Betfair Security Improvement Ideas/Questions

Great questions, thanks - i'll add them to list.

Just wanted to clarify point 1 above, I meant an optional "Exposure limit" at selection level.  I.e., in the Match Odds market in a football match your maximum exposure could be set to a certain amount on each outcome (if possible, taking into consideration exposure reduction when multiple selections bet on, for example, you layed the draw and the home team).

Getafix for the player protection #2 they need a written request after the 6 months to reopen those parts of the site but I do agree with all the other points. It's about time betfair starting taking the security of peoples money more seriously even the second stage of a dropdown memorable word like the banks use would be a step in the right direction. I emailed asking why the country restrictions were removed and never even had a reply.

Maximum exposure limits *per market* would be a fantastic addition IMO. Not just for account security, but also for protection against stupid typing mistakes! I asked about this in a previous Q&A and Betfair said they 'might look into it'. Of course, nothing came of it.

Another VITAL security feature would be the option to access Betfair completely over a secure connection, ie httpS://www.betfair.com/ - for all betting, not just account login. If you don't think this is important, just google for 'firesheep' and see how easy it is to hack into peoples' facebook accounts and email. Betfair is open and vulnerable to this problem as well.

on your first point I recently tried to transfer some money from my wifes account to mine by placing losing bets in the old days this was never a problem but the next day both accounts were suspended and I was told this was money laundering and if it happened again I would be permanently suspended so I think if someone tried that illegally it would probably be picked up immediately by betfair which is encouraging

Thanks for response so far, the list is growing and think there are some great points.

I noticed a mistake in my original post:

3) Can we be have an option to be emailed/SMS if our ip address changes?  I only ever access my computers from my home pcs
should have been
3) Can we be have an option to be emailed/SMS if our ip address changes?  I only ever access my betting accounts from my home pcs

but I think you worked out what I was going on about.

I would like to just go over a few points:

mc selectaI too am concerned about security and don't really want to have to go down the route of withdrawing all my funds on a Sunday night and redepositing on Saturday morning (as a football gambler).

this is a problem especially when it takes several days for the money to land in your bank account as you end up with having to have much more in your bank account than that needed to cover your bets over several days.  I wonder if the funds, nowadays, can be transferred immediately.  I know certain banks can do it within 2 hours.  Another question added.
I think other options would be to have a 'cool off' period before any new cards can be added or ip addresses used. So you could register a new card but it would take 5 days before it became active.
I don't think the ip cooling off would work because people need access straight away.  I agree with an email notification if a card is added to your account though in this situation I suspect the new account would be traceable, though I don't purport to understand situation with say Neteller/paypal I assume equally as strict?

Ghetto Joe
Getafix for the player protection #2 they need a written request after the 6 months to reopen those parts of the site but I do agree with all the other points.
In that case, it is probably fine as is - I'll take off list. 
It's about time betfair starting taking the security of peoples money more seriously even the second stage of a dropdown memorable word like the banks use would be a step in the right direction. I emailed asking why the country restrictions were removed and never even had a reply.  I emailed asking why the country restrictions were removed and never even had a reply.
Great idea about memorable word with drop downs to select letters, this would certainly get around most of the key loggers.  I suspect the country ip became too difficult to maintain?  But that is bad you got no reply.  Astonishingly, they mustn't see this as being an important issue?  Would be interesting the response to Fine As Frog Hair's questions, in case I worry unnecessarily, but I doubt that!

SHAPESHIFTER - some good points, the https which Mr Magoo refers to would get round most public wifi issues etc but not sure what the burden would be to betfair.  When encrypting the posts to and from the source extra bumf is added to the bandwidth but seeing as the api works completely over https, I don't see why the website can't, I am sure with todays internet speeds the https would be negligable - I'm just trying to gauge what a betfair response would be to this.  The https usage would also get rid of that annoying messagebox that appears everytime I want to go to my account (such a simple fix to this - and has been there for years...anyway I am going off topic!).

Mr Magoo - Thinking this through more, I think your idea of exposure at the market level, instead of selection, would be better. I am thinking of which would be better for the majority of customers (I still need to think this through more)?  The idea here which touches on what "The Management" says about cost to betfair to implement this would be to keep this as low as possible.  Betfair already have the mechanism in place to prevent exposure over a set amount.  It would take very little IT development work, to add a little extra logic to use this same functionality at a market/selection level. So I wouldn't be too bothered whether market or selection I think, as long as bf could implement something quickly on current mechanism.

The Management - I have made requests to the betfair api team before, still not been implemented but is always worth a try as you never know lol.  Thanks for acknowledgement with thought and time, I am sure many others consider these points and have emailed as expressed, fortunately with the q&a and this thread(hopefully), there will be no way bf can avoid answering/action?  One other point, it is of interest to betfair for the following 2 reasons:
1) if the customers are more comfortable with regards their account security they are more likely to leave their funds in their accounts.  I assume betfair make interest from the money in our accounts (admittedly, not much by today's standards but still extra money and esp when the economic conditions improve again) - another question for the list (interest on customer's accounts) ;)
2) bad publicity.


I am the one and only223 I log in and out of my account all the time, so the current display of the ip address for the last 10 log-ins is completely useless.  It might only go back half an hour.  It would be better if they had the last 10 log-ins from each ip-address used to access my account.
I have often thought the same, good point and thanks for reminding me. Added to list.

cragihol
on your first point I recently tried to transfer some money from my wifes account to mine by placing losing bets in the old days this was never a problem but the next day both accounts were suspended and I was told this was money laundering and if it happened again I would be permanently suspended so I think if someone tried that illegally it would probably be picked up immediately by betfair which is encouraging
I can't see how betfair would pick up this information on a highly liquid market, I suspect this was more the result of additional information being used such as a cross-check against surname/address and bet amounts?

hazel
That is very worrying, esp if not to do with the issue expressed by Mr Magoo?

I will post a summary in the next few days, once the topic has been saturated.

Thanks investor, will check that in a minute.

cragihol - just thought, bf could have picked up on this "transferral" if you were using the same internet connection (ip address)?

don't really want to have to go down the route of withdrawing all my funds on a Sunday night and redepositing on Saturday morning

What is difficult about doing that? a few clicks of a mouse is all it takes.

You can withdraw more than 30k i think.

Avocado, I think it is the Visa restriction I refer to.

I have emailed the following:





Hi,

My questions are mainly to do with client security. I would be extremely grateful if you could answer, advise and possibly commit to some of the

questions/ideas/recommendations that follow.  I started a thread to discuss this in more detail here:

http://community.betfair.com/general_betting/go/thread/view/94082/26407401/Betfair_Security_Improvement_IdeasQuestions

because I have no idea when the next q&a session would be I thought a thread would be better to discuss upfront the interests of fellow clients.

The points are discussed in much depth in the above thread but I will rewrite (more succinctly) below:

1) Please can we have an "Exposure limit" at market/selection level not just full account? This would be a fantastic extra as many of us will rarely place a bet above a

certain amount.  If someone hacks your account, they will likely try and transfer your money in several ways (to be explained below) one of which is to place a bet with

the hacked funds and lay it off with their other account.  This I assume would be done with highly liquid events i.e., an important football match where it is nigh on

impossible to see where it would have been transferred.  By having a bet exposure limit, the criminal would have to place numerous bets in order to "transfer" funds.

This could prevent losing the whole bank immediately with the chance of noticing the hack earlier.  Also, it may be possible for betfair security to whittle down the

possible criminals (all users betting in same events). This option would also have another massive improvement as it could help protect clients against spelling

mistakes i.e., backing for £1000 when you meant £100 could be avoided if client had say a limit of £500 defined!

2) Please can we be have an option to be emailed/SMS if our login ip address changes?  Letting us know when an ip login address changes allows us to change passwords /

contact the betfair security team immediately if we know it isn't us.

3) Please can we have options to restrict access from other countries (but no option to unrestrict) - this should be possible by analysing the login ip address.  If we

go on holiday abroad and want to access betfair, maybe lifting of the country restriction should only be allowed by phoning betfair (not a web-account option) - I am

assuming there would be security checks done over phone, maybe also some email confirmation (a link you have to click)?  I believe something like this used to be an

option why has it been removed?

4) I know that if there were unscrupulous employees at betfair, account login info could be easily leaked or could it?  What measures do betfair use to ensure the

security of member's accounts?  I assume there is some kind of top encryption on login details but is there additional security on these databases to prevent say any

betfair developer querying this data?

5) What is the actual history on BF accounts being hacked and monies transferred out ?
Has BF compensated people ?

6) What happens when people add new bank cards to their betfair accounts, can they withdraw funds immediately to these different accounts?  If immediate withdrawal

possible and money was withdrawn to a criminal bank account would this be the responsibility of betfair/the bank/the client?  Perhaps a cool off period would be

beneficial for withdrawals to new cards?  This leads onto next question:

7) Please can we be have an option to be emailed/SMS if sensitive data is changed on the site i.e., password changes, address changes, bank/credit cards added to

account etc.

8) Please can we have a tighter login to the website, i.e., what banks use i.e., select letters from a memorable word/password from drop down boxes - this makes it more

difficult for keyloggers to pick this info up.

9) Please can the whole website be changed to use https (like the api) so that users using public wifi etc have more security (prevent their sessions being cloned etc)?

10) The current security feature on the website shows the last 10 logins, this is not very practical as many users login multiple times during the day.  Instead could

we have a list of all distinct ip addresses with the last time it was used to login (say for last 6 months)?

11) Please can you contact the forumite known as Hazel to rectify a known security problem - "I can log into the account of anyone I know without needing to know their

password. Indeed betfair customer services staff could also breach this security risk."

12) Do betfair have any additional security improvements planned for the future which is not contained in the above list?

Non security related questions:
1) Do betfair earn interest on client's funds?  If so, are client's funds higher than £50k protected?

Hopefully you will see the recommendations as reasonable and push forward such implementation.  I believe this would be a win-win for both betfair and client.  Please

keep an eye on the above thread as I am sure there will be more to debate when your response is published.  I will republish the thread if it get culled after a certain

amount of time (not sure if content expires on this new forum), so just search for the title "Betfair Security Improvement Ideas/Questions" in the General Betting

section in such an event.

Many thanks

Getafix

P.S. - this has taken me a long time to write so please confirm receipt of this email.

excellant stuff lads

Good email, btw.

getafix i don't mind if they contact me. If they don't contact me by Monday I will add the detail to this thread so you can then add it to your Q&A request if you want.

Well done on bringing all this together.

Good email getafix,

I can answer the non security question:
Non security related questions:
1) Do betfair earn interest on client's funds?  If so, are client's funds higher than £50k protected?

Yes they do. "In addition, revenue from management of customer
funds fell by £5.7 million to £2.6 million during the year as a result of the low interest rate environment." this is a quote from Betfair investor relations.

[b]Obviously funds are not protected even below £50k (if you are referring to government guarantees for bank accounts, which I guess you are), that doesn't apply at all.

Getafix, I don't think that's a big worry to be honest.

I know Betfair do indeed hold their money with a wide variety of institutions to minimalise this risk.

You can be extremely confident that Betfair will take the loss if funds are lost, as it would kill the business if they didn't.

Betfair have colossal cash reserves, so I think in this respect your money is safer with Betfair than with a bank.

In other ways your funds are far less secure though. Fraudulent activity being one example. I have had my credit card cloned before, and the bank took the losses (I didn't need to pay), there are rules and laws covering these kind of events, which don't apply to Betting exchanges. That is a far larger concern than a bank holding customer funds going bust.

Getafix - this knowledge is from 3 years  ago but i don't think much has changed.. if your card is fraudulently used and your bank returns the money to you, it is likely although not 100% certain that the funds will be taken off the merchant where the funds were spent. so if someone gets your card details and buys a macbook on Dixons website, your bank will ask Dixons for proof it was you that made the transaction. They will almost certainly be unable to do this, and then your bank will take the money from Dixons and give it to you. It is the exception to the rule where a bank will actually lose money itself by compensating a victim of fraud when the bank is not directly responsible itself.

Is anyone asking any of these on the Q&A tomorrow?

I forgot to mention, it's a credit to betfair that they did get in touch with you Hazel, indicates they do take security extremely seriously.

Getafix sorry for typo - I should have said - I sent the following to livechat

Betfair Live Chat Date Joined: 07 Jun 00
Add contact | Send message When: 14 Dec 10 18:06 Welcome to the forum Q&A, apologies for being 5 minutes late.

We will start to post answers to questions which have been emailed into us in advance. Customers who wish to ask further questions during this session can either respond in this thread, or email their questions to livechat@betfair.com.

Among the Betfair representatives answering questions this evening are Andrew French (UK Community Manager) and Lee Cowles (Director of our UK business).

No option for me to respond in that thread!  Shame.  I'll try and get the main question answered again as it doesn't even look like they've read the question!:

Betfair Live Chat Date Joined: 07 Jun 00
Add contact | Send message When: 14 Dec 10 18:13 Please can we have an "Exposure limit" at market/selection level not just full account? This would be a fantastic extra as many of us will rarely place a bet above a
certain amount.  If someone hacks your account, they will likely try and transfer your money in several ways (to be explained below) one of which is to place a bet with
the hacked funds and lay it off with their other account.  This I assume would be done with highly liquid events i.e., an important football match where it is nigh on
impossible to see where it would have been transferred.  By having a bet exposure limit, the criminal would have to place numerous bets in order to "transfer" funds.
This could prevent losing the whole bank immediately with the chance of noticing the hack earlier.  Also, it may be possible for betfair security to whittle down the
possible criminals (all users betting in same events). This option would also have another massive improvement as it could help protect clients against spelling
mistakes i.e., backing for £1000 when you meant £100 could be avoided if client had say a limit of £500 defined!

We currently offer Loss Limits on our Arcade & Quick Play and Poker products, and there is also transfer limits functionality available on our Exchange Games and Casino products.