From Lita Epstein at Daily Finance:

"Based on a survey by the American Bankers Association,  25 percent of the population prefers to do its banking online and that number is growing. In fact, the survey found that the Internet is the preferred banking mode for all customers under the age of 55 and the popularity of ATMs has fallen in all age groups.

Through 2012, the number of online banking users is projected to grow at a compound annual rate of 20 percent, according to a report from the Tower Group. The Tower Group defines online banking as anything done once a person logs onto a bank's website.


All brick and mortar banks are experiencing growth in their online services.

• Bank of America has 30 million online banking customers.


• Chase has 13.9 million online bank customers.

Clearly, the trend is toward online banking." 

Simply put, HomeATM's SLIM "enables online banking customers to authenticate themselves in the exact same manner trusted by both banks and consumers to dispense cash in real time at an ATM."  

Simply Put: Although "card not present" transactions probably constitute less than 10% of all transactions, they definitely are responsible for over 50% of all card fraud...and growing.  Therefore, the Card Not Present environment is responsible for the MAJORITY of card fraud.  By creating an environment whereby customers could "Swipe" vs. "Type" we eliminate the "card NOT present" environment...thus eliminating CNP fraud. 

Related articles by Zemanta

• More On the URLZone Online Banking Trojan (pindebit.blogspot.com)


• Citigroup to scale back branches and build online banking presence (dailyfinance.com)


• Useless Bank Promos (pindebit.blogspot.com)


• Does Weak Online Banking Log-In Make the Bank Liable for Losses Incurred when Fraud Occurs? (pindebit.blogspot.com)


• The Password is...Two Factor Authentication (pindebit.blogspot.com)


• Game Over! Hackers Win! (pindebit.blogspot.com)


• Online Banking is Weak Week Continues (pindebit.blogspot.com)


• Bank of America Gives Away $25 to Pay Bills Online (pindebit.blogspot.com)


• $35 Promo to Online Bill Pay at Bank of America (pindebit.blogspot.com)


• Closing Out Online Banking Security is Weak Week...with a Bang (pindebit.blogspot.com)


• Online Banking Trojans Infesting the Web (pindebit.blogspot.com)


• Garlik's UK Cybercrime Report 2009 Released (pindebit.blogspot.com)


• Consumers Fearful About Online Banking Risks (pindebit.blogspot.com)


• More on the Shames-Yeakel vs. Citizens Bank Decision (pindebit.blogspot.com)


• What Is Conficker Waiting For? (pindebit.blogspot.com)


• Online Banking's Innate Security Flaws (information-security-resources.com)


• Anti-Phishing with Two Factor Authentication (information-security-resources.com)

Let's "key" in on that for moment, shall we?  The "Key Word" here being "keystroke capture."  Let me oversimplify this.  What procedure does online banking mandate for online banking customers to log-in to their account.  Is it by "keying" (typing) in their username and password?  It is, isn't it?



Consumers type their username, their password (and more often now, in a lame attempt to add an additional layer of security, some banks require their customers to "key" in other information, such as a mother's maiden name, the make of their first car, etc.



But the fact remains...if the online banking customer has a virus that allows for keystroke capture, then it doesn't matter if banks require their customers to "key in" (type) the answers to 100 questions, does it?  It will ALL BE CAPTURED.  Wouldn't it? Make sense?  It does, doesn't it? 



Back to the story...

"At the time of the incident, the customer was using a bank-issued ACH house token, which was designed to protect against unauthorized access, specifically from keystroke logging fraud attacks. Obviously, it didn't."


Which is why we created our SLIM device...it eliminates typing, thus keystroke logging (and phishing) enabling online banking customers to Swipe their Bank Issued Card and Enter their Bank Issued PIN to authenticate themselves.  We utilize "existing bank rails" to authenticate the user.  (If that process sounds familiar, it is because it's the same process used to access cash from an ATM.)  100% seamless transition.

Editor's Note:  Guess what.  The SLIM would also "prevent" any stolen funds from being transferred "anywhere" ...until the online banking consumer demonstrated "intent" to "authorized" the transfer by "Swipinig their Card" and "Entering their PIN" a second time!  Talk about doubly protecting the consumer.

 

To review: If somehow (for instance, a pre-existing infection from Zeus, Clampi or the urlZone banking Trojans) the bad guys were able to get into an online banking customers account, they "WOULD NOT" (let me state that again) "WOULD NOT" be able to transfer funds "ANYWHERE"  (let me state that again) "ANYWHERE"...UNLESS THE BAD GUYS HAD THE CONSUMERS BANK ISSUED CARD AND THEIR BANK ISSUED PIN. 

Therefore, we eliminate keystroke logging, we eliminate phishing, and we eliminate the threat of unauthorized money transfers to money mules.  Sounds elegant and sounds like a great online banking promotion.  Get a free SLIM.  We'll even put your bank's logo on it.  Where can your bank get them? Email me: jfrank@homeatm.net

Criminals today can hijack active online banking sessions, and new Trojan horses can fake the account balance to prevent victims from seeing that they're being defrauded.



Traditionally, such malware stole usernames and passwords for specific banks; but the criminal had to access the compromised account manually to withdraw funds. To stop those attacks, financial services developed authentication methods such as device ID, geolocation, and challenging questions. Unfortunately, criminals facing those obstacles have gotten smarter, too. One Trojan horse, URLzone, is so advanced that security vendor Finjan sees it as a next-generation program.

Greater Sophistication

Banking attacks today are much stealthier and occur in real time. (Translation: One-Time Passwords are at risk) Unlike keyloggers, which merely re­­cord your keystrokes, URLzone lets crooks log in, supply the required authentication, and hijack the session by spoofing the bank pages. The assaults are known as man-in-the-middle attacks because the victim and the attacker access the account at the same time, and a victim may not even notice anything out of the ordinary with their account.

According to Finjan, a so­­phisticated URLzone process lets criminals preset the percentage to take from a victim's bank account; that way, the ac­­tivity won't trip a financial institution's built-in fraud alerts. Last August, Finjan documented a URLzone-based theft of $17,500 per day over 22 days from several German bank ac­­count holders, many of whom had no idea it was happening.



But URLzone goes a step further than most bank botnets or Trojan horses, the RSA antifraud team says. Criminals using bank Trojan horses typically grab the money and transfer it from a victim's account to various "mules"--people who take a cut for themselves and transfer the rest of the money overseas, often in the form of goods shipped to foreign addresses.



URLzone also seems to detect when it is being watched: When the researchers at RSA tried to document how URLzone works, the malware transferred money to fake mules (often legitimate parties), thus thwarting the investigation.

Silentbanker and Zeus

Silentbanker, which appeared three years ago, was one of the first malware programs to em­­ploy a phishing site. When victims visited the crooks' fake banking site, Silentbanker in­­stalled malware on their PCs without triggering any alarm. Silentbanker also took screenshots of bank accounts, redirected users from legitimate sites, and altered HTML pages.



Zeus (also known as Prg Banking Trojan and Zbot) is a banking botnet that targets commercial banking accounts. According to security vendor SecureWorks, Zeus often focuses on a specific bank. It was one of the first banking Trojan horses to defeat authentication processes by waiting until after a victim had logged in to an account successfully. It then impersonates the bank and unobtrusively injects a request for a Social Security number or other personal information.



Zeus uses traditional e-mail phishing methods to infect PCs whether or not the person enters banking credentials. One recent Zeus-related attack posed as e-mail from the IRS. Unlike previous banking Trojan horses, however, the Zeus infection is very hard to detect because each victim receives a slightly different version of it.

Clampi

Clampi, a bank botnet similar to Zeus, lay dormant for years but recently became quite active. According to Joe Stewart, director of malware research for SecureWorks, Clampi captures username and password information for about 4500 financial sites. It relays this information to its command and control servers; criminals can use the data immediately to steal funds or purchase goods, or save it for later use. The Washington Post has collected stories from several victims of the Clampi botnet.



Clampi defeats user authentication by waiting for the victim to log in to a bank account. It then displays a screen stating that the bank server is temporarily down for maintenance. When the victim moves on, the crooks surreptitiously hijack the still-active bank session and transfer money out of the account.  Editor's Note:  If people would STOP TYPING their username and passwords to log-in and replaced the authentication with a Card Swipe and PIN Entry (which ensures you are on the genuine online banking website) then this threat would be eliminated as well. 

Defending Your Data

There is an online banking Trojan out there that is bypassing up-to-date anti-virus programs as much as 77% of the time, according to security company Trusteer. The Zeus Trojan is also known as Zbot, WSNPOEM, NTOS and PRG. It is the most prevalent financial malware on the web, Trusteer says. (Editor's Note:  Others say it's Clampi) 

Related articles by Zemanta

• Online Banking's Ticking Time Bomb... (pindebit.blogspot.com)


• 93% of Internet Users Shoud Ditch Online Banking (pindebit.blogspot.com)


• Todos Delivers 20 Millionth eBanking Security Product (pindebit.blogspot.com)


• Closing Out Online Banking Security is Weak Week...with a Bang (pindebit.blogspot.com)


• Quote of the Day: Inside the Browser is Perfect Place for Criminals to Be... (pindebit.blogspot.com)


• Online Banking Fraud in the UK Hits a New High (pindebit.blogspot.com)


• What "Type" of Problems Can HomeATM Solve? (pindebit.blogspot.com)


• Online Banking Trojans Infesting the Web (pindebit.blogspot.com)


• Windows and Online Banking, Like Oil and Water (pindebit.blogspot.com)


• Online Banking Report from FBI (pindebit.blogspot.com)


• Wells Fargo Introduces Mobile Banking Money Transfer...Be Careful! (pindebit.blogspot.com)


• Garlik's UK Cybercrime Report 2009 Released (pindebit.blogspot.com)


• Online Banking Provide Opportunity to Rebuild Trust Between Banks and Consumers, Says MasterCard CFO (pindebit.blogspot.com)


• How Banks Can Be Serious Players in P2P Payments (pindebit.blogspot.com)


• Online Banking is Dead - Bank Technology News Editor-In-Chief (pindebit.blogspot.com)