Bank of America has an online security measure called SiteKey and says, “[W]hen you see your SiteKey, you can be certain you’re at the valid Online Banking website at Bank of America, and not a fraudulent look-alike site.”

But Christopher Soghoian, previously known for publicizing an NWA boarding pass generator, demonstrates how a variant on the “man in the middle” phishing attack can subvert SiteKey and still steal money from unaware consumers. He’s got a movie, too.

While users need take steps to protect themselves, like never clicking banking links in emails, and verifying the URL they’re visiting is correct, it’s plain incorrect for Bank of America to say SiteKey is invulnerable. — BEN POPKEN

A Deceit-Augmented Man In The Middle Attack Against Bank of America’s SiteKey

Service [Slight Paranoia]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.