How does a online only bank protect itself against fraud?
There are Cyber Security and Reporting Standards which Financial Service Provider (Banks and Financial services where customers deposit and/or transact fiat currency) You can find a comprehensive list on Wikipedia under Cyber security standards Depending on the geographic location there might be local Govt requirements such as reporting issues, data security etc. Concerning point 1. We have to differ between a fraudulent customer and an attacker on the banks infrastructure. Fraudulent customers / customers that have been compromised by third parties are identified with but not limited to credit scores and merchant databases or data from firms specialized in "Fraud Prevention". Attackers (Criminals that intend to steal, manipulate or spy on data) are identified/prevented/recorded by but not limited to IDS solutions and attacker databases. For firms that get compensation by insurances the most important thing is the compilant with law and have records of everything, they rather focus on recording data to backtrack attackers than preventing attacks. Concerning point 2. For you as customer the local law and deposit insurance are the most important things. Banks are insured and usually compensate customers on money theft. The authentication and PIN / TAN methods are most crucial but standard - these authentication methods consist of one password and one offline part such as a TAN from a paperletter or a RSA generator or card reader. WRAPUP: Financial institutions have to comply with local law and meet international standards. Banks use highly advanced Intrusion detection and fraud prevention which logically must be based on databases. For the average joe customer there is seldom high risk to lose deposits even if the attackers gains full access to the bank account but this depends a lot on the country you reside in. Concerning targeted attacks: