Skip to main content

Questions tagged [financial]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

What is the secure way to transfer money internationally and not involving any bank in it? [migrated]

I have been searching for a secure method of transferring money internationally and easy cashouts but not involving any banks (because of taxation-documentation-money trailing queries). Some ...
GBK's user avatar
  • 1
2 votes
0 answers
233 views

I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?

This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit? I've linked an account with Plaid. That account is 2FA ...
TyrannicalDuncery's user avatar
3 votes
1 answer
376 views

Why banks require such a low password entropy for web/app access?

Many banks I have worked with require between 4-6 characters passwords. Some even force to use only digits. Such a poor password is protecting your financial information, because MFA is usually not ...
user avatar
1 vote
4 answers
438 views

How does an organization completely delete records?

As given here: Permanently delete a record it is not fully possible to remove data completely. Then what do financial institutions do? Institutions that store authenticating delicate details? Even if ...
savegoodlyfnotendorsinganswer's user avatar
0 votes
3 answers
159 views

What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?

I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
user's user avatar
  • 103
1 vote
0 answers
115 views

How to get on a list of sites that handle financial information? [closed]

Until about a year ago, I was working for one of the big tech giants. During my time there, I noticed that the IT department would do a MITM attack on any website that employees access. i.e. if you ...
Ram Rachum's user avatar
  • 2,058
1 vote
1 answer
253 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
36bitavi's user avatar
0 votes
0 answers
172 views

Can phone apps edit my clipboard?

This is a question similar to this one but it is all about editing the clipboard contents. Can phone apps read my clipboard? Is this actually a case on latest API of Android an iOS? I mean ...
Mateusz's user avatar
-1 votes
1 answer
140 views

Fundamentals of securing a web app? [closed]

I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
YulePale's user avatar
  • 133
2 votes
1 answer
1k views

How many digits of my credit card number may be revealed on the merchant copy of the receipt (Europe)?

The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was ...
iLoveCode's user avatar
1 vote
1 answer
260 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
Mike's user avatar
  • 45
2 votes
1 answer
261 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
Kye's user avatar
  • 153
2 votes
4 answers
646 views

Do you need to hire a professional in order to be pci compliant?

i run an organic food store, and after a conference call with my credit card service (card connect), do i really have to hire a PCI certified professional once a year in order to be pci compliant? If ...
thinksinbinary's user avatar
0 votes
1 answer
215 views

Is this strategy end 2 end encryption and secure?

I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please. The workflow is as follows: A customer indicates they want to ...
irth's user avatar
  • 103
2 votes
2 answers
183 views

Can email be secured by the receiver only, without action by the sender?

An established financial institution just directed me to email them a document with sensitive information. When I questioned the security, the CS rep and manager both tried to assure me that, "...
zwiebelspaetzle's user avatar
28 votes
1 answer
7k views

Are credit-card security codes theoretically insecure (if not entirely broken) already?

I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine): The CSC for each ...
Dai's user avatar
  • 1,728
3 votes
1 answer
2k views

Storing basic financial data

I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
Mike's user avatar
  • 45
1 vote
0 answers
112 views

How to protect critical financial information in Web Apps and Web Services? (examples, common approaches) [closed]

Let's imagine a web service that allows to create wallets, deposit money and cryptocurrencies, perform money and cryptocurrency exchange and withdraw money. The critical information here is: "sign ...
splash27's user avatar
  • 111
1 vote
1 answer
112 views

Is there an advantage to request the same information if authentication fails?

Financial websites (banks, credit reporting agencies, etc.) often use two stages when authenticating you: Identifier (account number, email, etc.) Two characters from a memorable word I've noticed ...
AStopher's user avatar
  • 787
1 vote
0 answers
97 views

Is there any financial rating of electronic trading platforms?

There are too many different online stores and paid services in the Internet! Some are big and popular, other aren't. I search for some universal financial rating of electronic trading platforms or, ...
WallOfBytes's user avatar
1 vote
1 answer
2k views

Security reason that Card Security Codes (CVV/CVC) are usually on the back of a card? [closed]

My friend recently got an Amazon Credit Card. Interestingly, all the information could be found on the back of the card including name, expiration, number, and CVV. Here's an image I found of the ...
Goose's user avatar
  • 1,394
1 vote
2 answers
506 views

Is there a point to obfuscating form field values?

Our company provides omnichannel (web, mobile, etc.) solutions for the banking industry. One of our customers is pushing for obfuscating or encrypting the contents of the form fields (client-side, on ...
Ricardo Zuasti's user avatar
2 votes
0 answers
164 views

Compliance/ FCA regulations

First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question: SCENARIO I am planning ...
9 Digit's user avatar
  • 21
0 votes
1 answer
1k views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...
John Smith Optional's user avatar
1 vote
2 answers
834 views

My bank's homepage is on http. No SSL. Isn't it trivially easy to MITM+change links & get login credentials?

The homepages of several banks are available over http. Some have search engines linked to http. This, it seems to me, makes their users trivially vulnerable to MITM attacks if they visit the bank ...
Chris F Carroll's user avatar
3 votes
2 answers
359 views

Security of the Indian AadhaarPay fingerprint based payment system?

India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it. Clients provide their Aadhaar number (like a national identity ...
user avatar
7 votes
2 answers
907 views

Couldn't credit/debit cards easily be made more secure?

As a person who is going to get my first credit or debit card, I began researching a bit about security of them and a couple of questions came up about why the system is designed the way it is. I ...
George's user avatar
  • 291
47 votes
9 answers
8k views

How should high net worth individuals secure their financial accounts?

I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my ...
Logical Fallacy's user avatar
0 votes
1 answer
113 views

Responding to a coordinated attack against financial transaction systems [closed]

Imagine a coordinated attack by a large and motivated hacking group, that results in a nation-level compromise of the financial systems we take for granted: credit card payments, accounts at the top ...
Dan Dascalescu's user avatar
5 votes
1 answer
15k views

I emailed someone a picture of a check I wrote for them. What now?

On a whim, I emailed the intended recipient of a check I wrote a picture of that filled-in check to indicate I was about to mail it out. The full front of the check, with amount, my signature, account ...
Bigbio2002's user avatar
3 votes
0 answers
799 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
ROCK's user avatar
  • 96
1 vote
2 answers
943 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
RandomJay's user avatar
5 votes
1 answer
6k views

What is an ITGC Audit?

I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
maplemale's user avatar
  • 153
0 votes
2 answers
272 views

Finance with the multitude of "Secure Browsers" [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
oink's user avatar
  • 157
0 votes
1 answer
398 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
ThePiachu's user avatar
  • 365
48 votes
5 answers
27k views

How does a website instantly know if a certain credit card number is wrong?

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
tony9099's user avatar
  • 779
16 votes
2 answers
2k views

Can bankers' rounding be exploited to maliciously increase balances?

Everyone knows about the sure thing retirement strategy that is the Superman 3 exploit, but is there a way to exploit bankers' rounding to grab some of the less than half pennies "floating around out ...
Jim Bob's user avatar
  • 303
12 votes
5 answers
3k views

Why should I have secure passwords for sites that I pay bills on?

What's the worst that can happen, the hackers will pay my bills for me? Assume that this isn't a malicious hacker out to disconnect my electricity. What kind of concerns are there for my finances, ...
Bigbio2002's user avatar
1 vote
2 answers
1k views

Why does the finance industry uses 2TDEA instead of 3TDEA?

Why does the finance industry uses 2TDEA instead of 3TDEA? Is there any historical reason or technical limitations like the support by HSMs used in the industry? The paper referred to here says simply ...
user917279's user avatar
3 votes
1 answer
2k views

Why recommend "letters, numbers, and special characters" in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
David Cary's user avatar
  • 2,740
1 vote
3 answers
433 views

Information Security and Financial Risks

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If so,...
user53852's user avatar
12 votes
1 answer
16k views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
user69715's user avatar
  • 231
-2 votes
3 answers
378 views

How would authentication when depositing, and withdrawing money from a fund, differ?

I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions (...
Jay's user avatar
  • 535
0 votes
1 answer
8k views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
M. Asad Ali's user avatar
1 vote
1 answer
188 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
makerofthings7's user avatar
5 votes
1 answer
4k views

Is TLS 1.0 sufficiently secure for a bank?

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0. ...
user28179's user avatar
-1 votes
1 answer
313 views

How much can you trust a (banking) site after it spams you? [closed]

How much can you trust a company that send you spam ? Many people, after registering with Moneybookers(Skrill) started to receive spam that included their real name (as inputted in Moneybookers ...
sharp12345's user avatar
  • 2,059
5 votes
2 answers
138 views

What security controls should be in place for online updates of user's correspondance address?

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
ABC's user avatar
  • 101
-1 votes
1 answer
306 views

Is .bank owned by banking industry or not? [closed]

According to https://idc-insights-community.com/financial/financial-services-technology/the-four-letter-word-that-could-change-the-busines Banking Industry was lobbying for .bank But as I read this ...
user310291's user avatar
  • 1,403
2 votes
1 answer
267 views

Why does Paypal send TWO verification payments not just ONE?

The process would be easier if there was only one payment, but there must be some security or financial reason for Paypal to send you two random payments
user avatar