Bank account (payment account): what it is and how it is attacked
Where money goes, and who it belongs to.
Also known as
- payment account
- beneficiary account
- receiving account
- money
- payee
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Fraud diagrams end at money and most object libraries cannot draw it, so the last hop gets described in prose. Drawing it shows how few steps separate an email from an irreversible transfer.
How it gets attacked, and what reduces it
How it gets attacked
- Details changed on an existing supplier record rather than a new payee created
- Money split and moved onward within hours, faster than any recall
- An account in another jurisdiction, which ends practical recovery
What reduces it
- Verify any change of details by calling a number held before the request arrived, never one supplied with it
- Separate the person who can change a payee from the person who can release a payment
- Report to the bank within hours rather than days, because recall is a race and it is usually already lost
Where it sits
- Group
- Places · Physical locations and regions.
- Whose side, by default
- Not established · Whose side this is on has not been established. The honest setting for outside infrastructure early in an investigation.
- Catalogue identifier
- bank-account
Reviewed . CC BY 4.0.
Others in places
The places group carries every object in it, including the ones with no page of their own.
Bank account on your own diagram
Open the editor, press N, and type payment account. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker