Tuesday, June 2, 2009
Intuit Buying PayCycle for $170 MillionSecurity Top Concern for Online Bankers
Editor's Note: Had you not yet noticed, today is kindova "What's Wrong with Online Banking day" at the PIN Payments News Blog.Today's theme is the lack of security attached to online banking and how easy it would be to fix it by adding the missing piece to the puzzle.
There's been so much news lately regarding phishing, XSS attacks, what-have-you, that it will be easy to populate this blog with stories that are no older than 3 days old... stories which "clearly" evoke the message that it's time we start doing things differently.
There will be several posts today concerning online banking.
Here's one from the Beijing Morning Post.
ITWeb :Security top concern for online bankers
The Beijing Morning Post in conjunction with iResearch, recently conducted a survey on consumer attitude toward the use of online payments, says People's Daily.
The survey result shows security is still the main factor that netizens take into consideration when making online payments, with 66.3% of all users surveyed considering security the most important thing when it comes to the use of online banking.
The survey indicates that 79.2% of participants currently use online banking services, while 8.46% used online banking services in the past but no longer do.
American Banker Reports the following:
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u_dK8JEg4fHaOkoOLZEVVHObt9daFgG3fNobJxcuJ3doXA_L_uq5Fjvu1O2jYKq9eGWlYS2vTL9wcQuU_rAGHV0imHJHqUNtePqX4k9EcpViOeBScREluAakE0juAv9oBtBl0Fh8eEXq8ztgk_LbZa=s0-d)
Fraud Standing Firmly in the Way of Online Banking
In my ongoing onslaught of recent stories about the lack of security involved with online banking, and the repercussions of such, I bring you this story from yesterday's Crains Manchester. BTW: This is just the beginning of the fallout. It will get worse and more people and more businesses will pull back from online banking because of security fears. Just read today's postings if you disagree. Or at least read between the lines.
There's only one way to secure financial transactions and that is outside the browser space.
It's what we at HomeATM do. We're the FIRST and ONLY company in this whole wide World to design, patent and manufacture a World Wide Web PCI 2.0 Certified PIN Entry Device.
More Good News for Financial Institutions: We've got our cost down to the point whereby you could "give it away." The ROI could be as little as 30 days. Want to find out more? I'd be happy to show you how our device can not only provide ehance login security with 2FA, but also enable your online banking customers to securely pay their bills, transfer money, and make secure E2E 3DES Encrypted, Protected by DUKPT e-commerce transactions.
Fraud fear turns firms off online banking - Crain's Manchester Business
Fraud fear turns firms off online banking
By Michael Fahy
Greater Manchester's businesses are rejecting online business banking because of the risks involved, according to accountancy firm Saffery Champness.
The firm said the risk of online banking fraud, which increased by 132 per cent last year to £52.2m according to industry association Apacs, is putting SMEs off from using online account facilities, despite being encouraged to do so by the high street clearing banks.
“Bosses are suspicious of online banking because this key control is often unwittingly removed when access to online facilities is delegated to another person,” said Simon Kite, a partner in the Manchester office of accountancy firm Saffery Champness.
“The shocking thing is that banks will only compensate a business for losses if the directors can show the bank has been negligent with its online banking facility.
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_toto82CVJ24FbFuNLnB71r_WCZVxjGgd2T_I-Zi8qsviyMMvPzzKc1vNGPvFcLtIkOhMTQZR8I__aK8uzjnC7dqf6JPPBdJfkkyMtzx3ODpw0UVOsSw5TIfhVVEySZ5q_mK3jHTupjLB6LyIxl60_7=s0-d)
Down Goes HSBC - ATM & Online Banking Systems Fail
HSBC has launched an investigation after systems failed at the weekend leaving customers unable to withdraw cash from ATMs. Online banking was also down."HSBC would like to apologize to those customers that were affected by issues relating to its ATM network over the weekend. A full investigation is currently underway to establish the main cause of the problem," said HSBC.
One reader said when he tried to withdraw money from a Lloyds ATM he was greeted with the message "Unable to perform this function, please contact your card holder."
When he contacted NatWest he was told he had exceeded his daily card limit. Fearing he had been defrauded he tried unsuccessfully to go online. He telephoned HSBC and was told all HSBC UK customers were unable to access their funds electronically and that it was working to fix the problem.
HSBC said the investigation could take several weeks.
Continue Reading at ComputerWeekly.com
Something Phishy About Not Using PCI Certified 2.0 2FA for Online Banking
Something Phishy About Bank's Not Using 2FA from HomeATM
Researchshows that most online banking sites have inbuilt flaws which couldpotentially put valuable customer data into the wrong hands. Now there is a way (since March 17th, 2009) to vastly increase the security of online banking.
HomeATMengineered AND manufactures the world's FIRST and ONLY PIN Entry Devicesolely designed for online authentication and eCommerce to achieve PCI2.0 certification. What that means is:
Banks now have achoice. They can use what many consider to be a very obsoleteUserName/Password login OR they can provide a methodology which safelyand securely authenticates their online banking customers withtwo-factor authentication.
Logging on to a bank's online banking site is now quick/convenient and easy.
Bank customers would simply swipe their bankcard through HomeATM's SafeTPIN device and enter their bank assigned PIN.
HomeATMis proud to introduce the security of "True" 2FA (two-factorauthentication) to the online banking community AND provide the impetusfor banks to procure more online banking customers via the allure ofthe most secure online banking platform in the industry.
I don'tmean to oversimplify how easy it would be for a financial institutionto implement "True 2FA" with HomeATM's device, but it's unavoidable.
- Phishing attacks are costly:
According to research firm,Gartner, banks, online payment organizations and other financialinstitutions are bearing most of the financial cost of phishingattacks. (A survey of nearly 4,000 US consumers revealed a 40% increase in the number of phishing victims in 2008 over the year before to five million.)Guess what? The HomeATM "SafeTPIN" device would not only eliminate "phishing attacks" but it would also eliminate the threat of "cloned cards," "cloned bank sites", AND provide "True 2FA." for online banking customers.
The average loss was $350 per phishing attack, but consumers said they had recovered 56% of their losses from the financial institutions involved. (That's $196 to the banks and $154 to the consumers) "The findings underline the fact that the war against phishing is far from over," said Avivah Litan, analyst at Gartner. (Yes, the very same Avivah Litan who says "never" enter your PIN on the Internet unless it's hardware based)
Additional benefits include empowering online banking customers with the ability to perform:As I said, I don't mean tooversimplify WHY they banks should investigate our solution further,but sometimes the simplest things in life are the best...aren't they?
- Person to Person Money Transfers,
- Bill Payment Online (with "True PIN" vs. PINless Debit)
- Secure online transactions with online retailers.
In closing out this week's edition of the PIN Payments News Blog, 'll state one more "food for thought" item.
According to a trustworthy source, Bank of America spent $129 Million on PCI DSS compliance last year.
Now I'm not saying that our SafeTPIN device would eliminate the entire cost of PCI DSS compliance, BUT...on account of how we are "already" PCI 2.0 PED certified, any bank that utilizes our device for "True Two Factor Authentication" during the log-in process, would effectively be removed from the scope of PCI DSS requirements.
- at least for their online banking application
- and Bill Pay
- and online eCommerce Transactions
- and Money Transfers
So...to anybody out there that knows some high level banking executives...pop me an email and let's talk.
I'll make you some serious money, save the bank's some serious money, enhance the banks' image AND provide consumers with the peace of mind knowing that their financial information is secure!.
Consumers fear financial security threats more than the threat of a terrorist attack (see graph on left)
Here's a quote from: Convenience or Security? How About BOTH?
American's "DEFINITELY" want security.
Infact American's worry more about credit and debit card fraud than theydo about a terrorist attack...according to a new report from Unisys.
Oh...andin quantity, our device costs about 10% of what it currently costsbanks and consumers for each "phishing incident." Simple...ain't it?
Nothing Phishy About PCI 2.0 Certified Cardholder Present 2FA!
Nothing Phishy About PCI 2.0 Certified "Card Present 2FA"
Attn: Banking Institutions: The phishing problem can be immediately solved with "Card Present" Two Factor Authentication. And two of the steps are already in place.
1: Bank issues Card,
1: Bank issues Card,
2. Bank Issues PIN,
3. Bank Issues HomeATM's iSwipe. ($12.00...less in quantity)
A: Customer Swipes Card
C: Log-in authenticated, phishing problem solved.
Description:
The growing popularity and success of Internet banking has brought on unprecedented attacks from gangs of well organized cybercriminals, according to AIB today.
For example, the number of phishing attacks on AIB in April 2009 surpassed the total number experienced in the whole of 2008, it said.
Online banking is growing in Ireland with AIB's Internet Banking service showing continued growth with over 570,000 customers (up 18pc) now regularly banking online. The number of transactions completed online also continues to grow strongly (up 27pc) in 2008.
HomeATM eliminates phishing attacks completelybecause the user MUST authenticate themselves by 1. swiping their bankissued card and 2. entering their bank issued PIN. So even if thephisher obtained the Primary Account Number (PAN) and the Personal Identification Number(PIN) they would still be unable to log-in without physically swipingthe card. (Editor's Note: It is highly unlikely anyone could obtainboth the PAN and the PIN, I just use that to demonstrate how secure our2FA log-in is. It's not only two-factor-authentication,it's "card present" 2FA. What the world needs now is "Card Present ina Card Not Present World." It really is that simple. See "Something Phishy About Bank's not Using Card Present 2FA"![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sMxfpe-K3-YWv1srhuPSUdVZhDOS7bM3avDxqrfYvWtZqvwBW8G7jS_-bsvBbrq41seCFSJWYXh1yQQZgImS4WamxMO0z7Lp_tTdoL8fw1VmcOAP_wLcIqZk2jx26AxtxxjCb5tSMmxoz7P_oCwz9t=s0-d)
Online Banking Phishing Scams (since Saturday)
Phishing Scam Target: Veneto Banca Italy Customers
21 reports:
| Commonwealth Bank of Australia | 30th May 2009 |
| Urgent Notification | |
| |
| Cahoot Bank | 30th May 2009 |
| Cahoot Internet Banking Security Information | |
| |
| Cahoot Bank | 30th May 2009 |
| FRAUD VERIFICATION PROCESS - It's All About Your Savings | |
| |
| Commonwealth Bank of Australia | 31st May 2009 |
| Important message from the Commonwealth Bank! | |
| |
| Egg Bank | 31st May 2009 |
| You Have One Unread Message On Your Online Banking Account | |
| |
| Bank of America | 31st May 2009 |
| Bank of America Alert: Important Message Alert! | |
| |
| Commonwealth Bank of Australia | 31st May 2009 |
| Customer Satisfaction Survey. | |
| |
| PayPal | 31st May 2009 |
| Paypal Member Notification | |
| |
| Cahoot Bank | 31st May 2009 |
| Cahoot Bank-Your Account Is Temporarily Suspended | |
| |
| Alliance and leicester Bank | 1st June 2009 |
| 2009 Alliance and leicester CUSTOMER SERVICE MESSAGE | |
| |
| Alliance & Leicester | 1st June 2009 |
| IMPORTANT ANNOUNCEMENT | |
| |
| Egg Bank | 1st June 2009 |
| Online Security Update | |
| |
| CIBC | 1st June 2009 |
| Notification | |
| |
| Lloyds TSB Bank | 1st June 2009 |
| Your Online Banking Service Could Be Suspended. | |
| |
| PayPal | 1st June 2009 |
| PayPal Email ID PP4896 | |
| |
| Alliance and Leicester Bank | 2nd June 2009 |
| Customer Notice: Your Account Security. | |
| |
| Egg | 2nd June 2009 |
| Egg Card Security Message | |
| |
| Abbey | 2nd June 2009 |
| IMPORTANT SECURITY NOTICE - Together We are Stronger | |
| |
| Commonwealth Bank of Australia | 2nd June 2009 |
| You have one unread message | |
| |
| Bank of America | 2nd June 2009 |
| Digital Certificate Updating Procedure | |
| |
| AOL | 2nd June 2009 |
| Important: Billing Confirmation 331858* | |
| |
To see the Top 100 Phishing Scams from May 15-30th, click here
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vsAGW12EQHfsm9OaZSLoiBMW7LXc4zlsASa9Wpb7onsurrny9BLTzNa8ShVmTDOiN0QJOCWaaipVp4a5aAGVjdelaUBNXoIMbYqo3_emLzS677_NUgyOQOJGgYXkLdUxWSCU9sUGoIia5T18FsbyPI=s0-d)
Latest Trojan Steals Login Before Bank Website Can Encrypt
Editor's Note: Look what came across my desk AFTER I decided to dedicate a day to the perils of online banking! I've said all morning, Don't Type, Swipe, but naysayers are like, "C'mon, if it wasn't safe, then why would they be doing it that way? To which my reply is a chuckle. Because it's convenient! That's why. May I humbly suggest, I'm Right, they're Wrong, and everyday there's more evidence that the missing piece to the puzzle is HomeATM.
The Latest Incarnation (Trojan) Can Steal Internet Banking Login Information Before the Bank's Website Can Encrypt It.
Editor's Note: Yeah, because you let your customer "type" in their login information. If your customers "don't type" the hackers "can't swipe." Fortunately, your customers can. An exponentially better approach to authenticated log-in. "Swipe" the "bank issued" bankcard, and then securely enter the "bank issued" PIN. The cardholder data is instantaneously "encrypted" (meaning it's never in the clear) so the hacker can't get to it "before" it's encrypted. With HomeATM you are in the clear, because your data never is. Today's theme... "onliine banking is so weak it's time they showed the strength to admit they were wrong" continues...
June 2, 2009
Trojans target online banking
| By Tan Weizhen |
THE big Singaporel banks - DBS, OCBC and UOB - have once again beentargeted by the latest trojan horse computer program, which trickscustomers into revealing their Internet banking passwords.
Late last month, banks were alerted to the trojan, which could gain scammers access to customers' accounts.
UOB Bank warned on its website that scammers may be able to'make unauthorized funds transfers within a short period of time.'
DBS Bank had reportedly more than a million Internet bankingcustomers as of last month. The other two banks declined to reveal howmany they had.
The three banks last came under attack by trojans - computerprograms infiltrating users' computers - in December, but this latestincarnation can steal Internet banking login information even beforethe bank's website can encrypt it.
Continue Reading
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vsRQrGrzlgwl8O_lEK_MA3PM8Z7Isqp-Z_DRn8ITWXVZ2Fyrd2S8lCcaUCyBAKY4lu0qau8fnGu5Jr5cbwqLkAyity_1CL4CRhTOSKxFlDj70yDCVD_rAbWoNObR7m7rlFSvjM-giV3iQOlENAz0av=s0-d)
28% of Chinese Consumers Reduced Online Banking on Security Fears
Study: Fearful Chinese Cut Online Banking
Cardline Global | Tuesday, June 2, 2009
Nearly28% of Chinese consumers have reduced their online banking and paymentactivities over fears that their personal information could becompromised, according to a report last month by iResearch Consulting Group.
TheBeijing research company found that 63% of consumers said they arebeing more careful about using the Internet for financial activitiesand 3% said they no longer do any banking or shopping online.
However, 18% of respondents said phishing activities and other online scams have had little impact on their financial habits. The research firm surveyed 2,328 consumers in March.
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tg2fC9VOQs6QSTjhj4C0-SLBaBNnaWG9EYIbjpm0vD-oVrf9q1BeK9DQ3_ojtrEnce8jFUvTH2RHj1MRnXMj7BCt6lAR52LvQuqcWoZG_f0M6VU45YfbJOvPBU4n_jWCCmMLAB61uvAYG5s0fk3E5q=s0-d)
Costin: Online Banking Needs More Defense Against Phishing
Kaspersky - e-banking Needs More Defense against Phishing Attacks - SPAMfighterChief Security Expert of Kaspersky Lab EEMEA, Costin Raju, claims that out of the thousands of Trojans discovered by Kaspersky Lab daily, 1/3rd attack e-banking.
Costin further adds that banks should provide more protection to their customers against these Trojans. (Editor's Note: I would further add the it's "Costin" the banks $350 per phishing attack)
At the ITWeb Security Summit held in Midrand (South Africa) on May 26, 2009, Raju states that malware has tremendously augmented for the last few years, causing a severe trouble as security firms could not raise the number of analysts.
Despite the fact that banks worldwide are coping with the economic slowdown, Raju says that this is not the time for them (banks) to reduce their security resources regardless of gloomy economic forecasts and cash flow issues. He says that though security expenses have minimized, online financial dealings are not reducing.
Banks have lessened their physical security expenses in today's economic slowdown time and it alarms Raju that online security will also follow the same trend. IT security estimates between 5% and 12% of the whole IT spend. As the IT expenditure comes down, security also suffers along with everything else.
The closure of many international financial institutions has also aggravated the trouble and carried it with a latest ambush of phishing attacks. Raju states that customers, who are unsure about whether their
funds invested in one of these institutions will be paid back or not, are prone to become victims of these phishing attacks. These customers are more likely to reply to phishing mails claiming they will not get
their money back if they do not furnish their online information within 1 day.Hence, Raju recommends that banks should be frank with their customers and not only accept them (attacks) but also provide suggestions and guidelines to curtail these dangers.Some other security experts also acknowledge that this is one of the methods hackers use to make money. They employ malware to trace passwords typed through a keyboard, phish for private account details and finally redirect online banking customers to fake sites made to gather login and password information.
Further, Trojans also employ screenshots, taking each mouse click on the virtual secure keyboard. (oops, does that mean that a "floating PIN Pad" which uses "mouse clicks" is not* safe?) * denotes sarcasm
Editor's Note: Let me "B. Frank" with the online banking community. If your customers "don't type" the fraudsters "can't swipe." The only one's doing the "swiping" will be your customers, and that's okay! Because when "they" swipe, the data is never in the clear.
End Result? HomeATM eliminates phishing, eliminates the threat of "fake sites" (or official looking sites) and your customers are in the clear...not their card data. Got IT?
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_s6t8prKVLDH1W0M-QJ6R5YlD3a57jb36Bz-UBJpZGdV93U-zE4rRExPMOXMTAR7NppXCwAQ2bPimmHxINjnxaTII7Ufg4oUn7NKMU3yoB1_CrcjvAf7EL8TK5UXfT8rkMTc423M_YqWwK-bG1mgTE=s0-d)
Clearly Puzzlin' Evidence
CommBank cops sustained online fraud attack - Security - Technology - smh.com.au
Asher Moses
June 2, 2009 - 3:25PM
Commonwealth Bank customers are being inundated with phishing attacks, some at a rate of several scam emails a day, sent by cyber criminals seeking to steal passwords and credit card details.
The scammers, who are specifically targeting the bank in a sustained assault, are bombarding customers with several clever variations of the email ruse - such as using bogus call centres - in an attempt to hook even tech-savvy web users.
The emails have largely managed to evade spam filters using methods such as images instead of text.
Commonwealth Bank spokesman Steve Batten said the bank was working closely with the Australian Federal Police's Australian High Tech Crime Centre to track down the scammers. However, the bank appears to be losing the war.
"As soon as we close them down they are opening up elsewhere," Batten said.
This is backed up by figures from the Australian Payments Clearing Association, which reported a 33 per cent increase in both the volume and value of fraudulent online payments in Australia for the year ended December 31, 2008.The scam emails, which look authentic and include the Commonwealth Bank's logo, try to trick the victim into handing over sensitive information by telling them they need to unlock an account, activate a card, claim a fee refund, update internet banking details, view an important security message or complete a survey in exchange for payment.
When the victim clicks on the link in the email, they are either infected with a password-stealing virus or presented with an official-looking page that asks them to enter their details, which are then harvested by the fraudsters.
Continue Reading
Editor's Note: An "Official Looking" page is officially "USELESS" if banks "required" their customers to "Swipe" their "bank issued" card and Enter the "bank issued" PIN.
Banks wouldn't be "losing the war" they would be closing down the "Phisheries."
With HomeATM's PCI 2.0 Certified PIN Entry Device, the card holder data is NEVER in the clear.
End Result: Our SwipePIN device eliminates the threat of "phishing" it eliminates the threat of a "cloned website" (i.e. "official looking page") and it enhances security for online banking with 2FA, 3DES E2E Encryption protected by DUKPT.
I'm relatively "puzzled" as to banks don't see this as clearly as hackers see cardholder data.
XSS Hits Barclays & HSBC
Plague of web bugs descend on British sites • The Register
Continue Reading at The Register UKPlague of web bugs descend on British sites: HSBC & Barclays bitten
Dan Goodin reports from in San Francisco
It's been a busy week for high-profile web vulnerabilities, with discoveries of careless bugs on the sites of three British companies.Online banking sites for HSBC and Barclays Group and the website for The Telegraph were caught with their pants down, as hackers published screenshots and other details that showed all three were susceptible to attacks that could compromise the security of people who visit the properties.
The XSS, or cross-site scripting, errors on HSBC were still present on a variety of HSBC sites on Monday afternoon California time, some 48 hours after the XSSed blog first reported them. The bugs allowed attackers to inject javascript and content into HSBC websites simply by tricking a user into clicking on a specially manipulated web address.
"Malicious people can exploit these bugs to conduct phishing attacks and infect bank customers and site visitors with crimeware," the blog warned.
Subscribe to:
Posts (Atom)