10/10/2024
To the Security Team at Westpac
I am writing to express serious concerns about the inadequacies in your security protocols, particularly in light of your claims of being a highly secure institution.
How is it possible that your online banking system allowed the same user to log in concurrently from two different cities without raising any red flags? This should have been an obvious and immediate cause for alarm.
A review of Westpac’s logs shows that for the past year, all logins were consistently from a single IP address tied to one business location. However, despite this clear pattern, your system allowed an unusual IP address to initiate multiple transactions totaling over $1 million within an hour. These logins, from two different geographic locations, occurred within just one minute of each other, and yet no alerts or warnings were triggered.
While I acknowledge that social engineering was involved and that a token code was eventually provided to the fraudster, this was a rudimentary attack that should have been easily detected and blocked by even the most basic security measures.
Westpac has so far shifted the blame entirely onto the customer, denying any responsibility. This response is completely unacceptable given the clear security failures on your part.
As an IT provider, I can offer guidance on educating users about scams and online threats, but this attack highlights deficiencies in your systems, not just user error. You claim to have advanced systems for detecting unusual activity—surely in this day and age, you are utilizing AI for threat detection and pattern analysis? If not, it is time to allocate some of your profits toward improving your threat detection capabilities and protecting your customers.
Where is the protection for your clients?
