Online banking security risks revealedWhich? Computing exposes big differences in banks
27 August 2009
Some of Britain’s biggest banks appear to be leaving their customers’ online bank accounts vulnerable to identity fraud because of poor security, says Which? Computing.
Halifax has one of the least secure log-in procedures of the ten online banks we looked at. It asks for three pieces of information to confirm a customer’s identity. As each entry is typed in full, this makes the information vulnerable to a simple keylogger, a virus that sits on a computer and tracks every keystroke with the aim of collecting passwords.
Keylogging software is blamed for online banking fraud more than doubling in 2008. It soared to £52.5m last year, up from £22.6m in 2007 according to the UK Payments Administration.
In contrast, Barclays and Lloyds TSB ask customers to use drop-down menus. Simply using menus rather than the keyboard stops keyloggers from quickly capturing passwords. Barclays customers who forget their PINsentry device (a handheld device that randomly generates new codes) must enter a five-digit passcode and two characters from a memorable word.
Browsing to another site can be unsafe with some accounts. Customers of Abbey, Alliance & Leicester, HSBC and Halifax are not immediately logged out if they browse, which means someone else could take over the session, leaving accounts vulnerable if accessed on a shared computer.
Which? Computing also found significant differences in how well money transfers appear to be protected. Abbey, First Direct, Halifax and HSBC have no visible security controls for money transfers, so if a banking session is hijacked, a criminal can enter the amount they want to.
Which? Computing Editor Sarah Kidner says: 'There are surprisingly big differences between big banks’ visible online security systems. Some simple measures, like the use of drop-down menus, could improve safety considerably. The banks may say it’s the hidden security measures that count, but to have real confidence in an online account, customers need to see security in place.'
The visible security measures rated
For more, read our guide and tips to staying safe when banking online
How to follow the latest Which? Tech news
Are you a Twitter user? Follow WhichTech on Twitter for regular tech tweets.
Prefer RSS? Don't miss a thing with the Which? tech RSS feed.
For just the main headlines in newsletter form, sign-up to our weekly Which? tech email.
Apple iPad 2 3G data plans compared - find the best 3G plan for your iPad
Best Android tablets round-up - we look at the best iPad alternatives around
Best cheap laptops for under £500 - find the best laptop deals