I'm sure this is a very broad question. I wanted to know your thoughts and possibly reading sources on

  • What are the top 2-3 ways that criminals conduct online fraud? IS there any data that I can look at?
  • What should a consumer know before opening a deposits account about what fraud avoidance techniques does the bank have? The call center people can't quite explain. Is there a source that shows data about fraud attacks/losses at bank and possibly benchmarks them based against the peers? Also, If I'm using a Visa/Master card there's some assurance given the large volume but for small bank that typically uses online/mobile banking, I wonder how they can protect against fraud.

I am aware that there are specialized companies and techniques for security and fraud. But it will be great to get set of links for the common man!


Much of what you're asking will not be disclosed for obvious security reasons, so don't be surprised when call center people say they "don't know". They may actually not know, but even if they did, they'd be fired if they were to say anything. Nothing could be a touchier subject than online security for the financial institutions.

I don't know of reliable sources for the data you're asking about, and I don't know the banks or other firms would release it. For a bank to talk about its incidence rates of fraud would be unusual, because none of these institutions wants to appear "less safe" than their competitors. If there's any information out there then it's going to be pretty vague. None of these institutions wants the "bad guys" to know what their degree of success is against one bank versus any other. I hope that makes sense.

The smaller banks usually piggyback their data on the networks of the larger financial institutions, so they are as secure (as a general rule) as the larger banks' networks they're running on. Also, your transactions on your credit cards are not generally handled directly by your bank anyway, unless it's one of the big heavyweights like Chase or Bank of America. All transactions run through merchant processors, who act as intermediaries between merchants and the banks, and those guys are pretty damned good at security. I've met some of the programmers, and they're impressive to me (I've been a programmer for 35 years and can't put a finger on these guys!).

Most banks require that you must provide proof of identity when opening an account, and that ID must me the standards of the "USA Real ID Act". Here's an excerpt from the Department of Homeland Security website on what Real ID is:

Passed by Congress in 2005, the REAL ID Act enacted the 9/11 Commission’s recommendation that the Federal Government “set standards for the issuance of sources of identification, such as driver's licenses.” The Act established minimum security standards for state-issued driver’s licenses and identification cards and prohibits Federal agencies from accepting for official purposes licenses and identification cards from states that do not meet these standards. States have made considerable progress in meeting this key recommendation of the 9/11 Commission and every state has a more secure driver’s license today than before the passage of the Act.

In order for banks to qualify for FDIC protection, they must comply with the Real ID standards when opening accounts.

As with any business (especially online), the most effective way to minimize fraud is vigilant monitoring of data. Banks and other online financial entities have become very adept at pattern analysis and simply knowing where and what to look for when dealing with their customers. There are certainly sophisticated measures which are kept carefully out of the public eye for doing this, and obviously they're good at it. They have to be, right?

There's no way to completely eliminate fraud -- too much incentive exists for the "bad guys" to not constantly search for new ways to run their schemes, and the good guys will always be at the disadvantage, because there's no way to anticipate everything anyone might come up with. Just look at online viruses and malware. Your antivirus software can only deal with what it knows about, and the bad guys are always coming up with some new variant that gets past the filters until the antivirus maker learns of it and comes up with a way to deal with it.

Your question's a good one to ponder, and I wouldn't want to be the chief of internet security for a bank or online institution, because I'd lay awake at night pondering when the call's going to come that we finally ran out of luck! (grin)

I hope this was helpful.

Good luck!

| improve this answer | |
  • Thanks so much for taking the time to write your response. – user9445 Jun 26 '16 at 1:47

I don't see why an online-only bank would need to do anything more against fraud than a bank that also has brick-and-mortars. In the contrary, they would need less (physical) security, as they don't have to protect cash, lock boxes, and other physical assets.

All banks nowadays have an online business, so they all have the same online fraud risks, and they all need the same level of protection.

| improve this answer | |

@ Daniel Anderson shared interesting insights. In my research I learned a few things

Some interesting data on fraud trends

AFP Payments Fraud and Control Survey 2016

As a consumer, at the very least I'd improve awareness of

  • AML
  • Multi factor authentication
  • 3d Secure
  • Setting up mobile alerts.

I'd also learn about basic types of fraud

  • Phishing by Email or Telephone
  • Malware : Through popups , email. Key loggers
  • Identity Theft : Someone opening account on your name
  • Money Mule : Get money from an illegitimate source, deposit in your account. Transfer
  • Social Engineering :False email on behalf of someone. Like you are a lucky winner but pay processing cost first or take part in a game or pay at a fraudulent site.
  • Card Cracking : Target teens for quick return on investments.

And for the techies out there, I'd recommend learning about layered security (There's no way the customer service is going to talk about this)

| improve this answer | |

There are Cyber Security and Reporting Standards which Financial Service Provider (Banks and Financial services where customers deposit and/or transact fiat currency)

You can find a comprehensive list on Wikipedia under Cyber security standards

Depending on the geographic location there might be local Govt requirements such as reporting issues, data security etc.

Concerning point 1. We have to differ between a fraudulent customer and an attacker on the banks infrastructure.

Fraudulent customers / customers that have been compromised by third parties are identified with but not limited to credit scores and merchant databases or data from firms specialized in "Fraud Prevention".

Attackers (Criminals that intend to steal, manipulate or spy on data) are identified/prevented/recorded by but not limited to IDS solutions and attacker databases.

For firms that get compensation by insurances the most important thing is the compilant with law and have records of everything, they rather focus on recording data to backtrack attackers than preventing attacks.

Concerning point 2. For you as customer the local law and deposit insurance are the most important things. Banks are insured and usually compensate customers on money theft. The authentication and PIN / TAN methods are most crucial but standard - these authentication methods consist of one password and one offline part such as a TAN from a paperletter or a RSA generator or card reader.


Financial institutions have to comply with local law and meet international standards. Banks use highly advanced Intrusion detection and fraud prevention which logically must be based on databases. For the average joe customer there is seldom high risk to lose deposits even if the attackers gains full access to the bank account but this depends a lot on the country you reside in.

Concerning targeted attacks:

  1. Clientside attacks on employees to rech in the network.
  2. Webapplication attacks.
  3. Serverside attacks.
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.