How does a online only bank protect itself against fraud?
"Much of what you're asking will not be disclosed for obvious security reasons, so don't be surprised when call center people say they ""don't know"".  They may actually not know, but even if they did, they'd be fired if they were to say anything.  Nothing could be a touchier subject than online security for the financial institutions. I don't know of reliable sources for the data you're asking about, and I don't know the banks or other firms would release it.  For a bank to talk about its incidence rates of fraud would be unusual, because none of these institutions wants to appear ""less safe"" than their competitors.  If there's any information out there then it's going to be pretty vague.  None of these institutions wants the ""bad guys"" to know what their degree of success is against one bank versus any other.  I hope that makes sense. The smaller banks usually piggyback their data on the networks of the larger financial institutions, so they are as secure (as a general rule) as the larger banks' networks they're running on.  Also, your transactions on your credit cards are not generally handled directly by your bank anyway, unless it's one of the big heavyweights like Chase or Bank of America.  All transactions run through merchant processors, who act as intermediaries between merchants and the banks, and those guys are pretty damned good at security.  I've met some of the programmers, and they're impressive to me (I've been a programmer for 35 years and can't put a finger on these guys!). Most banks require that you must provide proof of identity when opening an account, and that ID must me the standards of the ""USA Real ID Act"".  Here's an excerpt from the Department of Homeland Security website on what Real ID is: Passed by Congress in 2005, the REAL ID Act enacted the 9/11 Commission’s recommendation that the Federal Government “set standards for the issuance of sources of identification, such as driver's licenses.” The Act established minimum security standards for state-issued driver’s licenses and identification cards and prohibits Federal agencies from accepting for official purposes licenses and identification cards from states that do not meet these standards. States have made considerable progress in meeting this key recommendation of the 9/11 Commission and every state has a more secure driver’s license today than before the passage of the Act. In order for banks to qualify for FDIC protection, they must comply with the Real ID standards when opening accounts. As with any business (especially online), the most effective way to minimize fraud is vigilant monitoring of data.  Banks and other online financial entities have become very adept at pattern analysis and simply knowing where and what to look for when dealing with their customers.  There are certainly sophisticated measures which are kept carefully out of the public eye for doing this, and obviously they're good at it.  They have to be, right? There's no way to completely eliminate fraud -- too much incentive exists for the ""bad guys"" to not constantly search for new ways to run their schemes, and the good guys will always be at the disadvantage, because there's no way to anticipate everything anyone might come up with.  Just look at online viruses and malware.  Your antivirus software can only deal with what it knows about, and the bad guys are always coming up with some new variant that gets past the filters until the antivirus maker learns of it and comes up with a way to deal with it. Your question's a good one to ponder, and I wouldn't want to be the chief of internet security for a bank or online institution, because I'd lay awake at night pondering when the call's going to come that we finally ran out of luck! (grin) I hope this was helpful. Good luck!" I don't see why an online-only bank would need to do anything more against fraud than a bank that also has brick-and-mortars. In the contrary, they would need less (physical) security, as they don't have to protect cash, lock boxes, and other physical assets. All banks nowadays have an online business, so they all have the same online fraud risks, and they all need the same level of protection. @ Daniel Anderson shared interesting insights. In my research I learned a few things Some interesting data on fraud trends  AFP Payments Fraud and Control Survey 2016 As a consumer, at the very least I'd improve awareness of I'd also learn about basic types of fraud And for the techies out there, I'd recommend learning about layered security (There's no way the customer service is going to talk about this) "There are Cyber Security and Reporting Standards which Financial Service Provider (Banks and Financial services where customers deposit and/or transact fiat currency) You can find a comprehensive list on Wikipedia under Cyber security standards Depending on the geographic location there might be local Govt requirements such as reporting issues, data security etc. Concerning point 1. We have to differ between a fraudulent customer and an attacker on the banks infrastructure. Fraudulent customers / customers that have been compromised by third parties are identified with but not limited to credit scores and merchant databases or data from firms specialized in ""Fraud Prevention"". Attackers (Criminals that intend to steal, manipulate or spy on data) are identified/prevented/recorded by but not limited to IDS solutions and attacker databases. For firms that get compensation by insurances the most important thing is the compilant with law and have records of everything, they rather focus on recording data to backtrack attackers than preventing attacks. Concerning point 2. For you as customer the local law and deposit insurance are the most important things. Banks are insured and usually compensate customers on money theft. The authentication and PIN / TAN methods are most crucial but standard - these authentication methods consist of one password and one offline part such as a TAN from a paperletter or a RSA generator or card reader. WRAPUP: Financial institutions have to comply with local law and meet international standards. Banks use highly advanced Intrusion detection and fraud prevention which logically must be based on databases. For the average joe customer there is seldom high risk to lose deposits even if the attackers gains full access to the bank account but this depends a lot on the country you reside in. Concerning targeted attacks:"
"Losses at a brokerage firm due to fraud are insured up to $500,000 per account for securities  by the SIPC (Securities Investors' Protection Corporation), which is the stock market version of the FDIC (that insures deposits). The protection amount for cash is $250,000. That's small comfort to ""big"" players in MF Global. But it does protect ""small"" investors like you." "This doesn't answer your question, but as an aside, it's important to understand that your second and third bullet points are completely incorrect; while it used to be true that Swiss bank accounts often came with ""guarantees"" of neutrality and privacy, in recent years even the Swiss banks have been caving to political pressure from many sides (especially US/Obama), with regards to the most extreme cases of criminals. That is to say, if you're a terrorist or a child molester or in possession of Nazi warcrime assets, Swiss banks won't provide the protection you're interested in. You might say ""But I'm not a terrorist or a pervert or profiteering of war crimes!"" but if you're trying so hard to hide your personal assets, it's worth wondering how much longer until Swiss banks make further concessions to start providing information on PEOPLE_DOING_WHAT_YOU_ARE_DOING. Not to discourage you, this is just food for thought. The ""bulletproof"" protection these accounts used to provide has been compromised. I work with online advertising companies, and a number of people I know in the industry get sued on a regular basis for copyright or trademark infringement or spamming; most of these people still trust Swiss bank accounts, because it's still the best protection available for their assets, and because Swiss banks haven't given up details on someone for spamming... yet." can I be prosecuted for fraud as well? Yes. It is possible in several jurisdictions (e.g. UK). You have (unwittingly) cooperated with the fraudster and arguably been at least an involved party or accessory to a crime or attempted crime.  Whether you are actually prosecuted depends on whether the fraud or attempted fraud is reported or detected, whether the prosecutors obtain evidence you knew (or should reasonably have known) that there was some criminal aspect to the events and, at least partly, on your actions once you became aware of the fraud. However I am not a lawyer and law varies from place to place considerably. According to Online Threat Alerts If someone asks you to lend him/her your bank account, debit card and PIN number for a fee, or offer to transfer money to your bank account, ask you to transfer a certain amount to another account, and then asks you to keep the rest as payment, please do not take part in such activity. This type of activity is a money laundering scam, used by criminals to trick people into unknowingly taking part in a crime that can land them in jail. I wouldn't worry too much, you have been extremely naive, foolish and negligent but what matters is how you behave now (probably). "You should immediately tell your bank you've been scammed, request for the transactions' cancellation or revocation and get back most - if not all - of the money transferred. I've placed numerous orders online in the past and was always very careful about their trace-ability but I have to admit once I acted carelessly and got scammed. I didn't think of it much before placing an order for a very low priced laptop through a private seller on Amazon. I'd never purchased anything this way before but thought ""Amazon will protect me if anything goes wrong..."" so I sent an e-mail to the seller. He gave me his bank details (with Spanish IBAN) via a non-suspicious e-mail with the usual logos and e-mail address domain name, made the payment and guy came back to me saying he'll ship the laptop once he sees the funds received. Waited max. 2 days, trying to contact him but no response. Contacted Amazon giving the seller's ID and the ""transaction""'s ID I'd received from him and they told me there's nothing they can do as that transaction is not recorded on their systems. Immediately after realizing I've been scammed and done my goof, I contacted my bank via e-mail explaining the situation. I was informed that the transaction can be cancelled but they cannot guarantee the return of the entire amount. After 2-3 days, I saw my balance richer by €950 and the payment I'd made to the scum was €1,000. I'd highly recommend that you check the fraud protection policy of your bank and in case there's something that can be done, then just get in contact with them explaining the situation." When you want to pay a bill on line there are several ways to do it. You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.  You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are. You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.  In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.  The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud. All transactions involving fraud or theft are void by their nature. Title to your money never changes hands.  You are entitled by law to have assets stolen from you returned to you. In cases of negligence or broker malfeasance, lawsuits or SIPC protection are your primary recourse. "Many people do not know that bank online bill paying services are not provided directly by the bank. Banks often ""farm out"" this task to third party providers of bill paying services. These services in turn may farm out the customer service function to agents in foreign countries. These customer service agents have access to your account number, social security number, and your balance. This means that people have your personal information in countries where you have no rights and where security is not good and where enemies of your nation can easily access that information." If it is closed, you should be able to trust that it is closed permanently. What you still have is the online account. Imagine this would be removed and then the account would be re-activated? That should not happen, but the way you see it, you must be afraid of that as well. What I mean to say: See these two things as completely separate.