key: 2010-attacking-Natwest-online-banking
type: techreport
title: Exploiting Natwest and RBS online banking systems for profit
authors:
  - Ben Smyth
  - Chris Smith
year: 2010
month: 7
number: CSR-10-11
institution: School of Computer Science
address: University of Birmingham
listed: false
description: >-
  This article demonstrates a vulnerability of Natwest and RBS online banking systems which allows
  an adversary to steal money from a customer's account.
keywords: >-
  Natwest, Royal Bank of Scotland, RBS, online banking, usability, financial fraud, financial
  privacy, security, software engineering failure, attack, exploit, online banking security
abstract: >-
  The Natwest and Royal Bank of Scotland (RBS) online banking systems are vulnerable to a remote
  attack which allows an adversary to steal money from a customer's account. The vulnerability has
  arisen as a result of poor software engineering practice which neglected security. More precisely,
  the authentication mechanisms used by Natwest and RBS are dependent on six pieces of customer
  data, namely: name, date of birth, sixteen digit card number, three digit card security code (the
  number on the reverse of the card), sort code and account number. This information is publicly
  available and hence it can also be used by an adversary. Natwest and RBS have therefore failed in
  their duty to protect customers from financial fraud.
video:
  youtube: BHmv_0p_Nqo
  text: Video demonstration
extra: >
  <h2>Video demonstration</h2>

  <p>A video demonstrating this attack is available on <a
  href="http://www.youtube.com/watch?v=BHmv_0p_Nqo">YouTube</a>.</p>
links:
  - file: Smyth10-attacking-Natwest.pdf
    text: Technical Report