Questions tagged [financial]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
67 views

How are institutions physically connected to SWIFTNet?

There is a lot of information to be found about SWIFT and the protocols that are being used by its members to exchange messages. However, I could not find much information about how banks and ...
0
votes
0answers
65 views

Can phone apps edit my clipboard?

This is a question similar to this one but it is all about editing the clipboard contents. Can phone apps read my clipboard? Is this actually a case on latest API of Android an iOS? I mean ...
-1
votes
1answer
63 views

Fundamentals of securing a web app? [closed]

I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
2
votes
1answer
334 views

How many digits of my credit card number may be revealed on the merchant copy of the receipt (Europe)?

The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was ...
1
vote
1answer
65 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
2
votes
1answer
74 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
2
votes
4answers
300 views

Do you need to hire a professional in order to be pci compliant?

i run an organic food store, and after a conference call with my credit card service (card connect), do i really have to hire a PCI certified professional once a year in order to be pci compliant? If ...
0
votes
1answer
109 views

Is this strategy end 2 end encryption and secure?

I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please. The workflow is as follows: A customer indicates they want to ...
2
votes
2answers
109 views

Can email be secured by the receiver only, without action by the sender?

An established financial institution just directed me to email them a document with sensitive information. When I questioned the security, the CS rep and manager both tried to assure me that, "...
28
votes
1answer
7k views

Are credit-card security codes theoretically insecure (if not entirely broken) already?

I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine): The CSC for each ...
1
vote
1answer
646 views

Storing basic financial data

I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
1
vote
0answers
36 views

How to protect critical financial information in Web Apps and Web Services? (examples, common approaches) [closed]

Let's imagine a web service that allows to create wallets, deposit money and cryptocurrencies, perform money and cryptocurrency exchange and withdraw money. The critical information here is: "sign ...
1
vote
1answer
36 views

Is there an advantage to request the same information if authentication fails?

Financial websites (banks, credit reporting agencies, etc.) often use two stages when authenticating you: Identifier (account number, email, etc.) Two characters from a memorable word I've noticed ...
1
vote
0answers
40 views

Is there any financial rating of electronic trading platforms?

There are too many different online stores and paid services in the Internet! Some are big and popular, other aren't. I search for some universal financial rating of electronic trading platforms or, ...
1
vote
1answer
961 views

Security reason that Card Security Codes (CVV/CVC) are usually on the back of a card? [closed]

My friend recently got an Amazon Credit Card. Interestingly, all the information could be found on the back of the card including name, expiration, number, and CVV. Here's an image I found of the ...
1
vote
2answers
147 views

Is there a point to obfuscating form field values?

Our company provides omnichannel (web, mobile, etc.) solutions for the banking industry. One of our customers is pushing for obfuscating or encrypting the contents of the form fields (client-side, on ...
2
votes
0answers
87 views

Compliance/ FCA regulations

First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question: SCENARIO I am planning ...
0
votes
1answer
255 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...
1
vote
2answers
596 views

My bank's homepage is on http. No SSL. Isn't it trivially easy to MITM+change links & get login credentials?

The homepages of several banks are available over http. Some have search engines linked to http. This, it seems to me, makes their users trivially vulnerable to MITM attacks if they visit the bank ...
3
votes
2answers
282 views

Security of the Indian AadhaarPay fingerprint based payment system?

India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it. Clients provide their Aadhaar number (like a national identity ...
6
votes
2answers
664 views

Couldn't credit/debit cards easily be made more secure?

As a person who is going to get my first credit or debit card, I began researching a bit about security of them and a couple of questions came up about why the system is designed the way it is. I ...
48
votes
9answers
7k views

How should high net worth individuals secure their financial accounts?

I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my ...
0
votes
1answer
54 views

Responding to a coordinated attack against financial transaction systems [closed]

Imagine a coordinated attack by a large and motivated hacking group, that results in a nation-level compromise of the financial systems we take for granted: credit card payments, accounts at the top ...
5
votes
1answer
7k views

I emailed someone a picture of a check I wrote for them. What now?

On a whim, I emailed the intended recipient of a check I wrote a picture of that filled-in check to indicate I was about to mail it out. The full front of the check, with amount, my signature, account ...
3
votes
0answers
592 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
1
vote
2answers
590 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
4
votes
1answer
5k views

What is an ITGC Audit?

I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
0
votes
2answers
202 views

Finance with the multitude of “Secure Browsers” [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
0
votes
1answer
193 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
45
votes
5answers
21k views

How does a website know if a certain creditcard number is wrong instantly

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
16
votes
2answers
2k views

Can bankers' rounding be exploited to maliciously increase balances?

Everyone knows about the sure thing retirement strategy that is the Superman 3 exploit, but is there a way to exploit bankers' rounding to grab some of the less than half pennies "floating around out ...
13
votes
5answers
2k views

Why should I have secure passwords for sites that I pay bills on?

What's the worst that can happen, the hackers will pay my bills for me? Assume that this isn't a malicious hacker out to disconnect my electricity. What kind of concerns are there for my finances, ...
1
vote
2answers
991 views

Why does the finance industry uses 2TDEA instead of 3TDEA?

Why does the finance industry uses 2TDEA instead of 3TDEA; is there any historical reason or technical limitations like the support by HSMs used in the industry? The paper referred to here says ...
3
votes
1answer
912 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
1
vote
3answers
274 views

Information Security and Financial Risks

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If so,...
11
votes
1answer
14k views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
-2
votes
3answers
193 views

How would authentication when depositing, and withdrawing money from a fund, differ?

I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions (...
0
votes
1answer
5k views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
0
votes
1answer
119 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
5
votes
1answer
3k views

Is TLS 1.0 sufficiently secure for a bank?

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0. ...
-1
votes
1answer
250 views

How much can you trust a (banking) site after it spams you? [closed]

How much can you trust a company that send you spam ? Many people, after registering with Moneybookers(Skrill) started to receive spam that included their real name (as inputted in Moneybookers ...
5
votes
2answers
80 views

What security controls should be in place for online updates of user's correspondance address?

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
-1
votes
1answer
244 views

Is .bank owned by banking industry or not? [closed]

According to https://idc-insights-community.com/financial/financial-services-technology/the-four-letter-word-that-could-change-the-busines Banking Industry was lobbying for .bank But as I read this ...
2
votes
1answer
215 views

Why does Paypal send TWO verification payments not just ONE?

The process would be easier if there was only one payment, but there must be some security or financial reason for Paypal to send you two random payments
2
votes
2answers
3k views

Keeping valuable algorithms secret

Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best? The ...
12
votes
8answers
21k views

Is it possible to steal money directly from the systems of a big bank?

Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money... The most common way to steal money in ...