How I hacked a bank using pen & paper

The talk examines how Norwegian banks let one customer hand power of attorney over an account to someone else. Online this is tied to BankID, but a one-page paper form remains for elderly, disabled or offline customers. The speaker studied the largest Norwegian bank's version of that form and the information it relies on.

The required details turned out to be largely public. National ID numbers follow a predictable pattern based on birth date and a gender digit, so candidates can be generated and checked against a lookup service with no rate limiting. The bank account number is also exposed through ordinary activity, such as sending a parcel that requires cash on delivery. A phone call to customer service was part of the test, and the completed form, filled in with mixed pens and witnesses who did not grasp their role, was accepted. The account owner was never notified, and the granted access covered ten years of payment history, had a hard-coded expiry date and offered no granular limits.

Disclosure took months, with the bank and the financial supervisory authority informed before the story went public in March 2021. The bank moved to a two-page form requiring more documentation, and the researchers planned to test whether the new version could still be abused. The practical lessons are to treat national ID numbers as identifiers rather than secrets, to notify account holders when access is granted, and to build granular, time-limited delegation with clear logs. The talk also points to ISO 29147 and ISO 30111 as references for vulnerability disclosure and handling.