Online banking customers are being left exposed to some worrying fraud risks, according to Which?
The consumer group urged providers to “up their game” by using the latest protections for their websites and not allowing customers to set unsecure passwords.
It conducted an investigation with security experts 6point6, testing the online and mobile app security of 15 major current account providers on a range of criteria, including encryption and protection, login, and account management and navigation.
Six banks – HSBC, NatWest Santander, Starling, the Co-operative Bank and Virgin Money – let people choose passwords that include their first name and/or surname, the research found.
Santander told Which? this is being phased out, while NatWest and Virgin Money said it might now increase password limitations.
TSB, Lloyds, Metro, Nationwide Santander and the Co-operative Bank also used texts to verify people when logging in, leaving messages at risk of being hijacked by cybercriminals, Which? said.
Santander and the Co-operative Bank told Which? they were looking to move away from this.
Our security tests have revealed worrying flaws when it comes to keeping people safe from the…
