A description of attack scenarios over a two-year period illustrates several key security issues with Internet banking systems in Norway. Given the banks' security-by-obscurity policy, online customers knew little about security levels and falsely believed their assets were safe.