Beware! A very serious security issue in Angel Broking: Anyone can see the documents you uploaded if they know your phone number

Brokers
1

Here is how to reproduce the issue:

  1. Visit https://www.angelbroking.com/open-demat-account

  2. Enter the phone number you want to view details for.

  3. If they signed up for the platform, you will get all their details and see the documents they uploaded. They don’t do any mobile number OTP verification.

For a demo: I created a dummy profile using 9324116954. Try entering this number in the form. Don’t worry it’s unused phone number from angel broking support team, so no harm to anyone.

The example shows the account which is not fully created. While I am yet to test for a fully created account, I think it might also work for them too (although with some extra complicated steps).

Edit: I have already contacted them. Posting it to raise awareness since they obviously don’t care.

3

@siva it isn’t legal right , to have such loosenes in security and privacy

4

The Support guy should be fired. Let me escalate the issue with them. This is serious. Thanks for posting.

5

@VarunAgw @unofficed What happened next? Is the above security issue resolved now?

6

Angelone is not a safe platform. I inform their security team about the issue where i attempted 50 account and were success to login in 48 account(other 2 might be closed) eventhough this is serious issue i raise with them many times they not resolved for 2 to 3 years and seems like that is still there.

7

I don’t think this is true. When I opened the link and entered a random mobile number it said enter OTP sent to the mobile number.

1 Like
8

It looks like the security issue is fixed now. However, I will be thinking twice to invest further via AngelOne.