Question

Many banking websites have you select your own security image when creating your account. For subsequent log ins the image is displayed along with a caption, if you do not see the image and caption you chose, you are instructed not to log in.

What is the purpose of this added step, which type of attacks does it protect against?

Thanks!

Answer 1

Short answer:

Phishing.

Long story:

If you receive a fake email instructing you to log in to your bank account following this link: http://i.am.an.cyber.pirate.com/give/me/your/money/paypal/official/site/ultra/secured/website/

And because you don’t know about that kind of people, you click on it, but since you don’t see your custom image, you know that you are not on the official site, because you, and only you should know about this image.

Let’s say you choosed a picture of your dog and see your neighboor cat, well, don’t log in then.