ING uses DNI as username, allowing anyone to lock accounts

ING locks customer accounts daily because its username is the DNI

The ING access system allows customers to be locked out of their own accounts without theft, without guessing a password, and without any serious breach occurring on paper. The failure lies not in the key, but in the identifier: logging in requires typing the DNI (Spanish National ID) and date of birth, two pieces of information found on any resume posted online. That is enough to attempt access.

A customer of the institution has been unable to operate normally for weeks. Every day, someone tries their identifier, fails to enter the three random characters of the security code, and leaves the access blocked. Recovering it costs a phone call and around an hour of telephone management. The next day, the cycle starts again.

ING's username is the DNI and date of birth

ING does not identify the client with an invented alias, but with their DNI and date of birth. Based on these two fields, a six-digit key is requested, from which the system asks for three random characters. Anyone who knows the first two data points—trivial for an employer, a salesperson, or anyone reading a published resume—can try to access as many times as they want.

They will never guess those three digits, and that is the paradox. The mechanism protects the balance, but not the door. The identifier is not secret, and the blocking system, designed to stop attackers, becomes the tool with which a third party closes the door from outside. At no cost, leaving no useful trace, and requiring no IT knowledge.

Why is the account blocked if nobody guesses the password?

Because the system counts failures per user, not per origin. After the third wrong attempt, the entity blocks the account as a security measure and stops distinguishing between a legitimate holder making a mistake and a third party firing blindly. Each external attempt forces manual reactivation.

The affected person describes it bluntly: anyone who has paid them by card or received a transfer already knows their identifier. The result is a domestic, free, and repeatable denial-of-service attack against which the entity offers no alternative. The most circulated proposal is simple: require a prior factor—a value from the coordinate card, for example—and do not count it as an access failure while that factor is incorrect. This way, the block would only activate when the attempt actually reaches the key.

Ten numbers on a piece of paper: how ING responds to IP requests

The affected person formally requested the IP addresses from which access was being attempted. The response arrived, after a week of discussions, in the form of a sheet with ten noted numbers, sent to an office. Little more than what the interested party could have written down themselves.

Weeks later, the entity communicated that it would no longer send that list. In parallel, the client began receiving messages with unlock codes they had not requested. The comparison between what is asked and what is delivered is, in the words of the victim, "pathetic."

Can you report account blocking without theft?

The answer from consulted police forces is the same: without effective access and without stolen money, the matter remains as attempted fraud and the complaint is not processed. The affected person summarizes this by saying the paperwork is only useful to them.

Some argue that the correct path is to leave a record anyway, as it helps reinforce a subsequent claim against the entity. Others suggest going directly to the duty court when the police station refuses to process the report. The underlying debate is different: if breaking a house lock without entering is punishable, blocking access to another person's account should have similar legal standing.

Electronic certificate does not close traditional route

One proposed solution is to log in with an electronic certificate and request deactivation of old keys. The subsequent check was discouraging: even if entry with the electronic DNI is authorized, the traditional method remains active. The old door is still there, and with it, the blocking risk.

According to the client's account, the director of a branch told them there was no other solution than ceasing to be a customer. Uncommercial advice, and given the facts, probably sincere.

Several entities share the same weak point

The problem is not exclusive to ING. A comparative review by a forum user of half a dozen entities reveals an uncomfortable pattern: COINC asks for email and password without a coordinate card; i-banesto and Openbank use DNI with an eight-digit key; Popular-e uses username and six digits; SelfBank uses username and an alphanumeric password of eight characters; Activobank uses DNI without letter and four digits. According to this user, all allow locking a third party out of their account by failing three times.

In contrast, the Swiss model described by a UBS client seems almost alien: identifier, password, a numeric challenge generated by the web—what they call challenge there—a calculator provided by the bank, the card inserted inside, and its own PIN. In ING Luxembourg, a Digipass device is added, according to another participant. The detail matters: the system already exists, is comfortable to use, and takes barely half a minute more to access.

The complete breakdown of entities, methods, and key lengths, compared point by point, leaves a picture that no entity seems willing to publish.

What can change and what cannot

No entity will give up measuring failed attempts, and it makes sense not to. The discussion is about when the failure starts counting. As long as the identifier remains the DNI and date of birth, any customer with a public resume will be an easy and free target. If any entity changes its stance, it will likely be due to fruta pressure rather than judicial ruling.