Human error puts online banking security at risk

Nov 07, 2007

Using an SMS password as an added security measure for internet banking is no guarantee your money is safe, according to a new Queensland University of Technology study which reveals online customers are not protecting their accounts.

Mohammed AlZomai, from QUT's Information Security Institute, said one in five online transactions was vulnerable to obvious attacks despite added security methods such as SMS passwords being adopted.

Mr AlZomai said the study had found that the security threat had more to do with the usability of the SMS system and human error, rather than any technical security problem.

"In response to the growing threat to online banking security, most banks have implemented special methods for authenticating a transaction," he said.

"A typical method is sending a one-time-password via SMS to the customer's mobile phone for each transaction.

"This means the customer must manually copy the password from their phone in order to confirm the online transaction."

But Mr AlZomai said customers were failing to notice when the bank account number in the SMS message was not the same as the intended account number.

He said if this occurred it was a clear sign hackers had infiltrated the system.

As part of the study, QUT developed a simulated online bank and asked participants to play the role of customers and undertake a number of financial transactions using an SMS authorisation code.

Mr AlZomai said he then simulated two types of attacks - an obvious attack which was where five or more digits in the account number were altered, and a stealthy attack which was where only one digit was changed.

"It is worrisome that obvious attacks were successful in 21 per cent of cases," he said.

"And when transactions faced a stealthy attack, 61 per cent of attacks were successful."

He said this study showed that a significant number of users were unable to identify the attack.

"This is a strong indication that the SMS transaction authorisation method is vulnerable," he said.

"According to our study only 79 per cent of users would be able to avoid realistic attacks, which represents an inadequate level of security for online banking."

Mr AlZomai said while this study highlighted the importance for customers to be vigilant when they were banking online, banks also had a responsibility to their customers.

"We hope this research will allow online banks and other online service providers to be better prepared for these emerging risks."

Source: Queensland University of Technology

Explore further: Twitter blocks two accounts on its Turkish network

add to favorites email to friend print save as pdf

Related Stories

QR codes pose internet security risk

Feb 19, 2014

Internet security experts from Murdoch University have raised concerns about the growing use of Quick Response codes, also known as QR codes.

Bringing the world reboot-less updates

Jan 24, 2014

It's an annoyance for the individual computer user: You've updated your operating system, and now you need to reboot. This is so the computer can switch to the modified source code.

WhatsApp storms to lead in online-messaging race

May 08, 2013

Its chief executive claims it has more users than Twitter. It's rumored to have just rebuffed a $1 billion buyout offer from Google. So what's up with WhatsApp? And how has a San Francisco startup that many Americans still ...

Recommended for you

LinkedIn membership hits 300 million

Apr 18, 2014

The career-focused social network LinkedIn announced Friday it has 300 million members, with more than half the total outside the United States.

Researchers uncover likely creator of Bitcoin

Apr 18, 2014

The primary author of the celebrated Bitcoin paper, and therefore probable creator of Bitcoin, is most likely Nick Szabo, a blogger and former George Washington University law professor, according to students ...

White House updating online privacy policy

Apr 18, 2014

A new Obama administration privacy policy out Friday explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites. It also clarifies that ...

User comments : 0

More news stories

Finnish inventor rethinks design of the axe

(Phys.org) —Finnish inventor Heikki Kärnä is the man behind the Vipukirves Leveraxe, which is a precision tool for splitting firewood. He designed the tool to make the job easier and more efficient, with ...

Making graphene in your kitchen

Graphene has been touted as a wonder material—the world's thinnest substance, but super-strong. Now scientists say it is so easy to make you could produce some in your kitchen.

Poll: Big Bang a big question for most Americans

Few Americans question that smoking causes cancer. But they have more skepticism than confidence in global warming, the age of the Earth and evolution and have the most trouble believing a Big Bang created the universe 13.8 ...