# Banking Application Threat Model

Last reviewed: 2026-07-01

Owner: Security engineering
Risk owners: Engineering, finance, compliance, operations, privacy
Architecture reference: `docs/architecture-and-data-flows.md`

## Scope And Method

This threat model covers authentication, money movement, provider webhooks,
administration, cards, crypto/stablecoins, and FX. It uses STRIDE-style threat
discovery plus financial abuse cases. Risk is rated from impact and likelihood:

- Critical: credible loss of customer funds, systemic ledger corruption, bulk
  sensitive-data exposure, signing-key compromise, or regulatory breach.
- High: account takeover, unauthorized privileged action, duplicate external
  execution, material fraud, or prolonged loss of a regulated service.
- Medium: limited disclosure, contained workflow manipulation, or recoverable
  availability impact.
- Low: low-impact misuse with straightforward detection and recovery.

`Present` means a repository control exists. It does not mean a provider, cloud
control, legal process, or external test has been certified. Residual risks must
be resolved or formally accepted by the named risk owner before go-live.

## Protected Assets

- Customer funds, balances, ledger integrity, holds, and settlement state.
- Authentication credentials, sessions, MFA material, recovery codes, and keys.
- PII, KYC evidence, sanctions results, case notes, and regulatory reports.
- Card tokens and limited card metadata; clear PAN/CVV must remain out of storage.
- Crypto addresses, transaction instructions, custody references, and travel-rule
  records; private keys must remain outside this application.
- FX rates, quote terms, treasury positions, and maker-checker decisions.
- Provider credentials, webhook secrets, idempotency keys, and external references.
- Audit history, reconciliation evidence, release artifacts, and operational logs.

## Adversaries And Failure Actors

- External attacker using credential stuffing, phishing, API abuse, injection, or
  denial of service.
- Fraudulent or compromised customer attempting limit evasion, mule activity,
  duplicate execution, or account takeover.
- Malicious, coerced, or compromised employee or administrator.
- Compromised provider, provider credential, webhook secret, dependency, CI job,
  or deployment artifact.
- Software defect, race, stale data, clock skew, retry storm, message reordering,
  database failover, or operator error with the same effect as an attack.

## Trust Boundaries

1. Browser to edge: all headers, tokens, payloads, and client metadata are
   untrusted until authenticated and validated.
2. Edge to API: forwarded headers are trusted only from configured proxy ranges.
3. API/worker to PostgreSQL: database credentials and schema permissions define a
   high-impact boundary; direct operator writes are exceptional and controlled.
4. API/worker to providers: TLS is necessary but does not establish business
   outcome. Idempotency, signatures, references, timeouts, and reconciliation do.
5. API to KMS/evidence storage: workload identity and object-level authorization
   protect secrets and regulated evidence.
6. Production to non-production: customer data and production secrets may not
   cross this boundary without approved anonymization or rotation.
7. Admin/support to customer records: role scopes, step-up, maker-checker, purpose,
   ticket references, and audit evidence constrain insider access.

## Security Invariants

- A customer can read or mutate only resources owned by that customer unless an
  explicit, audited admin scope authorizes access.
- A fiat journal balances per currency, is immutable, and is corrected only by an
  explicit reversal or compensating entry.
- A business intent and provider event are processed at most once for their
  idempotency scope, including under retries and concurrency.
- Unknown external outcomes are investigated and reconciled, never blindly
  retried or marked successful.
- High-risk admin changes require a different checker and sufficient scoped
  authorization; the maker cannot approve their own request.
- Secrets, passwords, MFA seeds, recovery codes, PAN/CVV, and SAR/STR content never
  appear in normal logs, support views, analytics, or unprotected exports.
- Real card and crypto movement stays disabled without approved processor/custody
  boundaries and production evidence.

## Authentication Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| AUTH-01 | Credential stuffing or password spraying takes over accounts | High | Password hashing, distributed rate limits, login attempts, lockouts, suspicious-login events | Tune limits with staging traffic; connect alert routing and breached-password control. Security |
| AUTH-02 | Phished password and OTP create a valid session | High | MFA/TOTP, step-up, session records, remote revocation, passkey data model | Complete browser WebAuthn ceremonies and phishing-resistant admin policy. Security |
| AUTH-03 | Refresh token theft or replay prolongs access | High | Hashed refresh tokens, rotation, expiry, session revocation and anomaly evidence | Verify reuse detection under concurrent refresh and bind risk signals to device/session. Engineering |
| AUTH-04 | Account enumeration through errors or timing | Medium | Generic auth errors and rate limiting | Run DAST/timing tests against production-like edge. Security |
| AUTH-05 | MFA reset or recovery-code flow bypasses the second factor | High | Hashed one-time recovery codes and maker-checker MFA reset records | Operational identity proofing and reset notification must be exercised. Support/Security |
| AUTH-06 | JWT signing or MFA encryption key is exposed | Critical | Managed-secret/KMS configuration gates and key-rotation records | Use real KMS asymmetric signing or managed key policy; rehearse emergency rotation. Security |
| AUTH-07 | Session survives role reduction or security incident | High | Session listing and remote revocation | Automatically revoke affected sessions on role/MFA reset and prove alert delivery. Engineering |

Authentication verification:

- Test login throttling across API replicas and forwarded-IP trust rules.
- Test refresh rotation races, token expiry, revoked sessions, and clock skew.
- Test step-up expiry and ensure an ordinary access token cannot call protected
  admin or customer actions.
- Alert on impossible travel, new device plus high-risk action, repeated MFA
  failure, recovery use, and bulk session revocation.

## Money Movement And Ledger Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| MONEY-01 | Duplicate customer request or retry posts or pays twice | Critical | Idempotency keys, unique records, transactional journals and provider references | Certify idempotency scopes with every provider and load-test concurrent duplicates. Payments |
| MONEY-02 | Race overspends a balance or limit | Critical | Database transactions, account locking patterns, integer money and risk limits | PostgreSQL concurrency tests must cover every real movement path and provider callback race. Engineering |
| MONEY-03 | Direct balance edit bypasses ledger | Critical | Ledger source-of-truth policy, admin maker-checker, audit events and explicit reversals | Restrict production DB roles and alert on writes outside approved service roles. Finance/Security |
| MONEY-04 | Invalid state transition releases or settles held money | High | State transition maps, DB constraints/triggers and manual review workflow | Extend mappings and contract tests to real provider return/recall/reject states. Payments |
| MONEY-05 | Compromised beneficiary redirects payment | High | Ownership checks, routing validation, beneficiary screening, risk checks and step-up UX | Add beneficiary cooling period or confirmation according to product risk decision. Risk |
| MONEY-06 | Timeout creates unknown provider outcome and unsafe replay | Critical | Settlement events, pending/retry/failed states, provider reports and reconciliation | Add provider-specific inquiry-before-retry and circuit-breaker policy. Operations |
| MONEY-07 | Minor-unit or rounding error creates hidden loss | High | Integer minor units, currency rounding policies and FX vectors | Validate all supported currencies and provider conversion conventions. Finance |
| MONEY-08 | Insider issues unauthorized balance adjustment or reversal | Critical | Scoped admin actions, four-eyes adjustment requests, reversal records and audit export | Enforce narrower production scopes and periodic privileged-action review. Finance |

Required monitoring includes duplicate-key conflicts, negative available balances,
state-transition rejects, stale pending transfers, trial-balance non-zero, manual
adjustment volume, and reconciliation breaks by provider/currency.

## Webhook Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| HOOK-01 | Forged callback changes KYC, card, payment, or custody state | Critical | HMAC verification exists for implemented webhook paths | Replace shared local contracts with each provider's signing scheme, key IDs and rotation. Security |
| HOOK-02 | Valid event is replayed to duplicate effects | Critical | Event deduplication and replay/idempotency tests | Enforce provider-specific timestamp windows and durable unique event IDs. Engineering |
| HOOK-03 | Events arrive out of order and regress state | High | Explicit state transitions and event history | Define ordering/version policy per provider; quarantine gaps and regressions. Operations |
| HOOK-04 | Large or malformed payload exhausts resources or exploits parser | High | Strict JSON handling and edge controls | Set route-specific body/time limits and fuzz provider payload decoders. Security |
| HOOK-05 | Secret leaks through logs, diagnostics, or source control | Critical | Redacted structured logging, secret scanning and managed-secret gates | Add provider payload redaction fixtures and rotate secrets on any suspected exposure. Security |
| HOOK-06 | Acknowledgement is sent before durable processing | High | Transactional repositories for business changes | Contract-test acknowledgement timing and use inbox/queue pattern where provider retry SLAs require it. Engineering |
| HOOK-07 | Callback storm saturates DB and API | High | Rate limiting, observability and card/webhook-storm runbook | Add provider-specific queue/backpressure and capacity test at contracted burst rate. Operations |

Webhook handlers must preserve the raw bytes required for signature verification,
then parse into a strict provider schema. Signing success is not authorization to
perform an invalid state transition.

## Admin And Backoffice Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| ADMIN-01 | Broad admin role enables unrelated high-risk actions | Critical | Scope assignments, JIT elevation model and role dashboards | Define production role catalog, deny-by-default scopes and quarterly access review. Security |
| ADMIN-02 | Maker and checker collude or one account performs both actions | Critical | Different-user database checks and maker-checker APIs | Require strong admin MFA, reviewer independence policy and collusion monitoring. Risk |
| ADMIN-03 | Support impersonation exposes secrets or mutates money | High | Time-limited, ticket-bound, audited view-session model with allowed actions | Complete frontend enforcement and sample support-session reviews. Support/Security |
| ADMIN-04 | Audit evidence is altered or selectively omitted | Critical | Append-oriented audit records, integrity verification and evidence exports | Export to immutable/WORM storage with independent access and retention proof. Security |
| ADMIN-05 | Notes/attachments become a malware or data-exfiltration path | High | Metadata references, checksums and classifications | Add private object storage, malware scanning, content limits and signed URL expiry. Security |
| ADMIN-06 | Bulk export leaks PII or SAR material | Critical | Admin-only exports and role controls | Add purpose capture, field-level redaction, export watermarking and download alerts. Privacy |
| ADMIN-07 | JIT elevation is never removed | High | Expiring elevation request records | Enforce expiry at authorization middleware and verify active-scope revocation. Engineering |

Privileged actions must record actor, effective scopes, step-up/session identifier,
reason, ticket or approval reference, target, before/after values, request ID, and
timestamp. Break-glass access requires separate credentials, dual authorization,
immediate alerting, and next-business-day review.

## Card Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| CARD-01 | PAN/CVV is stored or logged, expanding PCI scope | Critical | One-time sensitive response type, redaction tests, tokenized metadata policy | Validate processor-hosted/tokenized production flow with QSA and DLP tests. Security |
| CARD-02 | Forged authorization or clearing event moves money | Critical | Webhook secret, deduplication, state and ledger event records | Implement certified processor signature/mTLS/IP policy and contract fixtures. Cards |
| CARD-03 | Hold is not released, is released twice, or clearing exceeds hold | High | Hold/clearing/reversal/expiry lifecycle and explicit ledger events | Run processor certification vectors including partial/incremental clearing. Finance |
| CARD-04 | Frozen/canceled card still authorizes | Critical | Local lifecycle enforcement and issuer sync calls | Define issuer consistency SLA and fail-closed response for stale lifecycle state. Cards |
| CARD-05 | Spending limits are stale between app and processor | High | Spending-limit sync records and risk limits | Reconcile processor limits and alert on drift before enabling spend. Operations |
| CARD-06 | Dispute workflow is abused or loses evidence | Medium | Dispute records, notifications and case history | Integrate processor deadlines/evidence formats and customer authentication policy. Cards |

No real card traffic is permitted until processor integration, PCI scope and
validation path, tokenization/key ownership, webhook certification, and dispute
operations are approved.

## Crypto And Stablecoin Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| CRYPTO-01 | Private key or signing authority enters application scope | Critical | Custody responsibility model and provider-only key boundary | Contractually and technically prove HSM/MPC custody and privileged approval model. Security |
| CRYPTO-02 | Address substitution sends withdrawal to attacker | Critical | Address screening and compliance gates | Add authenticated address confirmation, cooling period and custody-side allowlisting. Risk |
| CRYPTO-03 | Wrong chain/network causes irreversible loss | Critical | Asset/network controls and stablecoin network allowlists | Require exact custody asset/network identifiers and customer confirmation. Operations |
| CRYPTO-04 | Unconfirmed/reorged deposit is credited as final | High | Pending/confirmed/failed/reversed chain lifecycle | Configure confirmations and reorg handling per asset/network with custody provider. Finance |
| CRYPTO-05 | Sanctioned or high-risk address bypasses screening | Critical | Blockchain analytics provider interface and screening records | Contract real-time plus ongoing analytics; define stale-screening and outage behavior. Compliance |
| CRYPTO-06 | Travel-rule data is absent or leaked | High | Travel-rule workflow records and restricted data classification | Obtain jurisdiction decision, select secure interchange and minimize retained data. Compliance |
| CRYPTO-07 | Stablecoin depeg, issuer freeze, or bridge failure harms customers | High | Issuer monitoring and deposit/withdraw network controls | Connect market/issuer alerts and automated approved suspension thresholds. Risk |
| CRYPTO-08 | Provider callback or API compromise fabricates chain state | Critical | State/event history and provider references | Independently verify chain facts where feasible and reconcile custody reports. Security |

Real crypto movement remains disabled by default until legal scope, custody,
screening, travel rule, network controls, recovery, and incident response have
production evidence.

## FX Threats

| ID | Threat and abuse case | Risk | Present controls | Residual action and owner |
| --- | --- | --- | --- | --- |
| FX-01 | Stale or manipulated rate gives customer or bank unfair price | High | Source timestamps, quote expiry, stale monitoring and maker-checker rate changes | Connect contracted market data, independent tolerance checks and alerting. Treasury |
| FX-02 | Quote is reused or accepted after expiry | High | Stored quote status/expiry and conversion transaction | Concurrency-test single use and monitor rejected stale quote attempts. Engineering |
| FX-03 | Fee/spread is hidden or differs from execution | High | Stored quote disclosure fields and customer disclosure UI | Legal approval of market wording and receipt comparison tests. Product/Legal |
| FX-04 | Conversion posts one currency without the other | Critical | Atomic balanced conversion journals and trial balance | Run failover/serialization tests on every supported currency pair. Finance |
| FX-05 | Admin alters rates without independent approval | Critical | FX rate-change maker-checker and audit export | Narrow treasury scopes and independent daily rate-change review. Treasury |
| FX-06 | Fallback feed silently serves old or divergent prices | High | Source/fallback policy model | Set bounded age/deviation and explicit fail-closed rules per currency pair. Treasury |
| FX-07 | Treasury exposure grows beyond approved limits | High | Treasury position/PnL reporting and risk events | Add live exposure limits, hedging process and independent valuation source. Finance |

## Cross-Cutting Threats

| ID | Threat | Required treatment |
| --- | --- | --- |
| CROSS-01 | SQL injection, broken object authorization, or mass assignment | Parameterized SQL, ownership checks, strict request structs, contract/DAST/pentest evidence |
| CROSS-02 | Dependency or build-chain compromise | Pinned dependencies, review, vulnerability scans, signed images, provenance and digest deployment |
| CROSS-03 | Secret exposure | Managed secrets, workload identity, rotation, redaction tests, secret scanning and incident runbook |
| CROSS-04 | Database compromise or operator error | Private network, least-privilege roles, immutable evidence export, PITR and restore drills |
| CROSS-05 | Availability attack | Edge rate limits/WAF, autoscaling policy, bounded timeouts, backpressure and degraded feature flags |
| CROSS-06 | Sensitive telemetry | Structured allowlisted fields, redaction, restricted access and retention controls |
| CROSS-07 | Clock manipulation/skew | UTC timestamps, synchronized infrastructure and bounded token/webhook/quote windows |
| CROSS-08 | Tenant/resource authorization regression | Negative authorization tests for every object endpoint and admin scope |

## Security Test And Evidence Plan

Before a real-money launch, attach evidence for:

1. Threat-model review by engineering, security, finance, compliance, operations,
   privacy, and each selected provider owner.
2. API authorization and object-ownership tests, provider webhook contract tests,
   money-movement race/idempotency tests, and database invariant tests.
3. DAST against staging plus an independent penetration test covering customer,
   admin, provider, and support surfaces.
4. KMS/secret access review, emergency key rotation drill, production DB-role
   review, and immutable audit-export proof.
5. Provider certification for payment, card, identity, sanctions, market-data, and
   custody contracts that are in launch scope.
6. Incident exercises for account takeover, webhook storm, provider unknown
   outcome, reconciliation break, ledger imbalance, data breach, and crypto/card
   compromise where those products are enabled.

## Review And Risk Acceptance

Review this model at least quarterly and whenever a trust boundary, provider,
regulated product, authentication method, payment state, custody model, card-data
flow, or privileged role changes. Every unresolved Critical or High item requires
a named owner, due date, compensating control, and written acceptance by security
and the accountable business/risk owner. A document update alone does not close a
production gate; linked technical, contractual, and exercise evidence is required.