The Second Payment Services Directive (PSD2) of the European Union aims to create a consumer-friendly financial market by mandating secure and standardised data sharing between banking operators and third parties. Consequently, EU countries and the United Kingdom have adopted Open Banking, a standardised data-sharing API. This paper presents a formal modelling and security analysis of the UK Open Banking Standard's APIs, with a specific focus on the Account and Transaction API protocol. Our methodology employs the extended Alice and Bob notation (AnBx) to create a formal model of the protocol, which is then verified using the OFMC symbolic model checker and the Proverif cryptographic protocol verifier. We extend previous work by enabling verification for unlimited sessions with a strongly typed model. Additionally, we integrate our formal analysis with practical security testing of some necessary conditions to demonstrate verified security-goals in the NatWest Open Banking sandbox, evaluating mechanisms such as authorisation and authentication procedures.
E-Commerce offers the banking industry great opportunity, but also creates a set of new risks and vulnerability such as security threats. Information security, therefore, is an essential management and technical requirement for any efficient and effective Payment transaction activities over the internet. Still, its definition is a complex endeavor due to the constant technological and business change and requires a coordinated match of algorithm and technical solutions. Ecommerce is not appropriate to all business transactions and, within e-commerce there is no one technology that can or shoul…
This paper highlights the necessity to use modern blockchain technology in traditional banking sector to reduce frauds and enable high-security transactions on a permanent blockchain ledger. Reviewing different channels through which the traditional banking servers could integrate blockchain use, it is signified how a huge anti-fraud stand can be taken against bank servers allowing fraudulent transactions daily. Usage of a blockchain-based ledger is highly impactful in terms of security of a banking organization. Blockchain-based currency tokens, also referred to as Cryptocurrencies are not re…
In this chapter we provide an overview of the concept of blockchain technology and its potential to disrupt the world of banking through facilitating global money remittance, smart contracts, automated banking ledgers and digital assets. In this regard, we first provide a brief overview of the core aspects of this technology, as well as the second-generation contract-based developments. From there we discuss key issues that must be considered in developing such ledger based technologies in a banking context.
As ATM applications deploy for a banking system, the need to secure communications will become critical. However, multicast protocols do not fit the point-to-point model of most network security protocols which were designed with unicast communications in mind. In recent years, we have seen the emergence and the growing of ATMs (Automatic Teller Machines) in banking systems. Many banks are extending their activity and increasing transactions by using ATMs. ATM will allow them to reach more customers in a cost effective way and to make their transactions fast and efficient. However, communicati…
Over the past decade, smartphones have become the point of convergence for many applications and services. There is a growing trend in which traditional smart-card based services like banking, transport and access control are being provisioned through smartphones. Smartphones with Near Field Communication (NFC) capability can emulate a contactless smart card; popular examples of such services include Google Pay and Apple Pay. Similar to contactless smart cards, NFC-based smartphone transactions are susceptible to relay attacks. For contactless smart cards, distance-bounding protocols are propo…
With the rise of attacks on online accounts in the past years, more and more services offer two-factor authentication for their users. Having factors out of two of the three categories something you know, something you have and something you are should ensure that an attacker cannot compromise two of them at once. Thus, an adversary should not be able to maliciously interact with one's account. However, this is only true if one considers a weak adversary. In particular, since most current solutions only authenticate a session and not individual transactions, they are noneffective if one's devi…
Innovations in Cardless Artificial Intelligence Banking: A Comprehensive Framework for Cyber Secure and Fraud Mitigation using Machine Learning Algorithms
Computer Engineering, University of Central Florida, Orlando, Florida, USA
Internet banking (IB) continues to face security concerns arising from illegal access to users accounts. Use of personal identification numbers (PIN) as a single authentication method for IB users is prone to insecurities such as phishing, hacking and shoulder surfing. Fingerprint matching (FPM) as an alternative to PIN equally has a downside as fingerprints reside on individual mobile devices. A survey we conducted from 170 IB respondents of 5 different banks in Brunei established that majority (65%) of them preferred use of biometric authentication methods. In this work, we propose a two-lev…
Mobile banking apps, belonging to the most security-critical app category, render massive and dynamic transactions susceptible to security risks. Given huge potential financial loss caused by vulnerabilities, existing research lacks a comprehensive empirical study on the security risks of global banking apps to provide useful insights and improve the security of banking apps. Since data-related weaknesses in banking apps are critical and may directly cause serious financial loss, this paper first revisits the state-of-the-art available tools and finds that they have limited capability in ident…
There is a rapid increase in the number of mobile banking applications' users due to an increase in smart mobile devices. Mobile banking is a financial transaction and service offered through mobile devices. Almost all financial institutions now provide mobile banking services to their customers. However, the security of mobile banking applications is of huge concern because of the amount of personal data and information they collect. If an attacker gets hold of personal information, they can access bank payment or card accounts. This research aims to analyze the vulnerability of the UK digita…
In last few decades large technology development raised various new needs. Financial sector has also no exception. People are approaching all over the world to fulfill there dreams. Any sector needs to understand changing need of customer. In order to satisfy financial need for customer banks are taking help of new technology such as internet. Only problem remain is of security. The aim of this work is to provide a secure environment in terms of security for transaction by various ways. In order to improve security we are making use of "Steganography" technique in the way never used before. Ta…
Forced by regulations and industry demand, banks worldwide are working to open their customers' online banking accounts to third-party services via web-based APIs. By using these so-called Open Banking APIs, third-party companies, such as FinTechs, are able to read information about and initiate payments from their users' bank accounts. One of the most promising standards in this segment is the OpenID Financial-grade API (FAPI), currently under development in an open process by the OpenID Foundation and backed by large industry partners. The FAPI is a profile of OAuth 2.0 designed for high-ris…
In recent years, electronic retail payment mechanisms, especially e-commerce and card payments at the point of sale, have increasingly replaced cash in many developed countries. As a result, societies are losing a critical public retail payment option, and retail consumers are losing important rights associated with using cash. To address this concern, we propose an approach to digital currency that would allow people without banking relationships to transact electronically and privately, including both internet purchases and point-of-sale purchases that are required to be cashless. Our propos…
Skoltech（斯科尔科沃科学技术学院）；IITP RAS（俄罗斯科学院信息传输问题研究所）；MIPT（莫斯科物理技术学院）；Sber AI lab（俄罗斯联邦储蓄银行人工智能实验室）
Machine learning models using transaction records as inputs are popular among financial institutions. The most efficient models use deep-learning architectures similar to those in the NLP community, posing a challenge due to their tremendous number of parameters and limited robustness. In particular, deep-learning models are vulnerable to adversarial attacks: a little change in the input harms the model's output. In this work, we examine adversarial attacks on transaction records data and defences from these attacks. The transaction records data have a different structure than the canonical NL…
The purpose of this work was to perform a network analysis on the rapidly growing bitcoin transaction network. Using a web-socket API, we collected data on all transactions occurring during a six hour window. Sender and receiver addresses as well as the amount of bitcoin exchanged were record. Graphs were generated, using R and Gephi, in which nodes represent addresses and edges represent the exchange of bitcoin. The six hour data set was subsetted into a one and two hour sampling snapshot of the network. We performed comparisons and analysis on all subsets of the data in an effort to determin…
Randpay is a technology developed in Emercoin for blockchain micropayments that can be more effective in some scenarios than the Lightning Network as we show in the paper. The protocol is based on the concept of Ronald L. Rivest and published in the paper "Electronic Lottery Tickets as Micropayments" (1997). The "lottery ticket" was designed for centralized systems where a trusted third party is required to provide payments, and in some scenarios is also a lottery facilitator. The existing blockchain protocol cannot accommodate peer-to-peer "lottery" micropayments at least without the need to …
Scalable and Verifiable Federated Learning for Cross-Institution Financial Fraud Detection
School of Computer Engineering, KIIT Deemed to be University（计算机工程学院，KIIT deemed to be 大学）；School of Electronics Engineering, KIIT Deemed to be University（电子工程学院，KIIT deemed to be 大学）
The design of authentication protocols, for online banking services in particular and any service that is of sensitive nature in general, is quite challenging. Indeed, enforcing security guarantees has overhead thus imposing additional computation and design considerations that do not always meet usability and user requirements. On the other hand, relaxing assumptions and rigorous security design to improve the user experience can lead to security breaches that can harm the users' trust in the system. In this paper, we demonstrate how careful visualization design can enhance not only the secur…
