Halifax Online Security Problems going back to 2011

Neptune

I've been busy so just read the weekly email about the Halifax security flaw.

I emailed MSE back in July 2011 when I was was getting some unexpected results when logging in during the early hours of the morning during the Halifax overnight update process.

In brief I could see other peoples account information, despite being logged in as me to the Halifax Online banking system.

Here's the original email I sent to MSE in July 2011:

"Hi,

I thought you might be interested in this.

I am a HBOS customer and I use online banking. At the end of June I noticed something strange. During the overnight updates, which seem to take place between 2-4am (when apparently they cannot show my account numbers, they use an old style roll number instead).

However during this time I get to see the account name aliases of other accounts! I have loads of screen shots of this behaviour, and a little video too.

Each time the statement page is refreshed I get to see a new alias.

I have contacted Halifax by phone about the issue on numerous occasions now and in writing too, they keep telling me in that condescending way that large companies do, that they are a large bank and nothing can be wrong with their systems. They just returned the letter to me.

I woman however did tell me (a Ms. Sharon (maybe, Susan) Brady, from Halifax customer services) that she didn't doubt me and was aware of this happening before, that was week ago and it continues to occur. She arrange for me to be sent the usual 'tick box' list of things to check, correct and updated browser, empty cache etc. I jumped the hoops to keep them happy, but no further response and the issue persisted.

Attached are two such screen shots of the issue (this shows the issue hopefully so you get a better understanding of the issue - I have redacted my personal info). These are for 'Steps Recruitment' and 'Carlos'.

This clearly shows something is not quite right with the HBOS online banking system during the update process. This behaviour ceases as soon as the updates are complete and account numbers are able to be displayed on the initial account screen.

I've held off putting this in the public domain, but Halifax seem

Today I have had MY online access suspended so now I can't bank. But no one seems to know why or what is happening. Other HBOS account holders can login in. It would be interesting to know if other Halifax customer experience the same thing during the overnight update process."

I even sent some screen shots with the info redacted from some of the accounts I could see.

Never heard anything back from MSE and had my OWN account suspended by HBOS.

What I would say is TSB uses the Halifax systems (as they used to be part of HBOS) and those systems demonstrate some interesting behaviours too. I moved to TSB within the last month, both personal and a limited company account. I had problems the other day rang their CS, eventually was told the problem was because I was logged in to my business account using my personal account details....... the only problem being the business account wasn't setup?

I note that TSB systems will be down this weekend along with the Halifax systems (No ATM, online, telephone banking etc) One can only assume as TSB piggy backs the HBOS systems that TSB was affected too?

agrinnall

Neptune wrote: »

I note that TSB systems will be down this weekend along with the Halifax systems (No ATM, online, telephone banking etc) One can only assume as TSB piggy backs the HBOS systems that TSB was affected too?

Many (most) banks' systems will have some down time this weekend for the clock change.

Westie983

TSB has never been part of HBOS, Halifax + Bank of Scotland = HBOS.

Lloyds and Halifax are now part of Lloyds Banking Group (LBG) and TSB are not part of LBG.

TSB was part of LTSB, and they are now a separate bank away from Lloyds.

As for the downtime this is due to the clocks being changed and that is why most of the banks will have a online restriction this weekend.

colsten

agrinnall wrote: »

Many (most) banks' systems will have some down time this weekend for the clock change.

Westie983 wrote: »

As for the downtime this is due to the clocks being changed and that is why most of the banks will have a online restriction this weekend.

You two have a way to destroy the best conspiracy theories

Neptune

I dare say many will, however Halifax are taking their systems down to fix security issues. It is also true the TSB systems are down for exactly the same times.

Neptune

You are right in saying TSB are no longer part of LBG. HOWEVER, their systems piggy back the Halifax systems. This is a legacy issue from the Halifax / TSB both being part of LBG.

There are two reasons I say this.

1.) The Halifax and TSB call IVR systems are the same system. The online banking systems are the same systems (layout, ordering of account etc).

2.) TSB themselves will confirm that that are piggy backing / using a halifax system clone. But are in the process of moving to completely new and unlinked systems.

For those of us that use Halifax systems the move to TSB systems is like using a near perfect clone, save logos and colour schemes, even the paper statements are the same! Even the online banking login security requirements and flow are identical.

The following article from May 2014 confirms the use of Lloyds systems by Halifax:
http://www.theguardian.com/money/2014/may/30/halifax-lloyds-banking-online-security-hacker
In the article is the following: "But Halifax insists its security systems (shared with Lloyds) are robust."

This article is from 2012: http://www.mirror.co.uk/money/personal-finance/halifax-and-lloyds-tsb-customers-hit-1362464

And the following article from September 2013 illustrates their interconnectedness: http://www.thisismoney.co.uk/money/saving/article-2410108/What-happen-money-Lloyds-TSB-splits-up.html

In short Halifax and TSB (Lloyds TSB), were both part of LBG but LBG were forced to sell TSB after they rescued HBOS. When LBG saved HBOS they migrated the HBOS systems into the Lloyds TSB systems, then TSB when it was sold continued to use the same systems the following is from a 2012 article "A major part of the integration from an IT perspective was the migration of Halifax and Bank of Scotland customer accounts and data to the scaled Lloyds TSB platforms, and this was successfully completed in the third quarter.". The full article is here http://www.computerworlduk.com/news/infrastructure/lloyds-banking-group-completes-immense-halifax-system-migration-3339958/

Neptune

Westie983 wrote: »

TSB has never been part of HBOS, Halifax + Bank of Scotland = HBOS.

LBG bought HBOS ergo LBG contained Halifax and Lloyds TSB, LBG was then forced to sell-off Lloyds TSB, which became plain old TSB.

TSB are 'No Longer' part of LBG, but use their systems.

Westie983

Neptune wrote: »

What I would say is TSB uses the Halifax systems (as they used to be part of HBOS)

I know that TSB before they were sold were part of the Lloyds group but they have never been part of HBOS which was my point.

I made no comment about the system platforms and the similarities as I am also aware they are the same due to the LBG uniformity.

Thanks for the links though, they have nothing to do with my comment, which was TSB have never been part of HBOS, they were part of Lloyds TSB.

GingerFurball_2

Neptune wrote: »

Westie983 wrote: »

TSB has never been part of HBOS, Halifax + Bank of Scotland = HBOS.

LBG bought HBOS ergo LBG contained Halifax and Lloyds TSB, LBG was then forced to sell-off Lloyds TSB, which became plain old TSB.

TSB are 'No Longer' part of LBG, but use their systems.

TSB don't use Lloyds systems. They use their own systems which are nearly identical - there are some subtle differences in newer systems such as mobile banking (more functionality in LBG compared to TSB.)