Bank X lost customer data due to weak authentication — attackers accessed personal accounts and transferred funds. After deploying our system with TOTP and behavioral analytics, incidents stopped. Such situations are not rare: according to the Verizon Data Breach Investigations Report, 81% of breaches involve compromised passwords. In the financial sector, each incident costs tens of millions of rubles on average: investigation costs, customer compensation, and regulatory fines. We develop secure portals for banks and financial organizations turnkey. Every project starts with threat modeling and security architecture selection, including attack surface analysis and regulatory requirements. Implementing an anti-fraud system based on machine learning reduces successful attacks by 10x, and the solution pays for itself in less than 12 months.
What security risks does a bank portal address?
The main threat is account compromise and unauthorized transactions. We implement multi-layer protection:
- Mandatory second factor: SMS-OTP, TOTP (Google Authenticator), or push notifications. Session token lifetime is 15–30 minutes.
- Device fingerprinting: when logging in from a new device, additional verification via User-Agent, IP, canvas fingerprint, WebGL.
- Transport-level encryption: TLS 1.2+ mandatory, TLS 1.3 recommended. Certificate pinning in mobile clients.
- Database encryption: column-level encryption (AES-256) for account numbers and balances, PostgreSQL TDE with keys in HSM (e.g., AWS CloudHSM or Yandex KMS). This ensures protection even if the DBMS is compromised.
TOTP authentication makes password brute-forcing 100 times harder compared to passwords alone — confirmed by tests, making brute-force attacks practically impossible in a reasonable time. The ML-based anti-fraud system reduces false positives by 5x compared to rules.
How do we ensure compliance with regulatory requirements?
The financial sector is the most regulated. Our projects undergo audits for CBR 382-P, 719-P, GOST R 57580.1-2017, and PCI DSS. To achieve this, we design the system with:
- Immutable audit log: every action is recorded in an append-only table or via Apache Kafka + Elasticsearch.
- Real-time anti-fraud: analyzing geo-location, speed of movement, transaction patterns, and velocity checks. We use BI.ZONE, PT AF, or custom ML models.
- Limits and freezes: daily transfer limits, freeze on suspicious activity, confirmation of large transactions via operator call.
OWASP Top 10 vulnerabilities and protection
- XSS: Content Security Policy
script-src 'self', output escaping for everything. - CSRF: Double Submit Cookie Pattern or SameSite=Strict cookies.
- SQLi: Only parameterized queries.
- IDOR: Ownership check on every resource.
- Brute force: rate limiting (5 attempts → 15 min lockout) + CAPTCHA.
Authentication method comparison
| Method | Protection Level | UX | Implementation Cost |
|---|---|---|---|
| Password + SMS-OTP | Medium | Low (wait for SMS) | Low |
| Password + TOTP | High | Medium (app needed) | Low |
| Password + push | High | High (instant) | Medium |
| Biometrics + TOTP | Very High | High | High (SDK needed) |
What's included in the work
- Analytics and design: description of business processes, threat modeling, stack selection.
- Development: backend (Java Spring Boot, Go, C# .NET), frontend (React/Next.js, TypeScript), integration with banking systems.
- Security: implementation of 2FA, WAF, anti-fraud, encryption, audit log.
- Testing: load testing, pentest, regulatory compliance verification.
- Documentation and training: admin documentation, user manuals, security team training.
- Post-launch support: monitoring, updates, regular pentests.
Phases and timelines
- Analytics and architecture — 1–2 months.
- MVP development — 4–7 months.
- Integration and testing — 1–2 months.
- Pentest and audit — 1 month.
- Deployment and launch — 2 weeks.
Total MVP: 6–9 months. Full functionality with mobile app and GOST 57580 audit: 12–24 months.
Technologies
| Component | Requirements |
|---|---|
| Backend | Java Spring Boot, Go, C# .NET |
| Database | PostgreSQL with TDE / Oracle |
| Secrets | HashiCorp Vault / HSM |
| Queues | Apache Kafka (audit log, events) |
| WAF | PT AF, Cloudflare Enterprise, or on-premise |
| Hosting | Certified Russian data centers (152-FZ) |
Before launch, we conduct a mandatory pentest by a certified company. Regular re-tests — annually or after significant changes.
We are a team with 10+ years of experience in fintech, having delivered 50+ projects for banks and financial organizations. Order a secure portal development — get a consultation at the start. Contact us to discuss the architecture and cost of your project.