What U.S. banks offer two-factor authentication (such as password & token) for online banking?
"StasM, It's taken a while but many banks offer tokens - although they tend to limit the accounts for which they will be issued. All of the following issue tokens, but there are many more: CitiBank JP Morgan Union Bank Wells Fargo Callaway Bank Wachovia Bank of North Dakota The River Bank of Wisconsin Metcalf Bank, Kansas Stonebridge Bank In 2005 federal regulators stipulated that banks needed to get better with security for online banking customers, but they did not endorse a particular technology. Tokens (aka fobs) were endorsed. The news was negatively received by the banks because putting more steps in the way of a customer drives the customer away. See this 2005 report for more info: http://www.usatoday.com/tech/news/computersecurity/2005-11-02-cybercrime-prevention_x.htm  My guess is a tipping point was reached since then, where customers became savvy of the risks, and that the ""extra steps"" became less an issue than the ""extra security""." There are very few banks which offer two-factor authentication.  Part of the reason is cost.  Providing a token to every account-holder is expensive, not just in the device or system, but in providing support and assistance to the millions of people who won't have the faintest idea how it works and complain that they no longer have access to their accounts. That said, it is sometimes available on request for personal accounts and many banks require it for their business clients. My HSBC Business account comes with two-factor as default and it works extremely well. There is also the pseudo-two-factor security offered by Visa and MasterCard (3-D secure) which performs a similar function. E*Trade offers banking services, and will provide you with a security token free if you have sufficient assets there ($50,000). Otherwise they'll charge you a $25 fee. Bank of America supports two-factor authentication using SMS messages, similar to PayPal. You can enable the feature from Online Banking under Customer Service -> SafePass Settings. Update: Over the weekend of July 28th, 2012, the SafePass control on the authentication page was updated to simple HTML + JavaScript instead of Flash, so that it is now possible to login from Safari on iOS, among others. Some credit unions also offer them and support Business banking as well. First Tech Credit Union is a great example. They also have the most security-oriented banking website I've seen to date. https://www.firsttechfed.com/ As a side note I've found that Credit Unions are a MUCH better deal for personal and business banking. USAA does - that's my bank. Wells Fargo tries to determine whether the online activity is a risk; if it is, they'll require an SMS code or phoned code be entered. You can get a fairly definitive list of online companies at twofactorauth.org.
I have USAA and the home loan process was a nightmare.  My account was also compromised but I caught it immediately because they sent me an alert of a large sum of money being transferred to my checking account, so there is that.  I just found out that Navy Federal finally accepts Army veterans (it hadn't up until a couple of years ago) so I have an account with them just so I can get different loan options and credit card rates.  Navy Federal has minimums for getting ATM refunds while USAA doesn't, so for now I just have a savings account with them. I read an article where this website did an interview with them and concluded its very sketchy and possibly illegal. They refused to give out their FDIC number and they got the high interest rate by selling personal customer information to third parties When I went on vacation to London a few years ago, I looked around at banks with ATM deals with UK banks. I found that B of A had a deal with a UK bank that you could use their ATMs to take out money from your US account for practically no fees. So the week or so before I left, I opened an account at B of A, put a bunch of money in it, and used the B of A debit card during my trip as much as possible. Buxfer is a personal-finance web app which you might like.  It's not open-source.  But at least none of your complaints about financeworks.intuit.com apply to Buxfer. Buxfer offers a piece of software you can download to your own PC, called Firebux.  This macro-recording software provides automation that helps you download statements and upload them to Buxfer.  So you never have to give Buxfer any of your bank or brokerage usernames or passwords. Buxfer and Firebux are both free of charge. Wesabe, another personal-finance web app, also used to offer data-uploader software, but Wesabe has now gone out of business. I use online banking and bill pay for all accounts where I can control when and how much is paid, where I push the funds out.  The bills from those companies that want to be allowed to reach into my account and pull money automatically (e.g. my Chase mortgage) I simply will not enroll - they get a paper check in the mail. There is no way I am giving these cocksucker criminals *permission* to take money out of my accounts. In addition to the other answers, Harris Bank (now owned by BMO) allows Canadians living in Canada to open accounts, perhaps they consider other countries as well.  They have excellent customer service. I'm always hesitant to use local credit unions because I love accessing all atms fee free, having services available 24/7, having robust, safe and audited online services, and having a big enough bank that all major third party tools interface with it.   Joe Schmo Local Credit Union has a lot of good services, but audited and secure online banking? No fee nationwide ATMs? Native interfacing to major tools? I just don't see it often.   I shudder to think of the security at small bank websites, frankly. I'm working on some banking-related research, and have run into a problem: financial data switches between using RSSDIDs and FDIC certs to identify individual banks. I'm looking for an efficient way to convert between ID types or include both, as I am merging large financial data sets that each use different ID types. I have found [this](https://www.ffiec.gov/nicpubweb/nicweb/searchform.aspx), which allows for conversion one-by-one. However, I'm working with a very large set of bank data, and would really appreciate a more efficient way to do this. Does anyone know of a data set that matches certs to RSSDIDs?  edit: just in case someone else needs it, the call report bulk downloads on the ffiec site have both the CERTs and RSSDIDs, so you can use those. Capital One 360. No minimums balance, no fees. Everything's online. Make deposits using an app or an image of the check. ATMs are free almost everywhere. Personal finance startup BillGuard has raised $10 million in second-round financing, and it’s using it to expand its service that helps protect accounts from fraudulent activity, the company said Tuesday.  BillGuard protects users by registering their credit and debit cards and keeping an eye out for questionable and fraudulent charges. The company uses a crowdsourced approach to identifying unauthorized charges, by not only providing its own detection but also incorporating users’ billing complaints to track and analyze payments.  BillGuard’s big second round of funding comes from a powerhouse group, including Khosla Ventures, Eric Schmidt’s Innovation Endeavors and Peter Thiel’s Founders Fund.  “At Khosla Ventures we love entrepreneurs who dare to tackle large problems with disruptive, bottom-up methods,” said Vinod Khosla, founding partner of Khosla Ventures, in a statement.  At present, BillGuard is free to use for anyone who wants to sign up. So how is it going to make money? The company is talking to large banks that could act as partners and incorporate BillGuard on a per-customer basis for a small fee. BillGuard is also exploring the idea of a merchant certification program that would let merchants have access to some its data, and follow up with customers who end up with fraudulent or questionable charges.  New York-based BillGuard previously raised $3 million in its first round of funding from Bessemer Venture Partners and IA Ventures. BillGuard made its public debut on stage at the TechCrunch Disrupt conference in May 2011. I've had good experiences with a regional bank. All the perks of Wells but without the bullshit fees (except ATMs unfortunately but I just get cash back in the rare instance that a card / my phone won't cut it). While it's wise, easier and safer to check your transactions online a few times a month, I opt to receive and file paper statements as a hard copy back up of account history. Any reconciliation I perform is a quick glance to make sure the numbers sound right. It's probably a small waste of time and space, but it settles some of my paranoia (due to my training as a computer engineer)  about failure of electronic banking systems. If someone tampers with bank records or a SAN explodes and wipes out a bunch of account data, then I will have years worth of paper statements to back up my numbers.  Having years worth of statements printed on the banks stationary will have better credibility in court than a .pdf or printout thereof that could have been doctored, in case I ever needed to take my bank to court. A little piece of mind for the price of a letter opener, a square foot file box and a couple of minutes a month. "Much of what you're asking will not be disclosed for obvious security reasons, so don't be surprised when call center people say they ""don't know"".  They may actually not know, but even if they did, they'd be fired if they were to say anything.  Nothing could be a touchier subject than online security for the financial institutions. I don't know of reliable sources for the data you're asking about, and I don't know the banks or other firms would release it.  For a bank to talk about its incidence rates of fraud would be unusual, because none of these institutions wants to appear ""less safe"" than their competitors.  If there's any information out there then it's going to be pretty vague.  None of these institutions wants the ""bad guys"" to know what their degree of success is against one bank versus any other.  I hope that makes sense. The smaller banks usually piggyback their data on the networks of the larger financial institutions, so they are as secure (as a general rule) as the larger banks' networks they're running on.  Also, your transactions on your credit cards are not generally handled directly by your bank anyway, unless it's one of the big heavyweights like Chase or Bank of America.  All transactions run through merchant processors, who act as intermediaries between merchants and the banks, and those guys are pretty damned good at security.  I've met some of the programmers, and they're impressive to me (I've been a programmer for 35 years and can't put a finger on these guys!). Most banks require that you must provide proof of identity when opening an account, and that ID must me the standards of the ""USA Real ID Act"".  Here's an excerpt from the Department of Homeland Security website on what Real ID is: Passed by Congress in 2005, the REAL ID Act enacted the 9/11 Commission’s recommendation that the Federal Government “set standards for the issuance of sources of identification, such as driver's licenses.” The Act established minimum security standards for state-issued driver’s licenses and identification cards and prohibits Federal agencies from accepting for official purposes licenses and identification cards from states that do not meet these standards. States have made considerable progress in meeting this key recommendation of the 9/11 Commission and every state has a more secure driver’s license today than before the passage of the Act. In order for banks to qualify for FDIC protection, they must comply with the Real ID standards when opening accounts. As with any business (especially online), the most effective way to minimize fraud is vigilant monitoring of data.  Banks and other online financial entities have become very adept at pattern analysis and simply knowing where and what to look for when dealing with their customers.  There are certainly sophisticated measures which are kept carefully out of the public eye for doing this, and obviously they're good at it.  They have to be, right? There's no way to completely eliminate fraud -- too much incentive exists for the ""bad guys"" to not constantly search for new ways to run their schemes, and the good guys will always be at the disadvantage, because there's no way to anticipate everything anyone might come up with.  Just look at online viruses and malware.  Your antivirus software can only deal with what it knows about, and the bad guys are always coming up with some new variant that gets past the filters until the antivirus maker learns of it and comes up with a way to deal with it. Your question's a good one to ponder, and I wouldn't want to be the chief of internet security for a bank or online institution, because I'd lay awake at night pondering when the call's going to come that we finally ran out of luck! (grin) I hope this was helpful. Good luck!" Are there banks where you can open a bank account without being a citizen of that country without having to visit the bank in person? I've done it the other way around, opened a bank account in the UK so I have a way to store GBP.  Given that Britain is still in the EU you can basically open an account anywhere.  German online banks for instance allow you to administrate anything online, should there be cards issued you would need an address in the country.  And for opening an account a passport is sufficient, you can identify yourself in a video chat.  Now what's the downside?  French banks' online services are in French, German banks' services are in German.  If that doesn't put you off, I would name such banks in the comments if asked. Are there any online services for investing money that aren't tied to any particular country? Can you clarify that?  You should at least be able to buy into any European or American stock through your broker.  That should give you an ease of mind being FCA-regulated.  However, those are usually GDRs (global depository receipts) and denominated in GBp (pence) so you'd be visually exposed to currency rates, by which I mean that if the stock goes up 1% but the GBP goes up 1% in the same period then your GDR would show a 0% profit on that day; also, and more annoyingly, dividends are distributed in the foreign currency, then exchanged by the issuer of the GDR on that day and booked into your account, so if you want to be in full control of the cashflows you should get a trading account denominated in the currency (and maybe situated in the country) you're planning to invest in. If you're really serious about it, some brokers/banks offer multi-currency trading accounts (again I will name them if asked) where you can trade a wide range of instruments natively (i.e. on the primary exchanges) and you get to manage everything in one interface.  Those accounts typically include access to the foreign exchange markets so you can move cash between your accounts freely (well for a surcharge).  Also, typically each subaccount is issued its own IBAN. Australia has a massive housing bubble (one of the last in the world to pop), no productivity growth (lots of investment in mining which hasn't yet payed off, though we'll do well if commodities pick up), and relies on China and India buying lots of coal and steel at historically high prices.