Actually I think you'd find that it you ask a lawyer on this there are things (i.e. laws) stopping them from capturing this information. Is your opinion just that or is it based on an analysis of NZ laws?
Yes, stealing this information is against the law. Pages that capture online banking usernames and passwords and pretend that they're the bank are known as phishing or ghost websites. POLi's page is functionally equivalent - it presents you with a bankname.paywithpoli.com page (e.g. from the article, commbank.apac.paywithpoli.com/netbank/Logon/Logon.aspx for CBA). It looks exactly like your bank's logon page, but it's actually somewhere else. The assumption that POLi don't
keep your details is still an unknown. I don't think they do, but there's nothing (technically, based on their solution architecture) stopping them from doing it.
-
Note, up until these articles started flying around, i.e. about 3 days ago, POLi displayed a "Bank URL" box and a Padlock that made it look more like you were on the bank's page, but they've now removed that.
You'll also notice that if you try to visit any links on the bank page that aren't "log in", that your mouse will change to a little "no" symbol and you can't do that, and if you hover over and look down the bottom you'll see the link is to a page hosted by POLi. So, if you've forgotten your password, you can't follow that link.
For them to say that they don't capture your credentials is complete hogwash, because they're sent to POLi's "secure server". (But you have to take their word on that, who knows what security practices they actually observe).
After POLi gets them, they replay them to the bank server in the back end.
There are a few things that are "stopping them" from
keeping your credentials:
- Decency, and reputability (i.e. they're
probably not an evil company that's out to steal your information)
- It is indeed illegal
But the nature of their service is that they
capture them (in all likelihood to just send to the bank). But
what they do is evil.
Banks disable phishing/ghost websites daily, and all will tell you to only ever log in if you've typed the bank URL in yourself, and not followed a link. Whether the link is in a spam email, or from a payment page on Jetstar, technically speaking, you're still being socially engineered into doing something you think is actually something else.
POLi's old system of requiring an ActiveX control which observed you doing a transaction while you logged into the actual internet banking was an order of magnitude less evil, in my opinion anyway.
Sorry for the somewhat off topic post.
