Once you've logged in, in order to do any transaction you'd need to know challenge-response number from a key list (say, "enter security ID #75"). Needless to say, the lists are totally random and I have the only copy.
Of course that doesn't stop people from creating scam sites, where front page looks exactly like the banks official site (with a slightly different address)
Then it asks you to "confirm" all your personal information, including "10 next keycodes" (which should be more than enough to empty your account)
And yes, too many people still fall for that. Luckily some people created software, that will fill those scam sites with random information, thus making it harder to locate the details of real people.
Personally I don't consider this a security problem, rather some users being way too stupid. But I guess it was becouse of that, that my bank started asking the codes in random order.
