# Bank of America, your security isn't very secure (long, requires logic)! **URL:** \ **Category:** The BBQ Pit\ **Created:** [March 23, 2006, 2:56pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591 "2006-03-23T14:56:18Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Happy\_Scrappy\_Hero\_Pup](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@Happy\_Scrappy\_Hero\_Pup](https://boards.straightdope.com/u/Happy_Scrappy_Hero_Pup)\ **Post date:** [March 23, 2006, 2:56pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/1 "2006-03-23T14:56:18Z")
So, today being bill day and all, I decide to fire up teh old intarweb and take care of the **Happy Scrappy Financial Obligations** lickety-split. So I sign on to Bank of America’s website. To log on, I have to give them my account number, password, and state in which I opened my account. So I do so. They don’t recognize my computer (I’m at my school’s library), so they ask me a verification question. Which I answer. Then we come to the dreaded Layer Three of Security!!!twenty-five!! The impergnable, unbustable, uncircumventable Level Three of Security!!!twenty-five!!! They show me a picture I picked with a title I gave it, and ask me to do some loony word-association bit. By looking at the picture, I am supposed to remember the word I associated with that picture, and therefore Bank of America will know it’s really me and then I can Use my money to pay my debt to… Bank of America. See, Bank of America KNOWS that someone who knows my account number, PIN, state of account opening, mother’s middle name, town of my birth, and town of my hich school might not actually be me. So in order to prove that I am REALLY me, I ought to submit to this dime-store Rorshach treatment. One problem. I, like many people who have more than two things to think about, don’t have enough room in my happy scrappy brain to remember what word I associated with a stupid fucking picture forty-five fucking days ago. So I click on the “Forgot Your MMPI Answer?” button. Which pops open a box that says “Call 1-800-HOLD-PLS to obtain your InkBlot pass.” So I call. Now, I don’t see how a security increase is served by forcing a guy to speak aloud all his account information in a public place, but then, I’m just a law student and such things are beyond me. I resolve to ask the operator just how in the blue hell I’m safer, but I don’t get the chance. Call volume is “exceptionally high.” Wait time of five minutes or so. But, according to the voice, if I want to reset my InaneKey, I can follow the instructions on the website. So I figure, “That shouldn’t be that hard. I’ll reset it, they’ll bounce the new one to my e-mail, and I’ll just get it from there. This will serve the dual purposes of ease (as I am qualified to operate electronic mail) and security (as Bank of America has kindly provided an extra layer of passwordism and the evil phishers may not know the linked account).” Simple enough. So I click to reset. Holy crap! Another layer of security! In order to reset my passkey, I must provide them with… account number… PIN… state of account opening. The _same fucking three bits of info_ I had to give them to login in the very first place. So, feeling no small sense of deja vu, I do so. I hit “enter.” I wait for the window that says, “Your reset passkey will be mailed to your linked account.” Instead… _right to my fucking bank screen._ Let me get this straight, you morons. I give you three pieces of information. That’s not enough for you. You need to verify that it’s me. You ask me an inane question. I don’t know the answer. You say I can get around the inane question… by giving you the _exact same three pieces of information you asked for in the first place._ :smack: I dunno about you guys, but this seems more than a little… oh, REALLY FUCKING STUPID. Can anyone explain what I’m missing here? ---
**Author:** ![sunfish](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sunfish](https://boards.straightdope.com/u/sunfish)\ **Post date:** [March 23, 2006, 3:15pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/2 "2006-03-23T15:15:14Z")
You’re missing the idea that the little picture with the name you gave it is supposed to help you recognize that you haven’t been shunted to some phisher’s site, but instead are actually logging into the BoA. It’s not an extra level of ID that you have to provide. The password/PIN that you’re supposed to enter beneath the picture is your usual PIN. When you said you caouldn’t remember it, you were basically saying you couldn’t remember your PIN, so you had to go through the process of resetting it. I know it’s a little nuisance to have had to type in your PIN twice, but that only happens when you log in from a particular computer for the first time. On subsequent visits, all you would see on the home page is the box for your debit card number; then you’d enter your PIN on the next page, underneath the little picture. Sorry, but you just hosed yourself. ---
**Author:** ![Happy\_Scrappy\_Hero\_Pup](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@Happy\_Scrappy\_Hero\_Pup](https://boards.straightdope.com/u/Happy_Scrappy_Hero_Pup)\ **Post date:** [March 23, 2006, 4:20pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/3 "2006-03-23T16:20:52Z")
I wish it were that easy. But it wasn’t my PIN. I tried that. The answer they were looking for is an 8-12 character string including letters and numbers. I get the _idea_ of the passkey. What I don’t get is how easily circumventable it is. ---
**Author:** ![Doctor\_Who](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@Doctor\_Who](https://boards.straightdope.com/u/Doctor_Who)\ **Post date:** [March 23, 2006, 4:30pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/4 "2006-03-23T16:30:39Z")
> [@sunfish](#): > > You’re missing the idea that the little picture with the name you gave it is supposed to help you recognize that you haven’t been shunted to some phisher’s site, but instead are actually logging into the BoA. It’s not an extra level of ID that you have to provide. What he/she said. ---
**Author:** ![Doctor\_Who](https://avatars.discourse-cdn.com/v4/letter/d/ed8c4c/32.png) [@Doctor\_Who](https://boards.straightdope.com/u/Doctor_Who)\ **Post date:** [March 23, 2006, 4:36pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/5 "2006-03-23T16:36:54Z")
> [@Happy Scrappy Hero Pup](#): > > I get the _idea_ of the passkey. What I don’t get is how easily circumventable it is. Because the point is NOT really to add a second password. If you know your password and stuff, you can easily change the passkey (as you did). The point is that if you click on an email saying “Your Acc0unt has been frozen!!!” and it takes you to a “Bank of America” page, then you don’t see the proper picture when you go to log in. You get suspicious. You (maybe) don’t provide your account information to some stupid phisher. - Peter Wiggen ---
**Author:** ![sunfish](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sunfish](https://boards.straightdope.com/u/sunfish)\ **Post date:** [March 23, 2006, 5:38pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/6 "2006-03-23T17:38:19Z")
The comment I get on the site key page, underneath the box for your online banking passcode, says “(4 - 20 Characters. This Online Banking passcode is different from your SiteKey image title or Sitekey Challenge answers.)” My PIN has always worked for me, ever since they introduced the site key thing. I don’t know why it appears differently for you. ---
**Author:** ![LilyoftheValley](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@LilyoftheValley](https://boards.straightdope.com/u/LilyoftheValley)\ **Post date:** [March 23, 2006, 6:15pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/7 "2006-03-23T18:15:13Z")
> [@sunfish](#): > > The comment I get on the site key page, underneath the box for your online banking passcode, says “(4 - 20 Characters. This Online Banking passcode is different from your SiteKey image title or Sitekey Challenge answers.)” > > My PIN has always worked for me, ever since they introduced the site key thing. I don’t know why it appears differently for you. Add me to the list of “same here”. Did it this weekend. ---
**Author:** ![ed](https://avatars.discourse-cdn.com/v4/letter/e/c77e96/32.png) [@ed](https://boards.straightdope.com/u/ed)\ **Post date:** [March 23, 2006, 6:55pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/8 "2006-03-23T18:55:15Z")
The image has _nothing at all to do_ with your sitekey. My Sitekey is the same as my ATM PIN, and it works. If you’re having problems it’s quite likely something is amiss and you’ll need to have it reset. To reiterate the purpose of the picture, it has nothing at all to do with anything you typed in previously. They _tell_ you what you entered in for the description, even. It’s not to prove who _you_ are, it’s to prove who _they_ are to you. ---
**Author:** ![SkipMagic](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skipmagic/32/20706_2.png) [@SkipMagic](https://boards.straightdope.com/u/SkipMagic)\ **Post date:** [March 23, 2006, 7:08pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/9 "2006-03-23T19:08:03Z")
> [@ed](#): > > The image has _nothing at all to do_ with your sitekey. My Sitekey is the same as my ATM PIN, and it works. That’s incorrect, insofar as Bank of America has it set up. (I make no claims about any other bank.) The picture you see is, indeed, your SiteKey; in fact, when you go through the logon process and after you’ve entered your Online ID, you’ll get that picture with “Your SiteKey:” directly above it. Underneath the picture you’ll see an empty field with this label to the side: > [@](#): > > Enter Your Online Banking Passcode: Underneath that empty field are instructions telling you to enter your 4-20 character passcode. I’m not sure why you’d be using your ATM PIN unless you’ve set that up as your account’s passcode. (Mine is different.) ---
**Author:** ![GusNSpot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gusnspot/32/436_2.png) [@GusNSpot](https://boards.straightdope.com/u/GusNSpot)\ **Post date:** [March 23, 2006, 7:12pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/10 "2006-03-23T19:12:19Z")
I hope it is not a normal thing for you to do your electronic banking on public machines… The risk does not seem worth it to me. YMMV ---
**Author:** ![Aserrann](https://avatars.discourse-cdn.com/v4/letter/a/82dd89/32.png) [@Aserrann](https://boards.straightdope.com/u/Aserrann)\ **Post date:** [March 23, 2006, 7:29pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/11 "2006-03-23T19:29:20Z")
> [@ed](#): > > To reiterate the purpose of the picture, it has nothing at all to do with anything you typed in previously. They _tell_ you what you entered in for the description, even. It’s not to prove who _you_ are, it’s to prove who _they_ are to you. Maybe i’m missing something, and i don’t use this particular service… but how does a system to prove your really on the BoA website help when it only comes up after your’ve entered all your other info? or its it all on one page? ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [March 23, 2006, 8:59pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/12 "2006-03-23T20:59:42Z")
> [@Aserrann](#): > > Maybe i’m missing something, and i don’t use this particular service… but how does a system to prove your really on the BoA website help when it only comes up after your’ve entered all your other info? or its it all on one page? You enter your ID number (and the state your account is set up in, unless the computer has that info in a cookie) on the first page. Then, you go to a new page where you see the SiteKey image you selected (to confirm that you are on the genuine BoA site) and are prompted to enter your passcode. ---
**Author:** ![ed](https://avatars.discourse-cdn.com/v4/letter/e/c77e96/32.png) [@ed](https://boards.straightdope.com/u/ed)\ **Post date:** [March 23, 2006, 9:10pm UTC](https://boards.straightdope.com/t/bank-of-america-your-security-isnt-very-secure-long-requires-logic/349591/13 "2006-03-23T21:10:15Z")
> [@SkipMagic](#): > > That’s incorrect, insofar as Bank of America has it set up. (I make no claims about any other bank.) The picture you see is, indeed, your SiteKey; in fact, when you go through the logon process and after you’ve entered your Online ID, you’ll get that picture with “Your SiteKey:” directly above it. Yeah, I mistyped that. I _meant_ that your Sitekey is not related to the passcode. Bleh. Anyways, the passcode for former Fleet people tends to be their ATM pin because of the migration from Homelink; for a lot of people (like myself) the account passcode was defaulted to the ATM pin (Homelink used the ATM pin only for access). I don’t work there anymore but there are some things about Online Banking with them that might surprise most people.