Bank security and email accounts

Murmansk

Given that emails are not a very secure method of communication it seems to me that there is a significant security risk in the way in which, if you were to forget your internet banking details, your bank might send you a link via email to change your login details.

If someone had been able to hack into your email account they'd presumably be able to get hold of the link sent by the bank and get into your account.

I suspect most people don't have a particularly secure email account - a lot might not even know their password and I'm sure the majority don't use two factor authentication or any extra security.

We never seem to hear this mentioned in advice given out re bank fraud and how to avoid it - I wonder if this is because it's not actually as great a weakness as I suspect or that they've decided it's too "techy" for anyone to be able to understand it or do anything about it?

Ergates

Murmansk wrote: »

I wonder if this is because it's not actually as great a weakness as I suspect or that they've decided it's too "techy" for anyone to be able to understand it or do anything about it?

Mainly the former. Whilst emails can be "hacked" and intercepted - it's more effort than the average fraudster is willing to put in. It's most definitely *not* the weakest link.

There is probably also an aspect that email security isn't the bank's direct responsibility.

Chino

Murmansk wrote: »

it seems to me that there is a significant security risk in the way in which, if you were to forget your internet banking details, your bank might send you a link via email to change your login details.

Would you care to name some banks that do this?

For example, in the case of Barclays, if a customer forgets their online banking passcode then:
"You can re-order your passcode online by clicking the 'Forgotten your passcode?' link (by the passcode field) on the log-in page, but for security reasons we have to send this to you in the post. You can also request a new passcode in branch, but this will also be posted out to you. Please note that you can only order a passcode once in 7 days."
https://www.barclays.co.uk/help/online-banking/login/forgot-details/

spenderdave

Murmansk wrote: »

Given that emails are not a very secure method of communication it seems to me that there is a significant security risk in the way in which, if you were to forget your internet banking details, your bank might send you a link via email to change your login details.

If someone had been able to hack into your email account they'd presumably be able to get hold of the link sent by the bank and get into your account.

Possible if you are talking about Web Mail but unlikely if you access your emails via an email client and POP3 as then the original emails won't be online and will be deleted from any online version once you have downloaded them. That in itself is an important difference between Web Mail, often indeed with poor security, and POP3.

Takmon

Murmansk wrote: »

Given that emails are not a very secure method of communication it seems to me that there is a significant security risk in the way in which, if you were to forget your internet banking details, your bank might send you a link via email to change your login details.

Even if they do send you an email (which i don't know many that do) I've never known one to send a link you have to click on. They may send email you a code you have to enter while resetting your details online but they will also ask for things like DOB, Card number and possibly other details.

No bank will just rely on sending a link in an email to reset your details. Your probably thinking of if you forget your password on a site like this forum and you get sent a link because it's not that important if it's intercepted.