Sign in Subscribe
Banks (Finance)

Online Banking Security Flaws Exposed: Which? Warns of Worrying Fraud Risks

Strategic Insights

— 1 min read

A recent investigation by Which? found that online banking customers are being left exposed to worrying fraud risks, with several major current account providers failing to use the latest protections for their websites and mobile apps. The consumer group urged banks to "up their game" and take greater measures to safeguard customers' accounts. A security test conducted by Which? in collaboration with experts 6point6 evaluated 15 major current account providers on criteria such as encryption, login, and account management. The results revealed several alarming flaws, including the use of unsecure passwords and texts to verify customers' identities.

Key Takeaways:

  • Six banks - HSBC, NatWest, Santander, Starling, the Co-operative Bank, and Virgin Money - allowed customers to set passwords that included their first name and/or surname, posing a significant risk to account security.
  • NatWest, Virgin Money, and the Co-operative Bank have since agreed to phase out this practice, but HSBC still allows it.
  • Several banks - Nationwide, TSB, and Virgin Money - did not use software to block or quarantine spoof emails sent by scammers, potentially leaving customers vulnerable to phishing attacks.
  • TSB has introduced a fraud refund guarantee, while Virgin Money has implemented a system to prevent phishing attacks.
  • Metro Bank was ranked bottom for online security, while Monzo was ranked bottom for mobile app security, both of which are disputed by the respective banks.
  • Banks emphasized the importance of security, with many stating that it is a top priority and that they are continually investing in security measures.

Statistics:

  • 6 banks (40%) allowed customers to set unsecure passwords, including first name and/or surname.
  • 3 banks (20%) did not use software to block or quarantine spoof emails.
  • 5 banks (33%) had the most favourable online bank security scores, including HSBC, which scored five stars for website encryption and account management.
  • £801m was withdrawn from Post Office counters over the Christmas period (exact time period not specified).
  • Average house sellers in 2021 gained £95,000 more than they paid for their property (exact time period and data source not specified).

Sources:

  • Which?
  • 6point6 security experts
  • HSBC
  • NatWest
  • Santander
  • Starling Bank
  • the Co-operative Bank
  • Virgin Money
  • TSB
  • Metro Bank
  • Monzo
  • Nationwide
  • Lloyds Banking Group
  • PA Archive Online banking customers being left exposed to some worrying fraud risks, according to Which? (Picture posed by a model/Yui Mok/PA)

Read more