Who are the good guys and who could do better when it comes to online banking security?
The good, the bad and the ugly
Abbey and Halifax, say Which? Computing, have less secure log-in procedures than their competitors. Meanwhile Alliance & Leicester and HSBC returned average results.
Which? Computing singled out Halifax for criticism due to the need to enter three pieces of typed information to log in, increasing the propensity for keyloggers to capture valuable personal data.
Barclays and Lloyds TSB scored better. In both cases their online banking interface requires users to select from drop-down menus. An additional PIN entry device attracted praise from Which? Computing for the improved security it offered.
First Direct, Lloyds TSB, Nationwide, NatWest and RBS were also rated as good in the Which? Computing report.
How fraud takes place
The UK Payments Administration (formerly APACS) report that online banking fraud reached £52.5m in 2008. That is double the £22.6m online banking fraud recorded in 2007.
Keylogging Trojans are blamed for playing the larger part in the rise in online banking fraud.
Keystroke loggers are designed to record what consumers type when visiting internet sites before uploading this information to cybercrime servers. Any site could be infected in this way (though most webmasters are aware of how to prevent this, and do!).
Online banking is especially susceptible as it involves people typing in login details to bank accounts, entering bank account and payment details and a host of other sensitive exchanges of deeply personal financial information.
Other internet security problems and solutions
Abbey, Alliance & Leicester, HSBC and Halifax also drew criticism in the Which? Computing report for not logging out clients when surfers move on to other internet sites. This issue is especially accute where a person uses a shared computer which could leave leaves accounts vulnerable.
The Which? study also appraised security measures applied to money transfers with Abbey, First Direct, Halifax and HSBC drawing fire for a lack of visible security controls for money transfers. In theory this means that if a banking session were hijacked, a criminal might be able to enter the amount they wanted to transfer to an account they wanted to transfer to.
So, there you have it. If in doubt, get intelligent security in place which can spot keylogging, Trojans and the like sooner than later.
.gif)
