have a piece of paper with 2 fake PINs near my credit-card? The imagined attack goes as follows: The piece ...
8
votes
1answer
901 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
8
votes
1answer
4k views

Western Union prompts for bank login information — ridiculously bad practice? [duplicate]

I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information. The ...

1
2 3 4 5