Online bank/mutual fund/brokerage accounts and electronic transfers make it easy to move money around. However, I've started to wonder a little about the security. Assume for the sake of argument that someone does gain unauthorized access to one of these online accounts. Is there any second line of defense to prevent the attacker from adding his/her account as an electronically linked account and almost immediately withdrawing all funds?
Although I do not know about US Institutions; In India Banks have adopted a mix of features that mitigate the risk. Some ways that are used are;
- Additional Token [RSA] while doing an online transaction.
- Funds Transfer to another account requires it to be registered. The registraiton process is completed only after keying in additional one time code sent on your registered mobile/email. The beneficiary is activated 24 hrs after addition. Alerts on change in beneficiary.
- The Mutual fund account only encashes into registered bank account, hence is less of a risk [except for buying to selling things you would not have wanted to]
- Seperate passwords for online loging in and querying and seperate password for carrying out a transaction.