162
votes
Accepted
How does Shutterstock keep getting my latest debit card number?
Simply put, Account Updater:
When participating issuers re-issue cards, they submit the new account
number and expiration date to VAU. Participating merchants send
inquiries on their credentials-on-...
- 72.7k
160
votes
Should I be worried of tracking domains on a banking website?
It looks like the main site is embedding script from Adobe Marketing Cloud directly into the page. While these scripts are loaded from the same server as the main site it looks like that these scripts ...
- 198k
130
votes
Accepted
Why are my plastic credit card and activation code sent separately?
Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. ...
- 21.6k
106
votes
Is Plaid, a service which collects user’s banking login information, safe to use?
I want to point out that despite Plaids apparently honest attempts at security, their approach is a privacy nightmare, as you give full access to Plaid, to all and every single information your bank ...
- 1,061
90
votes
Bank wants my Online-banking PIN through the telephone
It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are ...
- 853
82
votes
Unexpected email from Yorkshire Bank
I feel that ignoring would be the wrong thing to do, but I'm not sure what to do.
If you feel that ignoring this is wrong, look up the bank's phone number from a reputable source, e.g. yellow pages ...
- 15.4k
81
votes
Accepted
Bank wants my Online-banking PIN through the telephone
In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) ...
- 2,721
68
votes
Is a 6 digit numerical password secure enough for online banking?
A 6 digit numerical password doesn't do much.
Why 6 Digits?
Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing ...
- 749
66
votes
Accepted
Is a 6 digit numerical password secure enough for online banking?
Unusual? Yes. Crazy? No. Read on to understand why...
I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, ...
- 33.4k
65
votes
How can "USB stick" online identification possibly work?
What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the ...
- 49.3k
64
votes
Is Plaid, a service which collects user’s banking login information, safe to use?
So, does Plaid have some special access to banking systems, or is it
using user passwords to log in to bank accounts, which requires
storing them in plaintext (or convertible to plaintext) and ...
- 72.7k
60
votes
Accepted
My bank support just asked me for my online banking credentials
Assuming that you called them on a published number, I'd say that this sounds like it was an interactive Voice Response (IVR) system, which is pretty common in the banking world.
The concept is ...
- 62.1k
57
votes
Accepted
Why do some internet banks force logout on back button?
A scenario such banks might want to protect you from could be this:
you visit your banking website and do your banking stuff.
after you are finished you log out and then navigate to some other ...
- 49.3k
56
votes
Should a bank be able to shorten your password without your involvement?
Most likely the bank always used just 20 characters.
As Affe already suggested in the comments, the simplest explanation is that nothing has actually changed in the way the bank stores the passwords. ...
- 841
51
votes
Accepted
Why does my digital bank need my phone date and hour to be correct?
One of the reasons can be the usage of the digital signature. If the time on your phone differs essentially from the actual current time, this may cause your phone to reject signatures done by the ...
- 12.2k
42
votes
How should I verify a caller is from the bank or company they claim?
I would refuse to give out any personal details to anyone that called me as you can't verify who they are.
If they need to talk to you then say you can call back. You can then call through on the ...
- 332
42
votes
Why should we prevent users from saving their passwords in their password manager?
DON'T.
Unique passwords is one of the most important aspect of password security, as a breach in a different site will not affect other sites for the same user.
Unique passwords per site is almost ...
- 15.4k
39
votes
Explain to non tech savvy person how to check that your connection to mybank.com is safe?
Why security indicators fail vs. phishing
There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no ...
- 6,848
32
votes
Why are my plastic credit card and activation code sent separately?
A lot of people get a credit card and leave it in the envelope for a considerable amount of time.
Further, separating the data complicates life very greatly for a mail thief. To snatch one piece ...
28
votes
Accepted
Explain to non tech savvy person how to check that your connection to mybank.com is safe?
Update 09/2018:
While I previously stated that this might be a good option, the world has changed, and the use of EV is no longer a particularly reliable indicator, even given the drawbacks mentioned ...
- 27.4k
28
votes
How can "USB stick" online identification possibly work?
One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect ...
- 31.4k
28
votes
Bank wants my Online-banking PIN through the telephone
As there has been some confusion here, I wanted to add another (and hopefully last) answer to consolidate all the information that is flying around.
First of all, what kind of PINs are there in today'...
- 7,955
27
votes
Why do some internet banks force logout on back button?
There's a couple of things going on here:
Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server.
...
- 33.4k
26
votes
Accepted
Voice Biometrics for financial authentication
This will be abused and instead of password dumps we will see attackers trading voice sample dumps and building huge databases of identified voice samples from public documents and places like YouTube....
- 14.2k
25
votes
How can "USB stick" online identification possibly work?
....they don’t require the user to install any software on the machine....
I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted ...
- 4,823
22
votes
Accepted
Bank complains about rooted Android. Is it really any worse than a Windows desktop?
It's All About the Security Model
We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web ...
- 3,397
19
votes
Voice Biometrics for financial authentication
This keeps popping up every year as the next big thing.
2016:Citi
2015:ING
2013:Barclays
This 2014 paper Automatic speech recognition for under-resourced languages: A survey. Speech ...
- 3,966
19
votes
Why does my digital bank need my phone date and hour to be correct?
There are security reasons why your bank may expect your mobile to have automatic date and time enabled. This will include protection against replay attack, where each request includes a timestamp, ...
- 682
18
votes
Why does my digital bank need my phone date and hour to be correct?
In addition to Tim's answer, I would add that it also has to do with how SSL Certificates are verified.
If you log onto your computer instead of your phone, and change the date and time on your ...
- 309
17
votes
Is a 6 digit numerical password secure enough for online banking?
Original answer
This is a bad, bad policy. There are only 106 or a million different 6-digit numbers. That is so too little.
It is almost impossible to prevent an offline brute force attack, no ...
- 65.4k
Only top scored, non community-wiki answers of a minimum length are eligible