Online bank 'was fraud target for two years'

The online bank accounts of 3.1 million UK customers at HSBC may have been exposed to hacking or fraud for at least two years, it was claimed today.

An investigation by researchers at Cardiff University discovered hackers would be able to break into a victim’s account in fewer than 10 attempts.

HSBC said it had not noticed any criminal activity as a result of the “supposed flaw” and insisted fraud at its internet banking system was substantially lower than market average.

A report in The Guardian said criminals could use gadgets called “keyloggers” to record every keystroke made by a victim and then use the data to access their bank account.

It means a hacker would be able to change the account information and address, transfer money, arrange big bank loans or order foreign currency.

Computer experts told The Guardian the problem is easy to fix and said other banks had more secure systems to protect customers using Iinternet banking.

HSBC played down the discovery, but said it was always looking to upgrade security measures and would study the results of the investigation.

A spokesman said: “HSBC would be very interested to hear any expert commentary on the security of its personal internet banking service.

“However, in this instance, the supposed flaw uncovered is not one we have seen criminals use.

“It is an extremely sophisticated attack that would require a time-consuming focus on one individual victim, which was not not likely to be a profitable way for criminals to behave.

“Online fraud via HSBC’s internet banking system is substantially lower than the market average and we are satisfied our customers are adequately protected.”

Keylogger is a kind of surveillance software that is readily available on the internet and offers the chance for PC users to keep tabs on what people are using the computer for.

In January, City watchdog the Financial Services Authority (FSA) said consumer confidence in internet banking was very fragile.

It said half of internet users claimed they were either extremely or very concerned about the risk of fraud when making an online transaction.

The regulator found while many consumers were taking steps to protect themselves against fraud, such as by installing security software, more than a quarter did not know when they last updated it.