UK bank customers are unnecessarily exposed to fraud and account compromise due to poor online security, according to new Which? study.
A consumer rights group commissioned Red Maple Technologies to evaluate the online banking websites and apps of 13 checking account providers from September through November 2022. The research covered four main areas: login, navigation and logout, account management, and encryption.
Issues found in testing include:
- Failure to properly block weak passwords
- Send one-time passcodes and other sensitive information via text message
- Unable to log out customer after 5 minutes of inactivity
- Allow access to your account from multiple web browsers/IP addresses simultaneously
- Sending customer notifications containing web links or phone numbers that look like phishing messages
Virgin Money came in at the bottom of the list with a combined score of 52% online and 54% in app. This test found six outdated web apps run by banks with potential vulnerabilities. According to Red Maple Technologies, the lender said he acknowledged three vulnerabilities and said these would be fixed.
Starling comes out on top with scores of 82% for online banking and 80% for apps. HSBC was a close second overall, with online banking sites scoring 80% and apps topping with 82%.
“It is essential for consumer protection that banking apps and websites use the strongest possible security mechanisms to protect their customers. Mobile apps offer the convenience of being able to quickly block and check transactions.” But we can’t sacrifice security,” said Rob Stemp, CEO of Red Maple Technologies.
“What’s interesting is that the newer app-based banks have a more comprehensive set of measures compared to some of the more traditional banks. From the bottom of my heart, I understand that you are often plagued with complexity within your IT estate and legacy systems at the core of your infrastructure.”
Losses from remote banking fraud fell 36% year-on-year to nearly £85m in the first half of 2022, according to industry body UK Finance.
