How does a online only bank protect itself against fraud?
"Much of what you're asking will not be disclosed for obvious security reasons, so don't be surprised when call center people say they ""don't know"".  They may actually not know, but even if they did, they'd be fired if they were to say anything.  Nothing could be a touchier subject than online security for the financial institutions. I don't know of reliable sources for the data you're asking about, and I don't know the banks or other firms would release it.  For a bank to talk about its incidence rates of fraud would be unusual, because none of these institutions wants to appear ""less safe"" than their competitors.  If there's any information out there then it's going to be pretty vague.  None of these institutions wants the ""bad guys"" to know what their degree of success is against one bank versus any other.  I hope that makes sense. The smaller banks usually piggyback their data on the networks of the larger financial institutions, so they are as secure (as a general rule) as the larger banks' networks they're running on.  Also, your transactions on your credit cards are not generally handled directly by your bank anyway, unless it's one of the big heavyweights like Chase or Bank of America.  All transactions run through merchant processors, who act as intermediaries between merchants and the banks, and those guys are pretty damned good at security.  I've met some of the programmers, and they're impressive to me (I've been a programmer for 35 years and can't put a finger on these guys!). Most banks require that you must provide proof of identity when opening an account, and that ID must me the standards of the ""USA Real ID Act"".  Here's an excerpt from the Department of Homeland Security website on what Real ID is: Passed by Congress in 2005, the REAL ID Act enacted the 9/11 Commission’s recommendation that the Federal Government “set standards for the issuance of sources of identification, such as driver's licenses.” The Act established minimum security standards for state-issued driver’s licenses and identification cards and prohibits Federal agencies from accepting for official purposes licenses and identification cards from states that do not meet these standards. States have made considerable progress in meeting this key recommendation of the 9/11 Commission and every state has a more secure driver’s license today than before the passage of the Act. In order for banks to qualify for FDIC protection, they must comply with the Real ID standards when opening accounts. As with any business (especially online), the most effective way to minimize fraud is vigilant monitoring of data.  Banks and other online financial entities have become very adept at pattern analysis and simply knowing where and what to look for when dealing with their customers.  There are certainly sophisticated measures which are kept carefully out of the public eye for doing this, and obviously they're good at it.  They have to be, right? There's no way to completely eliminate fraud -- too much incentive exists for the ""bad guys"" to not constantly search for new ways to run their schemes, and the good guys will always be at the disadvantage, because there's no way to anticipate everything anyone might come up with.  Just look at online viruses and malware.  Your antivirus software can only deal with what it knows about, and the bad guys are always coming up with some new variant that gets past the filters until the antivirus maker learns of it and comes up with a way to deal with it. Your question's a good one to ponder, and I wouldn't want to be the chief of internet security for a bank or online institution, because I'd lay awake at night pondering when the call's going to come that we finally ran out of luck! (grin) I hope this was helpful. Good luck!" I don't see why an online-only bank would need to do anything more against fraud than a bank that also has brick-and-mortars. In the contrary, they would need less (physical) security, as they don't have to protect cash, lock boxes, and other physical assets. All banks nowadays have an online business, so they all have the same online fraud risks, and they all need the same level of protection. @ Daniel Anderson shared interesting insights. In my research I learned a few things Some interesting data on fraud trends  AFP Payments Fraud and Control Survey 2016 As a consumer, at the very least I'd improve awareness of I'd also learn about basic types of fraud And for the techies out there, I'd recommend learning about layered security (There's no way the customer service is going to talk about this) "There are Cyber Security and Reporting Standards which Financial Service Provider (Banks and Financial services where customers deposit and/or transact fiat currency) You can find a comprehensive list on Wikipedia under Cyber security standards Depending on the geographic location there might be local Govt requirements such as reporting issues, data security etc. Concerning point 1. We have to differ between a fraudulent customer and an attacker on the banks infrastructure. Fraudulent customers / customers that have been compromised by third parties are identified with but not limited to credit scores and merchant databases or data from firms specialized in ""Fraud Prevention"". Attackers (Criminals that intend to steal, manipulate or spy on data) are identified/prevented/recorded by but not limited to IDS solutions and attacker databases. For firms that get compensation by insurances the most important thing is the compilant with law and have records of everything, they rather focus on recording data to backtrack attackers than preventing attacks. Concerning point 2. For you as customer the local law and deposit insurance are the most important things. Banks are insured and usually compensate customers on money theft. The authentication and PIN / TAN methods are most crucial but standard - these authentication methods consist of one password and one offline part such as a TAN from a paperletter or a RSA generator or card reader. WRAPUP: Financial institutions have to comply with local law and meet international standards. Banks use highly advanced Intrusion detection and fraud prevention which logically must be based on databases. For the average joe customer there is seldom high risk to lose deposits even if the attackers gains full access to the bank account but this depends a lot on the country you reside in. Concerning targeted attacks:"
"Yes, your privacy is invaded, that's the law in many jurisdictions. The goal is to make money laundering and financing Evil Things harder. That's why banks are required to request proof for every money transfer larger than a specific sum. This is only a minor issue most of the time. You will have some kind of agreement with that Money Management company and this agreement (or a copy of it) will serve as a proof of your lawful reason to transfer money. It works just like that - you get to the bank and say you want to initiate a money transfer, the clerk asks you to show the ""proof"", you give them your agreement or a bill that requests you to pay or whatever else document you may have that proves that you're bound by some kind of contract with the recipient of money. The clerk then makes a copy of the ""proof"" and it stays in the bank to back the transfer until it is completed. The copy is then stored for some time and later destroyed - that's up to how the bank handles documents." The answer to this question can be found in the related question  Is there any online personal finance software without online banking? "You've touched on a very abstract concept that exist partly due to fractional-reserves and directly due to currency having no base (ex. not backed by gold), money can and does just pop into existence. To answer your question, we have to understand that the criminal is irrelevant. ""Can't a cyber criminal increase/decrease a bank's holdings just by changing a number in a computerized ledger book?"" The bank wouldn't need the cyber criminal's aid, they could change their own holdings. They have their own computers after all. Money's value is derived from trust. A bank that would change its own books would be black-balled. Similarly, a bank that un/consciously allows a cyber criminal change their holdings would lose trust. If this was a small transaction, they bank bottom line is unaffected. If these scandal is large enough to affect a bank's bottom line, the difference would be noticeable and raise suspicion." The only people who should know my online bank password are me & my spouse. Forget it, I won't share that sensitive information with any other company. I might as well give a blank check! Besides, don't banks require people to keep their username & password & PIN private? I signed an agreement to that effect, I think!  So even if I did find the online services compelling enough to try, I would want to check with my own bank first & ask them if it's OK to give my password to somebody else. I wonder what they would say to that!! While Rocky's answer is correct in the big picture there is another factor here to keep in mind: The disruption while you're waiting to resolve it. If a fraudster gets your card and drains your account you'll get your money back--but there will be a period while they are investigating that it won't be available. For this reason I avoid debit card transactions and only use credit cards.  If the fraudster gets your credit card you might lose access while they investigate but you don't lose access to your bank account. "There will be no police involved. The police do not care. Only the feds care, and they only care about large amounts (over $100,000). What will happen is that the teller will deposit the money like nothing is unusual, but the amount will trigger a ""Suspicious Transaction Report"" to be filed by the bank. This information goes to the US Treasury and is then circulated by the Treasury to basically every agency in the government: the Department of Defense, the FBI, the NSA, the CIA, the DEA, the IRS, etc. What happens next depends on your relationship with your bank and the personality of the bank. In my case I have made large cash transactions at two different banks, one that I had a long relationship with, and another that I had a long-standing but dormant account. The long-term one was a high end savings bank in a city. The dormant one was one of those bozo retail banks (think ""Citizens"" or ""Bank of America"") in a suburb. The long-term bank ignored my first deposit, but after I made some more including one over $50,000 in cash they summoned me via a letter. I went in, talked to the branch manager and explained why I was making the deposits. He said ""That sounds plausible."" and that was the end of the interview. It is unlikely that they transferred the information. They probably just wrote it down. They did this because they have ""know your customer"" regulations and they wanted to be able to prove that they did ""due diligence"" in case anybody asked about it later. The suburban bank never asked any questions, but they did file the STRs. In general, there is no way to know if the bank will interview you or not. It depends on a lot of different factors. The basic factors are: how much money is it, are you doing a lot of business normally, and how well does the bank know you. If you refuse to answer the bank's questions to their satisfaction, it is a 100% chance that they will close your account. They can also file higher level reports that flag your activity as ""highly suspicious"" as opposed to just the normal ""suspicious"". As long as it is a bank employee, you should have no serious concerns unless the guy seems strange and asks really pointed questions. If you have any question whether the ""employee"" is legitimate, just verify that he/she is a bank employee. Obviously if the feds visit you, you should say nothing. The chance of this happening is 1 in a million." I know of websites that do this, but I don't know of banks that do. Is there any reason you want to do this at a bank rather than use a service?  My main concern with using a bank for this would be the risk of overdraft fees I've had a card cloned 15 years ago and used to buy over 5k of goods in another country. So the inconvenience of having a card closed and re-issued is quite annoying even though the charges were reversed and I was made whole. But these days most CC fraud isn't from a card scanned by a waiter and cloned then used elsewhere. Mostly it is poorly secured databases or point of sale terminal malware. The latter is getting curtailed by chipped cards and the largest source of fraud is now online transactions (so called card not present) where the merchant has your CC number. If their system is breached the bad guys have a wealth of card numbers they sell in an E-bay like site on the dark web. This is where the Citi virtual CC comes in handy. Here's how it works to protect the bank and the hassles you go through when a card as to be re-issued. Citi's virtual CCs let you generate an actual credit card, complete with security code and expiration date. What is unique is that once the virtual CC is used it can only be used subsequently by that same merchant and is declined by any other. You can also set a total limit on what the merchant can charge as well as an expiration date. I use them for all my online accounts because they are, for all practical purposes, immune to the malware that steals CC info. Even if somehow the virtual CC is used before the merchant makes the initial charge that locks in the CC to their account the charge can be reversed without closing your actual card which has a different number. You can manage multiple Citi virtual CCs and view charge status, close, or adjust limits over time so managing them is quite easy with no risk to your primary account. "The most important thing to look at is the FDIC insurance. Savings accounts are covered. Money markets - not necessarily. Online savings accounts provide rates of ~1%. Look at American Express, Ally, Capitol One, ING Direct, E*Trade, etc. The ""pledge"" basically brings EverBank into the same list, as they all have similar rates. Being top 5% of competitive accounts is not that hard, because there are thousands of banks around, you know. 0.76 is not the highest rate available. American Express currently give 1% on their savings account. Re moving the money a lot - depends on the amounts, but when the rates were higher, I moved around a lot. Now, it just doesn't worth the trouble, although I would move for 0.25%." "Banks have a financial, and regulational duty called ""Know your customer"", established to avoid a number of historical problems occurring again, such as money laundering, terrorism financing, fraud, etc. Thanks to the scale, and scope of the problem (millions of customers, billions of transactions a day), the way they're handling this usually involves fuzzy logics matching, looking for irregular patterns, problem escalation, and other warning signs. When exceeding some pre-set limit, these signal clues are then filtered, and passed on for human inspection. Needless to say, these algorithms are not perfect, although, thanks to financial pressure, they are improving. In order to understand why your trading account has been suspended, it's useful to look at the incentives: false positives -suspending your trade, and assuming you guilty until proven otherwise- could cost them merely your LTV (lifetime value of customer -how much your business brings in as profit); while false negatives -not catching you while engaging in activities listed above- might cost them multi-month investigations, penalties, and court.  Ultimately, this isn't against you. I've been with the bank for 15 years and the money in the accounts has been very slowly accumulated via direct-deposit paychecks over that time. From this I gather the most likely explanation, is that you've hit somekind of account threshold, that the average credit-happy customers usually do not exceed, which triggered a routine checkup. How do you deal with it? Practice puppetry! There is only one way to survive angry customers emotionally: you have to realize that they’re not angry at you; they’re angry at your business, and you just happen to be a convenient representative of that business. And since they’re treating you like a puppet, an iconic stand-in for the real business, you need to treat yourself as a puppet, too. Pretend you’re a puppeteer. The customer is yelling at the puppet. They’re not yelling at you. They’re angry with the puppet. Your job is to figure out, “gosh, what can I make the puppet say that will make this person a happy customer?”  In an investigation case, go with boredom: The puppet doesn't care, have no feelings, and is eternally patient. Figure out what are the most likely words that will have the matter ""mentally resolved"" from the investigator's point of view, tell them what they have to hear, and you'll have case closed in no time. Hope this helps." If your debit card/ATM card is stolen or lost, someone else might be able to withdraw money from the checking account that it is tied to, or buy things with the card and have the money taken out of the checking account to pay the merchant. Subject to daily withdrawal limits imposed by your bank, a considerable amount of money could be lost in this way. At least in the US,  debit or ATM cards, although they are often branded Mastercard or Visa, do not provide the same level of protection as credit cards for which the liability is limited to $50 until the card is reported as lost or stolen and $0 thereafter.  Note also that the money in your savings account is safe, unless you have chosen an automatic overdraft protection feature that automatically transfers money from your savings account into the checking account to cover overdrafts. So that is another reason to keep most of your money in the savings account and only enough for immediately foreseeable needs in the checking account (and to think carefully before accepting automatic overdraft protection offers). These days, with mobile banking available via smartphones and the like, transferring money yourself from savings to checking account as needed might be a preferred way of doing things on the go (until the smartphone is stolen!) US checking accounts are not really secure, though many people use them. One form of check fraud has been highlighted by Prof. Donald Knuth and carried out by Frank Abagnale, as portrayed in the film Catch Me If You Can. Basically, anyone can write a check that would draw from your account merely by knowing your account number and your bank's ABA routing number.  With those two pieces of information (which are revealed on every check that you write), anyone can print a working check, either using a laser printer with MICR (magnetic ink character recognition) toner, or by placing an order with a check-printing company.  The only other missing element is a signature, which is a pretty weak form of authentication. When presented with such a check, your bank would probably honor it before finding out, too late, that it is fraudulent. A variant of this vulnerability is ACH funds transfers.  This is the mechanism through which you could have, say, your utility company automatically withdraw money from your account to pay your bill.  Unfortunately, the transfer is initiated by the recipient, and the system relies largely on trust with some statistical monitoring for suspicious patterns. Basically, the whole US checking system is built with convenience rather than security in mind, since other institutions are able to initiate withdrawal transactions by knowing just the ABA number and account number.  In practice, it works well enough for most people, but if you are paranoid about security, as you seem to be, you don't want to be using checks. The European system, which has largely eliminated checks in favor of payer-initiated push transactions, is safer by design. They are networked machines and they talk to all the banks in order to look up the details of your account to provide you with that money. The protocol they use has known vulnerabilities.  A blackhat conference about 5 years ago they made one of the machines output money onto the street. I use online banking and bill pay for all accounts where I can control when and how much is paid, where I push the funds out.  The bills from those companies that want to be allowed to reach into my account and pull money automatically (e.g. my Chase mortgage) I simply will not enroll - they get a paper check in the mail. There is no way I am giving these cocksucker criminals *permission* to take money out of my accounts. "Stock prices are set by bidding. In principle, a seller will say, ""I want $80."" If he can't find anyone willing to buy at that price, he'll either decide not to sell after all, or he'll lower his price. Likewise, a buyer will say, ""I'll pay $70."" If he can't find anyone willing to pay that price, he'll either decide not to buy or he'll increase his price. For most stocks there are many buyers and many sellers all the time, so there's a constant interplay. The typical small investor has VERY little control of the price. You say, ""I want to buy 10 shares of XYZ Corporation and my maximum price is $20."" If the current trending price is below $20, your broker will buy it for you. If not, he won't. You normally have some time limit on the order, so if the price falls within your range within that time period, your broker will buy. That is, your choice is basically to buy or not buy, or sell or not sell, at the current price. You have little opportunity to really negotiate a better price. If you have a significant percentage of a company's total stock, different story. In real life, most stocks are being traded constantly, so buyers and sellers both have a pretty good idea of the current price. If the last sale was ten minutes ago for $20, it's unlikely anyone's going to now bid $100. They're going to bid $20.50 or $19.25 or some such. If the last sale was for $20 and your broker really came to the floor and offered to buy for $100, I suppose someone would sell to him very quickly before he realized what an outrageous price this was. I use TD Ameritrade, and on their web site, if I give a price limit on a buy that's more than a small percentage above the last sale, they reject it as an error. I forget the exact number but they won't even accept a bid of $80 if the stock is going for $40. They might accept $41 or $42, something like that."