![](bg3.png)
overall security. It should be ensured that sensitive fi-
nancial operations are carried out in trusted networks,
or at least well protected, although one should be par-
ticularly careful when using WiFi, because of the lat-
est Krack attack against algorithm WPA-2 (Vanhoef
and Piessens, 2017).
We take a psychological approach to determine
the level of security. If the “low level” corresponds to
what is currently used as the standard, the user would
likely switch to a better solution, i.e. two-factor secu-
rity or biometrics (intermediate). On the other hand, it
is easier to downgrade the level of security by “one”,
giving up biometrics, but in the end, we get a higher
level of security than the one we started with.
When using a user password, we recommend
masking it and requesting only selected characters in-
stead of entering the whole password, thus ensuring
protection against interception of the entire password
during a single session and thwarting attempts at anal-
ysis of the way of writing (keystroking attacks). It
does not apply if one would like to use a password
manager, thus those two solutions are excluding each
other.
2.3 Anti-phishing
Users lack awareness of how hacking attacks are con-
ducted and do not realize that they are not targeted
but automated, based on phishing and installation of
malware on victims’ devices. Large-scale phishing
attacks (automatic attacks) affect payment and settle-
ment agents as well as the banks themselves through
which the adversary extorts all data from the user, in-
cluding logins, passwords, confirmations, and codes.
These attacks are carried out most often in the form
of impersonating legitimate banking websites. Coun-
termeasures provide in-depth control of addresses of
the origin of emails or links and verification of SSL
certificates.
In response to this challenge, practical educational
campaigns with a psychological element should be
developed. Such actions can be carried out through
a tool for simulated social-technical attacks based on
phishing along with an educational aspect. The ba-
sis of this solution should be to determine the level of
awareness and competence of employees and users of
digital banking in the area of social-technical attacks.
Based on our results of research, effective ways of in-
forming about conducted attacks and potential threats
should be developed, combined with effective educa-
tion of users.
Most people have never experienced a hacking at-
tack and therefore have no idea what emotions are as-
sociated with it. Lack of awareness of cybersecurity
is due, among other things, to a lack of understanding
of the consequences of an attack and the emotions that
are associated with it. Simulation of a social-technical
attack in controlled conditions is to be a kind of shock
connected with emotional stress, which will allow to
effectively assimilate the transmitted information, un-
derstand what the attack is and what emotions a vic-
tim of social-technical attack experiences. The con-
cept of emotionally based messages is presented in
Figure 1. The figure represents three levels of emo-
tion that can be caused in users, according to the de-
gree of education one wants to achieve. The headings
and content of the messages displayed to the user af-
ter wrong behavior (e.g. click on the phishing link)
should be aligned to kind and strength of emotions
we would like to invoke. The authenticity of those
feelings and the whole experience during the process
is crucial for educational objectives and remembering
abilities.
Notably, some sensitive data used by banks to
authenticate their clients are (to some extent freely)
available via legitimate channels and media and as
such do not require sophisticated phishing attacks.
Perhaps the greatest example of all is the mother’s
maiden name widely used as an “established secret”
between the bank and the customer. While guessing
a random victim’s mother’s maiden name may indeed
seem impossible, it needs to be stressed that banking
attacks can be directed against a particular person – in
which case such guesswork is greatly simplified. Es-
tablishing a back-up password based on details of the
client’s life seems to have originated many years ago
when a certain operating system granted access to the
computer by such method in case the password is lost
or forgotten. While this might be a valid solution to a
stationary computer, it is certainly not applicable to a
banking account with non-personal access capability.
Of course, there is still the problem of respon-
sive, substitute websites that can act as an interme-
diary between the user and the correct service (MiTM
attack), and intercept communication and dynami-
cally generate content. To mitigate this type of threat
one needs to take care of protection against the mal-
ware software and especially control the permissions
of various applications and plugins on mobile device
or web browser. Given the level of threat and pos-
sible negative outcomes of a successful attack, but
also the financial and organizational power of banks,
we strongly suggest certificate pinning methodology
(Oltrogge et al., 2015), not only for browser-based
online banking but especially for mobile application
development.
In the telephone channel, we recommend the use
of a defined reverse password, for which the user may
Security Issues of Electronic and Mobile Banking
633