“Uncovering the Security Flaws in Online Banking: Examining the Results of Which? Expectations Study”

Some banks’ websites and apps lack security measures, which may leave “doors open” for scammers. Which? Expectations.

The consumer group, with the help of security experts from Red Maple Technologies, tested customer-facing security systems from 13 current account providers from September to November 2022.

Account providers were evaluated by looking at their processes for sign-up, navigation and sign-out, account management and encryption – for both their online banking security and their app security.

Virgin Money was rated the worst overall in the study for online and app banking.

A Virgin Money spokesman said: “The security of our banking services is our top priority and we continuously monitor, evaluate and improve our security controls.

“Some of the issues raised in this study relate to choices we’ve made to enhance the digital user experience while ensuring our robust, multi-layered controls to protect customer accounts remain in place.”

Which? said it also had some concerns about TSB, which received the second-lowest score for its app in the study.

A spokesman for TSB said: “We continue to invest in our online and mobile services – and work with world-leading technology companies to offer our customers both security and accessibility. TSB is also well positioned in the industry for fraud prevention, and we are the only bank that protects its customers with a money-back guarantee if they are ever the victim of fraud.”

The Nationwide Building Society received the second-lowest score for online banking security.

A Nationwide spokesman said: “Nationwide takes the security of its members and their funds very seriously.

“We are never complacent and conduct regular testing of our systems to ensure we maintain an adequate level of protection while maintaining a positive user experience.

“We take the points from which? on board as we continue to develop our digital services.”

In the meantime, which ones? states that Starling Bank has been placed at the forefront when it comes to online banking security.

Last year’s top scorer for online banking safety, HSBC UK did well again this year. HSBC followed closely behind Starling in online banking, while its app received the highest score.

Which? said the banks involved in the investigation also have systems behind the scenes that the consumer group and Red Maple Technologies have not been able to test.

In general, the consumer advocate said he would like improvements that would block weak passwords, and he also believes that sensitive data should not be sent via text messages as it could be intercepted.

If the worst happens and people fall victim to remote banking fraud, in many cases they are entitled to a refund from their bank.

Sam Richardson, Which? Money’s deputy editor said: “Banks should not leave these doors open for scammers to exploit and need to up their game to adequately protect their customers.

“With improvements like weak password blocking, banks can take an important step in preventing unscrupulous fraudsters from trying to steal money and personal information from consumers.”

A spokesman for UK Finance said: “The banking and finance industry is keen to prevent fraud in the first place and invest billions in advanced technology to protect customers.

“Our figures have shown that the number of unauthorized fraud cases recorded has been declining year on year, with the first half of 2022 recording a 7% decrease to nearly 1.4 million and banks recording unauthorized fraudulent transactions of £583.9m stopped.

“The industry continues to work closely with government and law enforcement agencies to target the criminal gangs responsible and continue their efforts to prevent consumer fraud.”

Here are five tips from which? for secure online banking:

1. If you receive an unexpected email, SMS, WhatsApp or other message, do not click on the hyperlinks in it.

Criminals posing as your bank might try to steal confidential information, trick you into sending money, and even create fake websites to impersonate banks and other companies.

Also, do not download attachments or call phone numbers. If you need to get in touch with your bank, call them on a trusted number, e.g. B. the one on your debit card.

2. Use up-to-date security software. This means downloading antivirus software on your computer, phone and whatever other devices you have.

It is also important to download and install the latest updates for the device itself. Updates include security patches for new vulnerabilities, so don’t use an outdated device.

3. Protect your mobile phone. Go into Settings to ensure your phone locks automatically after a short period of inactivity.

Disable lock screen notifications while you’re there to prevent criminals from seeing incoming texts that might contain bank codes to access your account.

You can also add a pin to your sim card to prevent access.

4. Check privacy settings on social media. Remove all personal information like your email address, date of birth, and phone number, all of which can be used by criminals to steal your identity or impersonate your bank.

Only accept friend requests from people you know.

5. Replace the default passwords on your home router. This prevents others from accessing it. Also, avoid relying on unsecured wireless networks or public computers.

If you use a public computer, never leave it unattended and always log off when you’re done.

Source