Most industries have deployed internet technologies as an essential part of their business operations. The banking industry is one of the industries that has adopted internet technologies for their business operations and in their plans, policies and strategies to be more accessible, convenient, competitive and economical as an industry. The aim of these strategies was to provide online banking customers the facilities to access and manage their bank accounts easily and globally.

Online banking, also known as internet banking, e-banking or virtual banking, is an electronic payment system that enables customers of a bank or other financial institution to conduct a range of financial transactions through the financial institution's website. The online banking system will typically connect to or be part of the core banking system operated by a bank and is in contrast to branch banking which was the traditional way customers accessed banking services.

Online banking has been deployed more frequently over the past few decades to support and improve the operational and managerial performance within the banking industry.

Threats to Online Banking

There are some information security threats and risks associated with the use of online banking systems. The confidentiality, privacy and security of internet banking transactions and personal information are the major concerns for both the banking industry and internet banking. Attacks on online banking today are based on deceiving the user to steal login data. Phishing, pharming, Cross-site scripting, adware, key loggers, malware, spyware, Trojans and viruses are currently the most common online banking security threats and risks.

The following are the major attack scenarios:

1. A credential stealing attack (CSA), is where fraudsters try to gather user's credentials, either with the use of a malicious software or through phishing.
2. A channel breaking attack (CBA), involves intercepting the communication between the client side and the banking server, by masquerading as the server to the client and vice versa.
3. A content manipulation also called man-in-the browser (MiTB) attack, it takes place in the application layer between the user and the browser. The adversary is granted with privileges to read, write, change and delete browser's data whilst the user is unaware about it.

Best practices for online Banking Users

For Users

1. Protect your PC:

• Install anti-virus software and keep it updated on a regular basis to guard against new viruses
• Install anti-spyware security software against those programs that monitor, record and extract the personal information you type in your PC (passwords, card numbers, ID numbers, etc.)
• Install personal firewalls to protect your PC against unauthorized access by hackers
• Keep your operating system and internet browser up to date, checking for and downloading new versions/security enhancements from the vendor's web site

2. Protect your personal information:

• Create hard-to-guess security access codes (User ID & password) for Online Banking and make them unique (e.g. they should not be the same as those you use to access your e-mail account)
• Change your security access codes periodically
• Memorize your security access codes, avoid writing them down and keep them strictly personal and confidential
• Do not disclose to ANYONE your security access codes: Bank will never initiate or contact you for your e-banking or ATM PINs, card or account numbers, personal identification information, neither over the phone nor in any electronic or written message. Also refrain from providing ATM pin for ecommerce transactions.
• Never leave your PC unattended when logged into Online Banking
• Always remember to log off from your online session using the "Log-off" button when finished using the e-banking services

3. Use the Internet cautiously:

• Always access Online Banking internet only by typing the URL in the address bar of your browser.
• Never attempt to access Online Banking internet through an external link of unknown or suspicious origin appearing on other websites, search engines or e-mails
• Before logging in, check for the Bank's Security Certificate details and the various signs (e.g. green address line and Lock, HTTPs) that confirm you are visiting the secure pages of Bank.
• Ignore and delete immediately suspicious fraudulent (phishing, spoof, hoax) e-mails that appear to be from Bank, asking you to urgently click a link to a fraudulent (spoof) website that tries to mimic the Bank's site and to lure you into giving out your sensitive personal information (PIN, account or card numbers, personal identification information et al.)
• Never click on a link contained in suspicious e-mails
• Avoid using Online Banking from public shared PCs (as in internet cafes, libraries, etc.) to avoid the risk of having your sensitive private information copied and abused

4. Stay alert:

• Sign-on to Online Banking regularly and review your account transactions, checking for any fraudulent activity on your account (e.g. transactions you do not recognize)
• Keep track of your last log-on date and time, displayed at the top left side of the Online Banking Home page
• Once logged into Online Banking, you can also monitor the actions performed online

5. Prompt reporting of suspicious activity:

• Contact your bank immediately, if you think someone knows your security access code or in case of theft of your code/ money or in case you have forgotten your credentials.
• Forward any suspicious e-mails to the bank on their phishing reporting email as well as on CERT-In email incident@cert-in.org.in
• Your prompt action is crucial to prevent any (further) damage

Reference: Indian Computer Emergency Response Team