Online banking

How many people of you do online banking?
I never have and -if possible- never will. I drive to the bank if I want to pay bills. When people ask me: you're a computer geek, software developer and system admin. How come you of all people don't use online banking?

To which my stock answer is: because I am a computer geek, software developer and system admin. :)

Honestly, there is so much shockingly bad security around that it is appalling, even in the banking business. My banking contracts all exclude online banking.

I online bank. I just don't have the time to go to the bank every time I have to pay a bill or transfer money somewhere. I just don't. So I online bank and it works fine for me. Besides that if a hacker cracks the bank then it's not my fault but the banks and I'll be insured for any monetairy values lost anyway.

I'm the same as you Bruno, I will never online bank. I think the security they have is atrocious!

And, having worked for a major retail bank in the UK and seen how lousy their IN BRANCH security is and how easily people can get past it, I have no intention of entrusting my money to their online facilities.

I hope to make it to a European get together at some point, so remind me and I'll tell you some of the stories as and when we meet. Some of them would make your hair go grey!

I do online banking, but at the moment I am student so the most money that is ever in my account is my rent check. I figure if someone is going to go through all the trouble of getting into someone account, its going to at least be someone with a little more money.

I'm confused about the driving to the bank to pay bills though. Can't you just pay via debit card online, the same way we pay for purchases from amazon or other sites? Unless of course I am being a naive student and larger bills require bank transfers or something.

Oh, and because I forgot to mention this is the above post but it makes me sound like I don't know what I'm talking about without it, I pay cable, power, and rent online. It is a pretty great deal.

That would still be 'online' banking :)

Btw, it's not just the banks security that worries me. Internet providers, web mail, etc... There are so many chinks in the armour that protection is impossible.

They don't care about how much money you have. Every 100$ counts. If you can harvest account information of 1000 people, and get 100$ from every account, that's still 100K.

Sure, you can get your money back. Eventually. -IF- it is the bank's fault. If someone managed a man in the middle attack or you got a virus that sniffs your keyboard, or you clicked on an emailed link to your bank (some of them are very authentic looking) it is -your- fault.

I go to the bank to deposit, but all my bills are automatic payment from my checking account. This saves me the trouble of having to remember the due dates, passwords to accounts and the headaches of late charges.

Quote:

---

Originally Posted by Bruno

That would still be 'online' banking :)

Btw, it's not just the banks security that worries me. Internet providers, web mail, etc... There are so many chinks in the armour that protection is impossible.

They don't care about how much money you have. Every 100$ counts. If you can harvest account information of 1000 people, and get 100$ from every account, that's still 100K.

Sure, you can get your money back. Eventually. -IF- it is the bank's fault. If someone managed a man in the middle attack or you got a virus that sniffs your keyboard, or you clicked on an emailed link to your bank (some of them are very authentic looking) it is -your- fault.

---

I online bank mainly because of the easiness and the additional charges if you pay at the counter. Seriously, it would be a called robbery if they wore masks and they were not a bank. Unfortunately still, they apparently have decided I need to pay for the transaction I make myself with my funds from my own bankaccount. Grrrr.

And security is kinda moot point since some poor sod might lose (or legitimately sell without smashing the drive) his laptop or usb-stick with unencrypted data there. There has been too many of these kind of breaches at least in uk. Fortunately not here yet.

The online security at my bank seems pretty tight. I get an email notice anytime a purchase or withdrawal is made from the account. Also, no online account transactions can be made without ringing my cell phone and waiting for code confirmation. I like having access to my account when I travel so I can pay bills while I'm away for extended trips.

I'm sure smart crooks can find away around all secrity features, but the alternative is not completely safe either. Getting statements in the mail, using a credit card, or just driving up to the bank all have risks greater than zero.

Still, I have never tried to convert anyone to online banking. I didn't want to be blaimed if something bad happened. I just feel like for me, online is better. (I feel less safe after reading Bruno's post. :o )

I do my banking online. Even if you go to the bank there's a paper trail, and your bank information is still entered into their databases. No matter how you bank you can be a target for malicious use.

We use a strong password and make sure that our bookmarks are all https:// when logging in.

Bruno, I'm surprised at your POV. Not doing online banking has no guarantee against your account being hacked. Sure, idiots out there use a weak password or fall for phishing scams, but the banks security itself if breached would allow a hacker to (in theory) get to your account from within. (Especially if you consider the fact that social hacking/phishing applies just as much to those who work for the bank and have access!)

I love online banking. I don't have to deal with incompetence of bank staff, I can do it at home or at work, I can transfer funds easily, and I can track and audit my own spending (read: my wife's spending).

Do you use an ATM card? Because the variety of creative scams, tools, and methods used means you personally are just as likely to fall for that as you are to fall for phishing. (i.e. if you're careful, you fall for neither. If you're not, you're as likely to fall for one as the other.)

Seriously, I don't get your view. It's accurate in it's understanding of how weak security is, but it falls short in appreciating that you already do it through ATMs, credit cards etc.

I would live in a van down by the river if I did not have online banking.

In Belgium, fraudulent withdrawals are refunded by the bank, no matter how the thief managed to get access to your account.

All banks now have a system that involves a little device that needs the physical presence of your bank account card. That's pretty secure, imho.

Someone with the right knowledge could possibly hack into the bank's network, and than they have also access to those accounts that don't use home-banking. The bank will still refund any possible loss.

There have been cases of bank card fraud In Belgium, where a gang used phony card terminals to copy the data on the card and film the person entering his secret code. Also in those cases, the victims were refunded.

You can keep your money in a stocking at the attic and hope you don't get robbed, or your house doesn't burn down. No bank or insurance refunds that.

I just had to charge someone €4,93 to be left with €3,80 after Paypal charges all their various fees. Now that's what I call theft. And I wonder what they'll refund if someone hacks their computers?

Quote:

---

Originally Posted by majurey

Do you use an ATM card? Because the variety of creative scams, tools, and methods used means you personally are just as likely to fall for that as you are to fall for phishing. (i.e. if you're careful, you fall for neither. If you're not, you're as likely to fall for one as the other.)

Seriously, I don't get your view. It's accurate in it's understanding of how weak security is, but it falls short in appreciating that you already do it through ATMs, credit cards etc.

---

I use an ATM card, but it only goes into slots where I can still see it, or bank terminals. If I enter my pin, I always cover my hand and the pin keypad.
I never use CC unless absolutely necessary (like in the US or on business travel) and then I monitor the bill closely.

Most banks here have ATMs inside that you can use to manage your banking transactions. Works like a charm, and is closeby. It's not that I would not use online banking if there was no other realistic option, but there is, so I don't.

If I use paypal, I always enter the url manually. I always transfer all > 100 euro amounts to a priavte bank account that only allows 1 way transactions. I also don't click on anything in a mail claiming to come from my bank. They know not to mail me.

Seriously, it's not like I singled out online banking and then forgot about the rest. I am careful with all transactions, and avoid as much attacks as I can. I also burn banking paperwork I don't use anymore.

Cost to benefit analysis says I online bank.

I don't have issues with security, I use Linux and OS X, so on my end things are fairly secure. On the bank's end I expect they are much more secure.

The only time I didn't bank online was when the bank was only supporting Internet Explorer, which was some years ago. And that bank does not exist anymore.

I do it online because all my funds are guaranteed by the bank. Since my bank was the second largest receiver of bailout funds, I know they can cover me.

today i tried in-branch banking. it turned out my atm card had expired few months ago so after the atm informed me of it i did banking at the counter.
they told me that to cancel the card that was automatically sent to me (and i hadn't noticed) and get a new one i will have to call the central customer service.
the branch couldn't cancel that card, and if they just ordered a new one i may get two new ones when i cancel it.

I online bank with my blackberry, worked fine so far....been about 5 years now.

Quote:

---

Originally Posted by Bruno

I use an ATM card, but it only goes into slots where I can still see it, or bank terminals. If I enter my pin, I always cover my hand and the pin keypad.
I never use CC unless absolutely necessary (like in the US or on business travel) and then I monitor the bill closely.

Most banks here have ATMs inside that you can use to manage your banking transactions. Works like a charm, and is closeby. It's not that I would not use online banking if there was no other realistic option, but there is, so I don't.

If I use paypal, I always enter the url manually. I always transfer all > 100 euro amounts to a priavte bank account that only allows 1 way transactions. I also don't click on anything in a mail claiming to come from my bank. They know not to mail me.

Seriously, it's not like I singled out online banking and then forgot about the rest. I am careful with all transactions, and avoid as much attacks as I can. I also burn banking paperwork I don't use anymore.

---

That does read like you're indeed very careful. But can't that same level of care be taken with online banking with the same effect?

Clearly you keep a lookout for those scanning machines that scammers fit to the front of an ATM. Clearly you take care to avoid line of sight to your keying in the code. (Both things I do as well.) You're careful with your CC though you rarely use it (but if you were to lose your wallet anyone can use your CC via the phone). Nevertheless, your due care and attention minimises the risk.

I don't see how those principles don't also apply to how you manage your computer(s) and therefore minimise the risk of online banking from your private computers?

Perhaps I'm missing something (in terms of understanding the ability of hackers), but I am personally more concerned about the risk of losing my wallet (either accidentally or being ripped off or mugged) than about the risks of online banking within the privacy of my own home.

I used to use on-line banking. But now I get paid in cash and I give almost all of that to my wife who pays the bills. I don't have to worry about banking on-line or otherwise.

Quote:

---

Originally Posted by majurey

That does read like you're indeed very careful. But can't that same level of care be taken with online banking with the same effect?

---

Yes, I could. At this moment, there is no need, since my bank is 5 minutes from here and has secure terminals where I can do everything. And since I also use the bank for getting cash, it doesn't inconvenience me to skip online banking, thus minimizing my risk as much as possible.

If or when I will have to use online banking, the banking sessions will run in a read-only virtual machine, firewalled in software to only allow outgoing connections, running connections through my hardware firewall. Said firewall would only allow outbound traffic from the virtual machine, and only to the banking domain (and windows update). I would also choose a banking setup that uses one of those RSA token or hardware authentication devices.

This is how I would implement it. And I would not fret over it either if I had to do it. I just believe in minimizing the attack surface as much as possible.

Quote:

---

Originally Posted by Bruno

How many people of you do online banking?
I never have and -if possible- never will. I drive to the bank if I want to pay bills. When people ask me: you're a computer geek, software developer and system admin. How come you of all people don't use online banking?

To which my stock answer is: because I am a computer geek, software developer and system admin. :)

Honestly, there is so much shockingly bad security around that it is appalling, even in the banking business. My banking contracts all exclude online banking.

---

I do 100% of my banking online. In fact, the only time a teller sees me is when I turn my coins into cash.

I bank online from my Mac. Just to pay bills.

I online bank, in fact, I switched banks earlier in the year and good online service was quite high on my list of things to look for.

Quote:

---

Originally Posted by Bruno

Yes, I could. At this moment, there is no need, since my bank is 5 minutes from here and has secure terminals where I can do everything. And since I also use the bank for getting cash, it doesn't inconvenience me to skip online banking, thus minimizing my risk as much as possible.

---

OK, now I get it. Seems like it's not too inconvenient to forego online in your case. In mine (with a 2-hour commute to work each way everyday), it's a godsend.

Quote:

---

Originally Posted by Bruno

or when I will have to use online banking, the banking sessions will run in a read-only virtual machine, firewalled in software to only allow outgoing connections, running connections through my hardware firewall. Said firewall would only allow outbound traffic from the virtual machine, and only to the banking domain (and windows update). I would also choose a banking setup that uses one of those RSA token or hardware authentication devices.

---

Again, something I may need to understand better... do you shop online with a CC? If so, why don't those stringent security specs not also apply?

Interesting thoughts. Online banking is nearly a must for me. Our banks around here close around 3PM... when you work until 3:30PM or later, that doesn't make things very convenient. I signed up for USAA banking so I can even deposit from home now, because I got tired of keeping checks in my wallet for weeks on end before I could get to a bank that was open.

My pay is direct deposit, my mortgage, and most bills are automatic withdrawal. If I've done things right the only checks I write are for local services (trash/sewer) where I have to mail the stub in with payment.

Internet buying is riskier than on-line banking.
When you give your credit card number over the phone or through the Internet, you don't know who is on the other end of the line.
How about paying with a credit card at a restaurant, store, etc?

Quote:

---

Originally Posted by Navaja

Internet buying is riskier than on-line banking.
When you give your credit card number over the phone or through the Internet, you don't know who is on the other end of the line.
How about paying with a credit card at a restaurant, store, etc?

---

The last time someone tried to steal money from my account was when some scum in London wrote down the number of my credit card, probably in one of the restaurants. His mistake was attempting to charge $400 for food in a Knightsbridge Indian bistro three months later.