IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

UK banks outed on security

Major holes highlighted in online banking security

Several major UK high street banks have been forced to review the security of their customer web sites following the exposure of flaws on the Internet.

Heise Security, a publisher of security information for businesses, alerted its readers to serious security vulnerabilities in the customer-facing web sites of several UK banks.

It warned of methods that criminals could easily use to send phishing emails to users via the banks' sites, without banks ever being aware of any attack.

Heise claims it was able to prove that the web site security of NatWest, USB, Cahoot, Bank of Scotland, Bank of Ireland, First Direct and Link could be bypassed.

As a result of the published warnings, both NatWest and USB have already moved to improve site security, with others expected to follow suit.

Heise says that many banks are running vulnerable sites in spite of several years' worth of warnings about identity theft and phishing. It cited HSBC, Barclays and the Halifax as banks which passed its test.

Banks are now starting to take the issue of web security more seriously, says Alistair Newton, principal banking analyst with Gartner. "Banks are, for example, taking more care to authenticate the customers that come to their sites," he says.

"They realize that to be sure of customer's identity, they need more than just a user ID name and password. They now often add in the need for a one-time password generated by a token given to the customer by the bank."

He says security is important not just for banks to be sure of who is on their sites, but also for customers to be reassured that someone who has captured their name and password will still not be able to pose as them if they fall prey to a phishing scam.

"As always with security, there's no one solution that fits all problems," says Newton. "It's something banks will need to keep on updating. But of course if you have too many layers of security, then you start to put people off."

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?

Should you take your password manager off the internet?

28 Jul 2022