3 ms·

It's enforced - sometimes - by the bank. My bank provides read access to everything with a username + password, but to transfer money or update details requires

• Beldin 5y ago
  I remember a presentation by the head of security of an Internet-only bank years ago, about banking malware. The latest malware was a man-in-the-browser style one: it intercepted your input and changed what you saw on-screen. This was used to defeat extra authentication: the malware inserted a (fake) deposit (something like "yearly subscription mr. X" for $2134.56) into your on-screen total and phoned home. The victim was then called by a mr. X who claimed to have accidentally swapped two digits in a transfer, and that the bank had said they can't fix it because the target account was a valid account. All they could do was exceptionally give out the phone number of the receiving side. Would you be so kind to rectify the situation? Since mr. X had all the details correct (amount, statement on transaction), the victim would initiate and authenticate a transfer. No way for the bank to detect, as this wouls be a genuine transfer order by the account owner. To be clear: the attack requires a victim whose browser is hacked and an associated phone number. That seemed like a tall order to me, but apparently not tall enough to stop this attack from being integrated into multi-banking malware. In short: read-only access is good, but not sufficient to prevent all attacks.
  • midasuni 5y ago
    That type of hack doesn’t require the user/password. It’s also on the same league as the Nigerian Prince, just appealing to kindness rather than greed. Idiots fall for these scams all the time, password not needed.