Nordbank Online Banking VDP

Financial services scope. Everything below is in scope for authenticated and unauthenticated testing, using test accounts we issue on request - never a real customer account. Hard limits: no transaction initiation beyond 1 unit of currency, no testing against the payment processor, and immediate stop-and-report if you encounter real customer data. We pay for systemic findings outside the severity table. If you can tell us something true about how our controls are derived rather than where one failed, that is worth more to us than an instance.