Аналіз вразливостей систем дистанційного банківського обслуговування щодо надмірного розкриття персональних даних користувачів

Abstract

This paper explores a privacy vulnerability within PrivatBank's digital infrastructure, specifically regarding the excessive disclosure of personal data in P2P transaction receipts. The research demonstrates how a legitimate user can exploit low-value transfers to systematically harvest sensitive information, including Full Names and Tax IDs (RNOKPP). By analyzing the structure of generated PDF receipts, the author identifies a significant vector for automated reconnaissance, which allows for the extraction of a customer's birth date and gender. The study concludes that this implementation represents a flawed architectural choice that facilitates targeted social engineering and identity theft.