key: 2010-attacking-Barclays-online-banking
type: techreport
title: "Privacy vs. Usability: A failure of Barclays online banking?"
authors:
  - Ben Smyth
year: 2010
month: 3
number: CSR-10-05
institution: School of Computer Science
address: University of Birmingham
listed: false
description: >-
  This article shows a vulnerability of Barclays online banking which allows an adversary to view
  statements and transfer money between a customer's accounts.
keywords: >-
  Barclays, online banking, usability, financial privacy, security, software engineering failure,
  attack, exploit, online banking security
abstract: >-
  Barclays online banking system is vulnerable to a remote attack which allows an adversary to view
  customer bank statements and transfer money between a customer's accounts. The vulnerability has
  arisen as a result of poor software engineering practice which neglected security in favour of
  usability. More precisely, Barclays authentication mechanism is reliant on four pieces of customer
  data, namely: surname, date of birth, sixteen digit card number and three digit card security code
  (the number on the reverse of the card). This simplifies the login process for the user. However,
  this information is publicly available and hence it can also be used by an adversary. Barclays
  have therefore failed in their duty to protect the financial privacy of their customers. Moreover,
  the system may leave customers open to fraud and even financial loss.
video:
  youtube: HV3FJ24e5eY
  text: Video demonstration
extra: >
  <h2>Media coverage</h2>

  <p>

  This article has been discussed by <a
  href="http://www.pcpro.co.uk/news/security/357241/experts-barclays-online-banking-vulnerable-to-snoopers">PC
  Pro</a> (<a href="/files/Smyth10-attacking-Barclays-PC-Pro-coverage.pdf">local cache</a>) and <a
  href="http://www.timesonline.co.uk/tol/money/consumer_affairs/article7085592.ece">The Times</a>
  (<a href="/files/Smyth10-attacking-Barclays-Times-coverage.pdf">local cache</a>); The Times have
  also published a <a
  href="http://www.timesonline.co.uk/tol/money/consumer_affairs/article7141658.ece">follow-up
  article</a> (<a href="/files/Smyth10-attacking-Barclays-Times-coverage-follow-up.pdf">local
  cache</a>).

  </p>

  <h2>Video demonstration</h2>

  <p>A video demonstrating this attack is available on <a
  href="http://www.youtube.com/watch?v=HV3FJ24e5eY">YouTube</a>.</p>
links:
  - file: Smyth10-attacking-Barclays.pdf
    text: Technical Report