Several major UK high street banks have been forced to review the security of their customer web sites following the exposure of flaws on the Internet.
Heise Security, a publisher of security information for businesses, alerted its readers to serious security vulnerabilities in the customer-facing web sites of several UK banks.
It warned of methods that criminals could easily use to send phishing emails to users via the banks' sites, without banks ever being aware of any attack.
Heise claims it was able to prove that the web site security of NatWest, USB, Cahoot, Bank of Scotland, Bank of Ireland, First Direct and Link could be bypassed.
As a result of the published warnings, both NatWest and USB have already moved to improve site security, with others expected to follow suit.
Heise says that many banks are running vulnerable sites in spite of several years' worth of warnings about identity theft and phishing. It cited HSBC, Barclays and the Halifax as banks which passed its test.
Banks are now starting to take the issue of web security more seriously, says Alistair Newton, principal banking analyst with Gartner. "Banks are, for example, taking more care to authenticate the customers that come to their sites," he says.
"They realize that to be sure of customer's identity, they need more than just a user ID name and password. They now often add in the need for a one-time password generated by a token given to the customer by the bank."
He says security is important not just for banks to be sure of who is on their sites, but also for customers to be reassured that someone who has captured their name and password will still not be able to pose as them if they fall prey to a phishing scam.
"As always with security, there's no one solution that fits all problems," says Newton. "It's something banks will need to keep on updating. But of course if you have too many layers of security, then you start to put people off."
